漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2013-043635
漏洞标题：清华大学某分站SQL注入
相关厂商：清华大学
漏洞作者： saar
提交时间：2013-11-22 15:18
修复时间：2014-01-06 15:18
公开时间：2014-01-06 15:18
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2013-11-22： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-01-06： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
清华大学某分站SQL注入
详细说明：
注入地址：
IP:166.111.4.39
影响:
该IP下有清华的12站点，均为清华的站点，
注入地址:
第一枚：
http://www.rsta.tsinghua.edu.cn/search/qyjmxx.php?userid=293
第二枚:
http://www.rsta.tsinghua.edu.cn/search/zjhcxx.php?userid=285
数据库啊，好多表。估计很多站的数据库都是在这个数据库里的。
Database: hdm0050741_db
[103 tables]
+------------------------+
| xh_admin |
| xh_admin_role |
| xh_admin_role_priv |
| xh_ads |
| xh_ads_place |
| xh_ads_stat |
| xh_announce |
| xh_area |
| xh_ask |
| xh_ask_actor |
| xh_ask_credit |
| xh_ask_posts |
| xh_ask_vote |
| xh_attachment |
| xh_author |
| xh_block |
| xh_c_bkyd |
| xh_c_down |
| xh_c_hyfc |
| xh_c_info |
| xh_c_ku6video |
| xh_c_news |
| xh_c_picture |
| xh_c_product |
| xh_c_video |
| xh_cache_count |
| xh_category |
| xh_collect |
| xh_comment |
| xh_content |
| xh_content_count |
| xh_content_position |
| xh_content_tag |
| xh_copyfrom |
| xh_datasource |
| xh_digg |
| xh_digg_log |
| xh_editor_data |
| xh_error_report |
| xh_form_bdxx |
| xh_form_jishuzixun |
| xh_form_yjsk |
| xh_formguide |
| xh_formguide_fields |
| xh_guestbook |
| xh_hits |
| xh_ipbanned |
| xh_keylink |
| xh_keyword |
| xh_link |
| xh_log |
| xh_mail |
| xh_mail_email |
| xh_mail_email_type |
| xh_member |
| xh_member_cache |
| xh_member_company |
| xh_member_detail |
| xh_member_group |
| xh_member_group_extend |
| xh_member_group_priv |
| xh_member_info |
| xh_member_qyhy |
| xh_menu |
| xh_message |
| xh_model |
| xh_model_field |
| xh_module |
| xh_mood |
| xh_mood_data |
| xh_order |
| xh_order_deliver |
| xh_order_log |
| xh_pay_card |
| xh_pay_exchange |
| xh_pay_payment |
| xh_pay_pointcard_type |
| xh_pay_stat |
| xh_pay_user_account |
| xh_player |
| xh_position |
| xh_process |
| xh_process_status |
| xh_role |
| xh_search |
| xh_search_type |
| xh_session |
| xh_space |
| xh_space_api |
| xh_special |
| xh_special_content |
| xh_spider_job |
| xh_spider_sites |
| xh_spider_urls |
| xh_status |
| xh_times |
| xh_type |
| xh_urlrule |
| xh_vote_data |
| xh_vote_option |
| xh_vote_subject |
| xh_vote_useroption |
| xh_workflow |
+------------------------+
漏洞证明：
注入地址：
IP:166.111.4.39
影响:
该IP下有清华的12站点，均为清华的站点，
注入地址:
第一枚：
http://www.rsta.tsinghua.edu.cn/search/qyjmxx.php?userid=293
第二枚:
http://www.rsta.tsinghua.edu.cn/search/zjhcxx.php?userid=285
数据库啊，好多表。估计很多站的数据库都是在这个数据库里的。
Database: hdm0050741_db
[103 tables]
+------------------------+
| xh_admin |
| xh_admin_role |
| xh_admin_role_priv |
| xh_ads |
| xh_ads_place |
| xh_ads_stat |
| xh_announce |
| xh_area |
| xh_ask |
| xh_ask_actor |
| xh_ask_credit |
| xh_ask_posts |
| xh_ask_vote |
| xh_attachment |
| xh_author |
| xh_block |
| xh_c_bkyd |
| xh_c_down |
| xh_c_hyfc |
| xh_c_info |
| xh_c_ku6video |
| xh_c_news |
| xh_c_picture |
| xh_c_product |
| xh_c_video |
| xh_cache_count |
| xh_category |
| xh_collect |
| xh_comment |
| xh_content |
| xh_content_count |
| xh_content_position |
| xh_content_tag |
| xh_copyfrom |
| xh_datasource |
| xh_digg |
| xh_digg_log |
| xh_editor_data |
| xh_error_report |
| xh_form_bdxx |
| xh_form_jishuzixun |
| xh_form_yjsk |
| xh_formguide |
| xh_formguide_fields |
| xh_guestbook |
| xh_hits |
| xh_ipbanned |
| xh_keylink |
| xh_keyword |
| xh_link |
| xh_log |
| xh_mail |
| xh_mail_email |
| xh_mail_email_type |
| xh_member |
| xh_member_cache |
| xh_member_company |
| xh_member_detail |
| xh_member_group |
| xh_member_group_extend |
| xh_member_group_priv |
| xh_member_info |
| xh_member_qyhy |
| xh_menu |
| xh_message |
| xh_model |
| xh_model_field |
| xh_module |
| xh_mood |
| xh_mood_data |
| xh_order |
| xh_order_deliver |
| xh_order_log |
| xh_pay_card |
| xh_pay_exchange |
| xh_pay_payment |
| xh_pay_pointcard_type |
| xh_pay_stat |
| xh_pay_user_account |
| xh_player |
| xh_position |
| xh_process |
| xh_process_status |
| xh_role |
| xh_search |
| xh_search_type |
| xh_session |
| xh_space |
| xh_space_api |
| xh_special |
| xh_special_content |
| xh_spider_job |
| xh_spider_sites |
| xh_spider_urls |
| xh_status |
| xh_times |
| xh_type |
| xh_urlrule |
| xh_vote_data |
| xh_vote_option |
| xh_vote_subject |
| xh_vote_useroption |
| xh_workflow |
+------------------------+
修复方案：
过滤呗
版权声明：转载请注明来源 saar@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝