sql miranda db

Discussion in 'Песочница' started by brown, 16 Feb 2017.

  1. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    189
    Likes Received:
    8
    Reputations:
    1
    Нашел скулю но хз как ее раскрутить.При добавлении в site.ru/id=6694'union select
    изменяется эта строка
    NewOrder->GetMasterOrder('6694 UNION...')


    ERROR!
    Exception code: 1064
    Exception message:
    You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''' at line 4
    Thrown by: 'DbMysql.class.php' on line: 177
    Stack trace: #0DbMysql.class.php(62): DbMysql->throwMysqlException()
    DbControl.class.php(104): DbMysql->query('SELECT c.*, om....')
    DbControl.class.php(283): DbControl->initiate()
    DbControl->fetchOneRow('SELECT c.*, om....')
    NewOrder->GetMasterOrder('6694 UNION...')
     
    #1 brown, 16 Feb 2017
  2. st55

    st55 Level 8

    Joined:
    20 Apr 2016
    Messages:
    185
    Likes Received:
    312
    Reputations:
    47
    Так не разобраться. Но предположу что возможен error-based вектор.
     
    #2 st55, 16 Feb 2017
    SeytaR likes this.
  3. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    189
    Likes Received:
    8
    Reputations:
    1
    Пробывал и еррорбасед и мапом гонял,нифига(
     
    #3 brown, 16 Feb 2017
  4. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    189
    Likes Received:
    8
    Reputations:
    1
    You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''' and 1=1 U' at line 6

    он добавляет сам запрос в ошибку
     
    #4 brown, 16 Feb 2017
  5. artkar

    artkar Well-Known Member

    Joined:
    14 Nov 2016
    Messages:
    350
    Likes Received:
    331
    Reputations:
    6
    Могу предположить с вероятностью 0,76 что инъекция сплотабельная и это тот случай когда нужен ручной подход к инжекции
     
    #5 artkar, 17 Feb 2017
  6. erwerr2321

    erwerr2321 Elder - Старейшина

    Joined:
    19 Jun 2015
    Messages:
    4,126
    Likes Received:
    25,618
    Reputations:
    147
    Кто он?
     
    #6 erwerr2321, 17 Feb 2017
  7. leksadin

    leksadin Level 8

    Joined:
    19 Jan 2016
    Messages:
    121
    Likes Received:
    60
    Reputations:
    12
    можешь кинуть ссылку в личку - посмотрим
     
    #7 leksadin, 17 Feb 2017
  8. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    189
    Likes Received:
    8
    Reputations:
    1
    Думаю WAF )
     
    #8 brown, 17 Feb 2017
  9. brown

    brown Member

    Joined:
    16 Oct 2016
    Messages:
    189
    Likes Received:
    8
    Reputations:
    1
    как мапу указать на эту строку DbControl.class.php(104): DbMysql->query?
     
    #9 brown, 26 Feb 2017
(You must log in or sign up to post here.)