当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156508

漏洞标题：某协会SQL注入导致五百多个数据库泄露

相关厂商：cncert国家互联网应急中心

漏洞作者： 雅柏菲卡

提交时间：2015-11-30 00:24

修复时间：2016-01-18 10:36

公开时间：2016-01-18 10:36

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-30： 细节已通知厂商并且等待厂商处理中
2015-12-04： 厂商已经确认，细节仅向厂商公开
2015-12-14： 细节向核心白帽子及相关领域专家公开
2015-12-24： 细节向普通白帽子公开
2016-01-03： 细节向实习白帽子公开
2016-01-18： 细节向公众公开

简要描述：

................

详细说明：

..................

漏洞证明：

Target: 		http://**.**.**.**/getMainBusiness.asp?id=0
Host IP:		**.**.**.**
Powered-by: 	ASP.NET
Web Server: 	yunjiasu-nginx
DB Server: 	MSSQL 2005 with error
Resp. Time(avg):	207 ms
Current User: 	web376151
Sql Version: 	Microsoft SQL Server  2000 - 8.00.2055 (Intel X86) 
	Dec 16 2008 19:46:53 
	Copyright (c) 1988-2003 Microsoft Corporation
	Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2)
Current DB: 	www_gdase_com
System User: 	web376151
Host Name: 	WNWG-003
Server Name: 	IDC-D-790
		master
		tempdb
		model
		msdb
		pubs
		Northwind
		www_test-s-x-d_com_cn
		www_aliyana_cc
		www_n_ss_com_cn
		www_rdgs_gov_cn
		www_999pharm_com_cn
		www_21ppm_com
		www_wweus_com_cn
		www_cwlib_com
		www_8no_net_cn
		www_is800_net
		www_fcintershop_cn
		net7741491
		www_zzybook_com
		net9497047
		net6327455
		www_xstyd_com
		www_xwyslj_com
		www_changminghome_com
		www_wonsnow_cn
		www_world-jpyoshida_cn
		net5400058
		net2784142
		www_ebizi_com_cn
		www_120yisheng_com
		www_cnbxg_net
		www_ccfeiyang_com
		www_dicube_com_cn
		www_cncyls_com
		www_jinlongtang_com
		www_xingyilian_com_cn
		www_gophh_com
		www_mingwei_cn
		www_fdasfdsafdsa_com
		www_waychance_cn
		www_waychance_com
		www_82866_cn
		www_dlfuhai_com
		www_hhtljzbw_com
		www_nhsww_com
		net2754397
		www_it5151_com
		www_wuhcontrol_com
		www_dadegroup_com
		www_eadata_com_cn
		www_hgmeng_com
		www_shiprepair_xgsy_com
		www_lm8688_com
		www_wffzsyxx_com
		www_bjhunqing_com
		www_hk_assoc_org
		net0420564
		www_ezdata_com_cn
		www_ehm2008_com
		www_chinasuiling_com
		www_china_lfpe_com
		www_jhhl_cn
		www_sg_micro_com
		www_tobon_com
		www_sefon_com_cn
		www_balixianjing_com
		www_unison-china_com
		www_cuteseo_cn
		www_oyotoon_com
		www_liyiqun111_com_cn
		www_mzzjy_com
		www_aid_net_cn
		www_dgmj_org
		net8713174
		www_hnprint_com
		www_pmyljt_com
		www_0510qc_com
		www_zlove999_com
		www_52xuezi_com
		www_xpxgx_com
		www_yitemedia_com
		net8533249
		net4311428
		www_da1314_com
		www_3prelax_com
		www_gyjinyuan_com
		www_xeros_cn
		net6020411
		www_thomasint_cn
		net1297290
		net8720009
		www_sendws_com
		www_hrbfur_com
		www_gdase_com
		www_hnslly_com
		www_37women_com
		web2619988
		www_c1wyse_com
		www_motoham_com
		www_piao111_com
		www_chinablz_com
		www_bfsiliao_net_cn
		www_024tour_com
		www_hlj95558_cn
		www_xingpaibilliard_com
		www_nj_car_cn
		www_jiadawatch_com
		www_sywcyc_com_cn
		www_tkfacility_com_cn
		www_inginc_com_cn
		wu4296
		www_cnrubberinfo_net
		www_jato56_com
		www_cbs88_cn
		www_gqe_cn
		www_yhqh_net
		net4326655
		www_bbt88888_cn
		www_hutoon_com
		net8699894
		www_meixl_com
		www_cnjockey_com
		www_city_gou_com_cn
		www_ght365_com
		www_aduos_com
		www_axgww_com
		www_haosumeng_com
		www_10000dns_com_cn
		www_anquandiyi_com
		net9069891
		www_elory_com_cn
		www_wolfu_cn
		host1378114
		www_simc_com_cn
		www_lovegogo_net
		www_yichaofs_com
		net4851543
		www_86099999_com
		www_lnvei_com
		www_it68_cn
		net3724019
		www_100zssj_com
		www_luxbetter_com
		www_51tijian_sh_cn
		www_sxdtest090709_com
		www_bdlsz_com_cn
		net89582945
		net0994778
		net8909926
		net3785762
		net8351836
		www_deckome_com
		net0823707
		www_npk_com_cn
		www_belt800_com
		www_jiluhome_com
		www_chinahaomenmian_com
		www_cdsilverstone_com
		www_wewinner_com_cn
		www_sometea_coffee_com
		host8543980
		www_yuantongtang_com
		net2546266
		www_huqin2_com
		www_huqin3_com
		www_sq_net_cn
		www_wisdomshtest_com
		net4756106
		www_gladoffice_com
		www_leadertech_com_cn
		www_china_iraq_org
		host0501119
		www_tdht_com_cn
		www_baokaisoft_com
		net9468975
		www_hysdjj_com
		www_cbi_hk
		www_qss2008_cn
		www_ceohq_cn
		net8693067
		www_bellaes_net
		www_chinabcy_com
		www_dtdsh_com
		www_zjgbbs_net
		net8455282
		www_jiuhe_com
		www_jiufu68_com
		net2166023
		www_cn_grease_com
		www_qdyixingroup_com
		net3431207
		www_hk521_com_cn
		www_csfddea_cn
		www_hnindustry_com
		www_liyiqun999_com
		www_liyiqun1002_cn
		www_liyiqun1003_com_cn
		www_zdxybj_com
		www_zhcjda_com
		net0806475
		www_cnzywh_com
		www_jinren_cc
		www_microchannel_com
		www_microchannelservice_com
		www_wslsoft_com_cn
		net5005941
		www_naluwan_com_cn
		www_qilecc_com
		net6850576
		www_sgczj_gov_cn
		www_gwp_cn
		www_tjevercare_com
		net9087680
		host3911165
		net5452582
		host4953748
		www_lefen_com
		web58389
		net6329008
		net9365957
		net9978308
		net4539576
		net7803201
		net1689244
		net7742077
		net9966975
		net75001995
		net5250692
		net1542771
		host7390693
		host9524051
		web1830149
		net5436390
		net2152203
		net2854109
		host2754217
		net0290042
		web637814
		net4991420
		net6693231
		web474131
		net0576335
		host9489592
		net2562539
		net8819049
		net36852879
		net3180457
		net6329356
		host5673177
		host8456735
		net2737250
		net7644808
		net39726121
		net0499143
		www_ahauto_org_cn
		net1950007
		net2496883
		net3083296
		host3213965
		net8503389
		net4596837
		net0009543
		net2806494
		net8194661
		net1386098
		net0458485
		net9496924
		net4726170
		net4199169
		net7207521
		net0561044
		net1552040
		net4755792
		net8778869
		net2643721
		web954196
		net1555944
		www_bestguilin_com
		net4463611
		net2182316
		net9360887
		net3759885
		web2154812
		net8563531
		net8949194
		net7603581
		net6033528
		net9678773
		net1707048
		host4510823
		net2243895
		net0039996
		net4856862
		net4120240
		net7192445
		net9364604
		host7310659
		host6852376
		net1763557
		net8532553
		host6719636
		host8088951
		net1566271
		net7937752
		net3377705
		net2764478
		net9271314
		net3090975
		net0628268
		net4812264
		net5132300
		net7172698
		net4279448
		net64173325
		net3236446
		host6482227
		net2122304
		net9040012
		net6560806
		net3047680
		web576591
		net2616794
		net94425810
		net7399178
		net1855444
		net9706544
		net8052049
		net1339215
		net3497921
		host6338996
		net2773683
		net26735695
		net3751335
		net96540152
		net0442724
		net6327766
		net8494822
		net3130740
		net1868879
		net3118772
		net9134635
		net7230602
		net4119467
		net6789109
		net3421476
		net1871736
		net6060140
		net9355785
		host4354658
		net6519990
		net3702823
		net2336327
		net0825673
		net0410950
		host2537375
		net4809300
		net7298334
		net6088413
		net7760048
		net6825640
		net4711462
		net5590691
		net6551058
		net1340474
		net21464830
		net4061370
		net5755645
		net2992759
		net6272623
		net1968126
		net6308567
		net8560426
		net1482148
		net2208597
		net4720240
		net7039661
		net4995465
		net8866978
		net8143670
		net4094845
		net1420720
		net9226953
		net3049279
		net5196720
		web2111756
		net8527482
		net5768987
		host1712937
		net9602869
		net9556871
		net4507722
		net8551878
		net5718462
		www_shop0757_com-auditing
		net3163108
		host5865346
		host8337771
		net1444085
		web647483
		host3995324
		net8525361
		net2104687
		net3075769
		net7474178
		net8076007
		net61408189
		net7452831
		net3854911
		net1241228
		net7773108
		net2018916
		net3085598
		net6962510
		net7256799
		net3014989
		net7862535
		net9653365
		net5554033
		net9607658
		net9610100
		net4122192
		net7605456
		net4412664
		testdavy410
		net1076405
		net8267198
		net7402301
		net3900947
		net9304794
		net1413410
		net2321116
		net6059360
		net6724213
		net3477020
		net9955660
		web430448
		net7874131
		net25498882
		net7448533
		net8967507
		net1675980
		net3315736
		net5211504
		net8080953
		net7356772
		net0937926
		net01693939
		net3045276
		net4058452
		net7248717
		net2018433
		net04048492
		net7400248
		net6843153
		net4758889
		net7071958
		net4520061
		net1641624
		net8025159
		net1038342
		net8411403
		net0189789
		net2403228
		host3863874
		net0122037
		net0384765
		net5110536
		net2380989
		net4539838
		net9009432
		net1285125
		net9373840
		net5498774
		net8812019
		net9943685
		net1617011
		net2451416
		net7191453
		net4436011
		net7228870
		net5955265
		net4873582
		net9805406
		net4472466
		net4291094
		net7686679
		net5674656
		net25222712
		net3048959
		net7173255
		net1359183
		net4889355
		net1945047
		net6402004
		net9427613
		net2010379
		net39934914
		net8364040
		net1839433
		net7965401
		net1579737
		net4508121
		net2612480
		net6962364
		net6595934
		net7855813
		net9172773
		net6934615
		net7441808
		net9622924
		net8960007
		net9913839
		net4408583
		net3048072
		net6535119
		net5073676
		net8361935
		net1980920
		net3130342
		net7324297
		net3788926
		net1870819
		net1239202
		net8478761
		host1612511
		net8875986
		net11040562
		web1700750
		net4931313
		net3116416
		net2054071
		net7144518
		net0938756
		web331952
		net2901375
		net3565899
		net0336717
		net4530611
		net3813235
		net6890451
		net9760985
数据库那么多 还包括政府的  危害性不做阐述了

修复方案：

...........

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-12-04 10:19

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给广东分中心，由广东分中心后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评价