当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0203860

漏洞标题：沈阳师范大学某站SQL注入漏洞（DBA权限）

相关厂商：沈阳师范大学

漏洞作者： 路人甲

提交时间：2016-05-02 21:33

修复时间：2016-05-09 09:00

公开时间：2016-05-09 09:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-05-02： 细节已通知厂商并且等待厂商处理中
2016-05-09： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

博学厚德 尚美健行

详细说明：

注入点：

http://cwc.synu.edu.cn/website/secondPages/secondIndex.jsp?i=0&ItemIdType=null&parentItemId=77


具有DBA权限：

1.png


可直接查看数据库用户密码：

2.png


数据库：

Database: tempdb
[2 tables]
+--------------------------------------------+
| sysconstraints                             |
| syssegments                                |
+--------------------------------------------+
Database: data
[6 tables]
+--------------------------------------------+
| OTHER_INCOME_INFO                          |
| SYS_HS_COVER_TWO                           |
| SYS_HS_SALARY_GATHER_TEMP                  |
| dtproperties                               |
| sysconstraints                             |
| syssegments                                |
+--------------------------------------------+
Database: msdb
[82 tables]
+--------------------------------------------+
| RTblClassDefs                              |
| RTblDBMProps                               |
| RTblDBXProps                               |
| RTblDTMProps                               |
| RTblDTSProps                               |
| RTblDatabaseVersion                        |
| RTblEQMProps                               |
| RTblEnumerationDef                         |
| RTblEnumerationValueDef                    |
| RTblGENProps                               |
| RTblIfaceDefs                              |
| RTblIfaceHier                              |
| RTblIfaceMem                               |
| RTblMDSProps                               |
| RTblNamedObj                               |
| RTblOLPProps                               |
| RTblParameterDef                           |
| RTblPropDefs                               |
| RTblProps                                  |
| RTblRelColDefs                             |
| RTblRelshipDefs                            |
| RTblRelshipProps                           |
| RTblRelships                               |
| RTblSIMProps                               |
| RTblScriptDefs                             |
| RTblSites                                  |
| RTblSumInfo                                |
| RTblTFMProps                               |
| RTblTypeInfo                               |
| RTblTypeLibs                               |
| RTblUMLProps                               |
| RTblUMXProps                               |
| RTblVersionAdminInfo                       |
| RTblVersions                               |
| RTblWorkspaceItems                         |
| backupfile                                 |
| backupmediafamily                          |
| backupmediaset                             |
| backupset                                  |
| log_shipping_databases                     |
| log_shipping_monitor                       |
| log_shipping_plan_databases                |
| log_shipping_plan_history                  |
| log_shipping_plans                         |
| log_shipping_primaries                     |
| log_shipping_secondaries                   |
| logmarkhistory                             |
| mswebtasks                                 |
| restorefilegroup                           |
| restorefilegroup                           |
| restorehistory                             |
| sqlagent_info                              |
| sysalerts                                  |
| syscachedcredentials                       |
| syscategories                              |
| sysconstraints                             |
| sysdbmaintplan_databases                   |
| sysdbmaintplan_history                     |
| sysdbmaintplan_jobs                        |
| sysdbmaintplans                            |
| sysdownloadlist                            |
| sysdtscategories                           |
| sysdtspackagelog                           |
| sysdtspackages                             |
| sysdtssteplog                              |
| sysdtstasklog                              |
| sysjobhistory                              |
| sysjobs_view                               |
| sysjobs_view                               |
| sysjobschedules                            |
| sysjobservers                              |
| sysjobsteps                                |
| sysnotifications                           |
| sysoperators                               |
| syssegments                                |
| systargetservergroupmembers                |
| systargetservergroups                      |
| systargetservers_view                      |
| systargetservers_view                      |
| systaskids                                 |
| systasks_view                              |
| systasks_view                              |
+--------------------------------------------+
Database: cwzhcx
[73 tables]
+--------------------------------------------+
| GZ_GRSDS_TMP                               |
| GZ_GRSDS_TMP                               |
| GZ_XMDM                                    |
| GZ_YLBT_TMP                                |
| GZ_YLBT_TMP                                |
| GZ_ZFBT_TMP                                |
| GZ_ZFBT_TMP                                |
| GZ_ZFGJJ_TMP                               |
| GZ_ZFGJJ_TMP                               |
| PBMDM_TMP                                  |
| PBMDM_TMP                                  |
| PBMXZDM_TMP                                |
| PBMXZDM_TMP                                |
| PGNDM                                      |
| PQUERY_FIELD                               |
| PQUERY_FIELD                               |
| PQUERY_TJ                                  |
| PSCWJDY                                    |
| PXMLXDM_TMP                                |
| PXMLXDM_TMP                                |
| PXSDM_TMP                                  |
| PXSDM_TMP                                  |
| PXSZC                                      |
| PXTCS                                      |
| PYHBMQX                                    |
| PYHDM                                      |
| PYHGNQX                                    |
| PYHXMLXQX                                  |
| PZGDM_TMP                                  |
| PZGDM_TMP                                  |
| PZGZC                                      |
| SF_DXJFFZZ_TMP                             |
| SF_DXJFFZZ_TMP                             |
| SF_EXPORT_LM                               |
| SF_IMPORT_LM                               |
| SF_JMMXZ_TMP                               |
| SF_JMMXZ_TMP                               |
| SF_SFMXZ_TMP                               |
| SF_SFMXZ_TMP                               |
| SF_TFMXZ_TMP                               |
| SF_TFMXZ_TMP                               |
| SF_ZJFFZZ_TMP                              |
| SF_ZJFFZZ_TMP                              |
| SF_ZZ_TMP                                  |
| SF_ZZ_TMP                                  |
| XM_MXZ_TMP                                 |
| XM_MXZ_TMP                                 |
| XS_EXPORT                                  |
| XS_IMPORT                                  |
| ZCFG                                       |
| ZW_FZJE_TMP                                |
| ZW_FZJE_TMP                                |
| ZW_KMJE_TMP                                |
| ZW_KMJE_TMP                                |
| ZW_KMNCS_TMP                               |
| ZW_KMNCS_TMP                               |
| ZW_MXZ_TMP                                 |
| ZW_MXZ_TMP                                 |
| ZW_WLZFK_TMP                               |
| ZW_WLZFK_TMP                               |
| ZW_XMCXZCB                                 |
| ZW_XMJE_TMP                                |
| ZW_XMJE_TMP                                |
| ZW_XMNCS_TMP                               |
| ZW_XMNCS_TMP                               |
| ZW_XMSCFZR                                 |
| ZW_XMSCFZR                                 |
| ZW_XMSCXMLX                                |
| dtproperties                               |
| pyhkmqx                                    |
| pyhxmqx                                    |
| sysconstraints                             |
| syssegments                                |
+--------------------------------------------+
Database: pubs
[14 tables]
+--------------------------------------------+
| authors                                    |
| discounts                                  |
| employee                                   |
| jobs                                       |
| pub_info                                   |
| publishers                                 |
| roysched                                   |
| sales                                      |
| stores                                     |
| sysconstraints                             |
| syssegments                                |
| titleauthor                                |
| titles                                     |
| titleview                                  |
+--------------------------------------------+
Database: gxzhcx3
[219 tables]
+--------------------------------------------+
| 111                                        |
| BZJ_FFMX_TEMP                              |
| BZJ_FFMX_TEMP                              |
| BZJ_FFZZ_TEMP                              |
| BZJ_FFZZ_TEMP                              |
| D99_CMD                                    |
| D99_Tmp                                    |
| DM_HS_DEPT                                 |
| DXJ_HDD_TEMP                               |
| DXJ_HDD_TEMP                               |
| DXJ_JM_TEMP                                |
| DXJ_JM_TEMP                                |
| DXJ_MX_TEMP                                |
| DXJ_MX_TEMP                                |
| DXJ_ZZ_TEMP                                |
| DXJ_ZZ_TEMP                                |
| GL_LKDJ                                    |
| GL_PJDJ                                    |
| GL_PJHPDJ                                  |
| GL_PJSFSDM                                 |
| GL_PPJLX                                   |
| GZ_BBZDDY_TEMP                             |
| GZ_BBZDDY_TEMP                             |
| GZ_BCGJJ_TEMP                              |
| GZ_BCGJJ_TEMP                              |
| GZ_BMDM_TEMP                               |
| GZ_BMDM_TEMP                               |
| GZ_FADM_TEMP                               |
| GZ_FADM_TEMP                               |
| GZ_GJJ_TEMP                                |
| GZ_GJJ_TEMP                                |
| GZ_GRSDS_TEMP                              |
| GZ_GRSDS_TEMP                              |
| GZ_GXSSB_TEMP                              |
| GZ_GXSSB_TEMP                              |
| GZ_QTSRMX_TEMP                             |
| GZ_QTSRMX_TEMP                             |
| GZ_XMDM_TEMP                               |
| GZ_XMDM_TEMP                               |
| GZ_ZGDM_TEMP                               |
| GZ_ZGDM_TEMP                               |
| OTHER_INCOME_INFO_BACKUP                   |
| OTHER_INCOME_INFO_BACKUP                   |
| PEXPORT_LM                                 |
| PEXPORT_LM                                 |
| PFBWD                                      |
| PGNDM                                      |
| PGROUP                                     |
| PGZCXFA                                    |
| PGZTLM                                     |
| PGZTYYFA                                   |
| PIMPORT_LM                                 |
| PIMPORT_LM                                 |
| PKMFL                                      |
| PKMLBDM                                    |
| PLBDM                                      |
| PMENUQX_XM                                 |
| PMENUQX_XM                                 |
| PMENU_XM                                   |
| PMENU_XM                                   |
| PQUERY_FIELD                               |
| PQUERY_FIELD                               |
| PQUERY_TJ                                  |
| PSCWJDY                                    |
| PXMZC                                      |
| PXSZC                                      |
| PXTCS                                      |
| PYHBMQX                                    |
| PYHDM                                      |
| PYHGNQX                                    |
| PYHKMLBQX                                  |
| PYHKMQX                                    |
| PYHXMLXQX                                  |
| PYHXMQX                                    |
| PZGZC                                      |
| REPORT_HS_DOWN_TEMPLATE                    |
| REPORT_HS_PRINT_LIMIT                      |
| REPORT_HS_UP_FILE                          |
| SYS_ADD_SALARY_DATECONFIG                  |
| SYS_CONSULT_DEPT                           |
| SYS_HS_CHECK_SALARYID_RESULT               |
| SYS_HS_CHECK_STATE                         |
| SYS_HS_COVER_FOUR_BACKUP                   |
| SYS_HS_COVER_FOUR_BACKUP                   |
| SYS_HS_COVER_TWO_BACKUP                    |
| SYS_HS_COVER_TWO_BACKUP                    |
| SYS_HS_CURENTACT                           |
| SYS_HS_CUR_MONTH_CHECK                     |
| SYS_HS_FI_DEPT_DUTY                        |
| SYS_HS_FUNCTION                            |
| SYS_HS_OPER_LOG                            |
| SYS_HS_ROLE_FUNCTION                       |
| SYS_HS_ROLE_FUNCTION                       |
| SYS_HS_SALARYID_CHANGE_INFO                |
| SYS_HS_SALARY_GATHER_BACKUP                |
| SYS_HS_SALARY_GATHER_BACKUP                |
| SYS_HS_SALARY_GATHER_TEMP_BACKUP           |
| SYS_HS_SALARY_GATHER_TEMP_BACKUP           |
| SYS_HS_SENDBACK_REASON                     |
| SYS_HS_UP_DATE_CONFIG                      |
| SYS_HS_UP_PER_INFO_TEMP                    |
| SYS_HS_UP_PER_INFO_TEMP                    |
| SYS_HS_VACATION_CONFIG                     |
| SYS_HS_VER_SALARYID                        |
| SYS_HS_WINDOW_INFO                         |
| SYS_HS_WORKFLOW_STEP                       |
| SYS_RT_EXPORT_DBASE3                       |
| SYS_RT_TEMP_SALARY_GATHER                  |
| V_CHECK_WCOMPLETE                          |
| V_CHECK_WIN_DEPT                           |
| V_CHECK_WSHOULD                            |
| V_DEPT_UP_PER_INFO                         |
| V_OPER_LOG                                 |
| V_PER_INFO_TYPE                            |
| V_ROLE_FUNCTION_QUERY                      |
| V_ROLE_FUNCTION_QUERY                      |
| V_WINDOW_GATHER                            |
| V_WINDOW_PER_INFO                          |
| XS_BMDM_TEMP                               |
| XS_BMDM_TEMP                               |
| XS_JMMXZ_TEMP                              |
| XS_JMMXZ_TEMP                              |
| XS_PBJDM_TEMP                              |
| XS_PBJDM_TEMP                              |
| XS_PSFQJ_TEMP                              |
| XS_PSFQJ_TEMP                              |
| XS_PSFXM_TEMP                              |
| XS_PSFXM_TEMP                              |
| XS_PXSDM_TEMP                              |
| XS_PXSDM_TEMP                              |
| XS_PXSLY_TEMP                              |
| XS_PXSLY_TEMP                              |
| XS_PXSXZ_TEMP                              |
| XS_PXSXZ_TEMP                              |
| XS_PXSZT_TEMP                              |
| XS_PXSZT_TEMP                              |
| XS_PZYDM_TEMP                              |
| XS_PZYDM_TEMP                              |
| XS_SFMXZ_TEMP                              |
| XS_SFMXZ_TEMP                              |
| XS_SFZZ_TEMP                               |
| XS_SFZZ_TEMP                               |
| XS_TFMXZ_TEMP                              |
| XS_TFMXZ_TEMP                              |
| ZW_BMDM_TEMP                               |
| ZW_BMDM_TEMP                               |
| ZW_BMXZ_TEMP                               |
| ZW_BMXZ_TEMP                               |
| ZW_FZJE_TEMP                               |
| ZW_FZJE_TEMP                               |
| ZW_KMDM_TEMP                               |
| ZW_KMDM_TEMP                               |
| ZW_KMJE_TEMP                               |
| ZW_KMJE_TEMP                               |
| ZW_MXZ_TEMP                                |
| ZW_MXZ_TEMP                                |
| ZW_WLZFK_TEMP                              |
| ZW_WLZFK_TEMP                              |
| ZW_XMDM_TEMP                               |
| ZW_XMDM_TEMP                               |
| ZW_XMEDKZLR                                |
| ZW_XMEDKZLR                                |
| ZW_XMEDZCKM                                |
| ZW_XMEDZD                                  |
| ZW_XMJE_TEMP                               |
| ZW_XMJE_TEMP                               |
| ZW_XMLX_TEMP                               |
| ZW_XMLX_TEMP                               |
| ZW_XMMXZ_TEMP                              |
| ZW_XMMXZ_TEMP                              |
| ZW_XMSCFZR                                 |
| ZW_XMSCFZR                                 |
| ZW_XMSCXMLX                                |
| Zw_xmedzeddz                               |
| Zw_xmedzkz                                 |
| Zw_xmedzzd                                 |
| a                                          |
| comd_list                                  |
| dtproperties                               |
| gz_ffb_01                                  |
| gz_ffb_02                                  |
| gz_ffb_03                                  |
| gz_ffb_04                                  |
| gz_ffb_05                                  |
| gz_ffb_06                                  |
| gz_ffb_99                                  |
| gz_ffpc                                    |
| help1                                      |
| help1                                      |
| p000000000000000000000000000               |
| p000000000000000000000000000               |
| pan                                        |
| pan                                        |
| pyhsfxmqx                                  |
| pyhxsxzqx                                  |
| sds_sysxmdm_show                           |
| sms_boxreceived                            |
| sms_boxsendedfail                          |
| sms_boxsendedfail                          |
| sms_boxsending                             |
| sms_chargeinfo                             |
| sms_feedbackconfig                         |
| sms_metone_reginfo                         |
| sms_module2mobile                          |
| sms_mt_param_ref                           |
| sms_regmobile                              |
| sms_sendconfig                             |
| sms_sysconfig                              |
| sms_thread_info                            |
| sysconstraints                             |
| syssegments                                |
| tmp                                        |
| xs_zyffb                                   |
| zw_wyls                                    |
| zw_xmedkzmxz                               |
| zwxmfzr                                    |
| zwyhtzgl                                   |
| zwyhtzlx                                   |
| zwyhtzyh                                   |
+--------------------------------------------+
Database: master
[37 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS       |
| INFORMATION_SCHEMA.COLUMNS                 |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE     |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES       |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE  |
| INFORMATION_SCHEMA.DOMAINS                 |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS      |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE        |
| INFORMATION_SCHEMA.PARAMETERS              |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES                |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS         |
| INFORMATION_SCHEMA.SCHEMATA                |
| INFORMATION_SCHEMA.TABLES                  |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS       |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES        |
| INFORMATION_SCHEMA.VIEWS                   |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE       |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE        |
| MSreplication_options                      |
| dtproperties                               |
| spt_datatype_info_ext                      |
| spt_datatype_info_ext                      |
| spt_fallback_db                            |
| spt_fallback_dev                           |
| spt_fallback_usg                           |
| spt_monitor                                |
| spt_provider_types                         |
| spt_server_info                            |
| spt_values                                 |
| sysconstraints                             |
| syslogins                                  |
| sysoledbusers                              |
| sysopentapes                               |
| sysremotelogins                            |
| syssegments                                |
+--------------------------------------------+
Database: model
[2 tables]
+--------------------------------------------+
| sysconstraints                             |
| syssegments                                |
+--------------------------------------------+
Database: synufinance
[85 tables]
+--------------------------------------------+
| DKY_BASE_CONDITION                         |
| DKY_BUGET_SPEND                            |
| DKY_COLLEGE_INFO                           |
| DKY_CONTENT_EXPECT                         |
| DKY_CREATE_NEWREWARD_CONF                  |
| DKY_FINISH_APPLY                           |
| DKY_FINISH_FUND                            |
| DKY_FINISH_MEMBERS                         |
| DKY_FINISH_RESULT                          |
| DKY_FINISH_STATEMENT                       |
| DKY_FUNDAPPLY_STATEMENT                    |
| DKY_FUND_APPLY_APPENDIX                    |
| DKY_FUND_APPLY_APPENDIX                    |
| DKY_LOGIN                                  |
| DKY_NEWS_APPENDIX                          |
| DKY_NEWS_INFO                              |
| DKY_NEWS_PICTURE                           |
| DKY_NODE                                   |
| DKY_PROJECT_FUND                           |
| DKY_PROJECT_MEANING                        |
| DKY_PROJECT_MEMBERS                        |
| DKY_PUBLIC_CODE                            |
| DKY_REWARDAPPLY_STATEMENT_bak              |
| DKY_REWARDAPPLY_STATEMENT_bak              |
| DKY_REWARD_APPLY                           |
| DKY_REWARD_DATE_CONF                       |
| DKY_RIGHT                                  |
| DKY_ROLE_RIGHT                             |
| DKY_ROLE_TYPE                              |
| DKY_TIME_CONFIG                            |
| HOPE_LINK_URL                              |
| SYS_ADMINE_APPENDIX                        |
| SYS_ADMIRE_INFO                            |
| SYS_ALL_ADMIRE_INFO                        |
| SYS_ALL_SCORE_LINE_INFO                    |
| SYS_ALL_SPECIAL_ADMISSIONS                 |
| SYS_COLLEGE_INFO                           |
| SYS_COLLEGE_SPECIAL_INFO                   |
| SYS_CONSULT_DEPT                           |
| SYS_CONSULT_INFO                           |
| SYS_CONSULT_SIGN_INFO                      |
| SYS_DICT_DEPARTMENT                        |
| SYS_DICT_STAFF_OWN_PRIV                    |
| SYS_DICT_STAFF_OWN_PRIV                    |
| SYS_DISPLAY_TEMPLATE                       |
| SYS_FUNCTION_PRIVATE                       |
| SYS_ITEM_INFO                              |
| SYS_NEWS_APPENDIX                          |
| SYS_NEWS_INFO                              |
| SYS_NEWS_PICTURE                           |
| SYS_NEWS_PUBLIC_POSITION                   |
| SYS_SCORE_INFO                             |
| SYS_SCORE_LINE_APPENDIX                    |
| V_2009TEMP_FINISHED                        |
| V_ALL_FINISHAPPLY_INFO                     |
| V_ALL_FUND_APPLY_INFO                      |
| V_ALL_REWARD_INFO                          |
| V_DKY_ROLE_RIGHT                           |
| V_PICTURE_NEWS_INFO                        |
| V_STU_FINISH_LIST                          |
| V_TOPIC_INFO                               |
| database                                   |
| dtproperties                               |
| sysconstraints                             |
| syssegments                                |
| v_ALL_SCORE_LINE_INFO                      |
| v_admire_state_info                        |
| v_admission_info                           |
| v_all_admire_info                          |
| v_all_special_admire_info                  |
| v_college_special_info                     |
| v_college_sqecial_info                     |
| v_college_staff_info                       |
| v_depart_coll_staff_info                   |
| v_depart_staff_info                        |
| v_item_info                                |
| v_item_news_info                           |
| v_item_own_news_info                       |
| v_item_public_news_info                    |
| v_parentownitem_news_info                  |
| v_private_info                             |
| v_score_line_info                          |
| v_staff_own_priv                           |
| v_sys_news_info1                           |
| v_sys_news_info1                           |
+--------------------------------------------+
Database: Northwind
[31 tables]
+--------------------------------------------+
| Categories                                 |
| CustomerCustomerDemo                       |
| CustomerDemographics                       |
| Customers                                  |
| EmployeeTerritories                        |
| Employees                                  |
| Invoices                                   |
| Region                                     |
| Shippers                                   |
| Suppliers                                  |
| Territories                                |
| Alphabetical list of products              |
| Category Sales for 1997                    |
| Current Product List                       |
| Customer and Suppliers by City             |
| Order Details Extended                     |
| Order Details Extended                     |
| Order Subtotals                            |
| Orders Qry                                 |
| Orders Qry                                 |
| Product Sales for 1997                     |
| Products Above Average Price               |
| Products Above Average Price               |
| Products by Category                       |
| Quarterly Orders                           |
| Sales Totals by Amount                     |
| Sales by Category                          |
| Summary of Sales by Quarter                |
| Summary of Sales by Year                   |
| sysconstraints                             |
| syssegments                                |
+--------------------------------------------+


点到为止，不继续深入。

漏洞证明：

修复方案：

过滤
希望学校的网站越来越安全！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2016-05-09 09:00

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评价