当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0145442

漏洞标题: 四川某市财政局SQL注入已进后台

相关厂商:cncert国家互联网应急中心

漏洞作者: 老男孩

提交时间:2015-10-09 11:23

修复时间:2015-11-27 17:32

公开时间:2015-11-27 17:32

漏洞类型:SQL注射漏洞

危害等级:低

自评Rank:1

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-09: 细节已通知厂商并且等待厂商处理中
2015-10-13: 厂商已经确认,细节仅向厂商公开
2015-10-23: 细节向核心白帽子及相关领域专家公开
2015-11-02: 细节向普通白帽子公开
2015-11-12: 细节向实习白帽子公开
2015-11-27: 细节向公众公开

简要描述:

SQL 注入

详细说明:

注入点: http://**.**.**.**/view/list?type=notice

6.PNG


后台地址: http://**.**.**.**/login.jsp

3.PNG


1.PNG


2.PNG


另一个数据库
网站后台:http://**.**.**.**/nchwhs/login.jsp

4.PNG


+----------------------------------+----------+
| 805785ae4cfa6423f2b98e4aa1ee11da | ncczkjk |
| f14d0713a84770e5652f7d05c4043df6 | system |
+----------------------------------+----------+

5.PNG


漏洞证明:

Database: alecms
[18 tables]
+----------------------------------------------+
| alecms_article |
| alecms_ask |
| alecms_document |
| alecms_examination |
| alecms_examunser |
| alecms_mailask |
| alecms_mailunser |
| alecms_menu |
| alecms_newsnenter |
| alecms_paper |
| alecms_resource |
| alecms_role |
| alecms_role_res |
| alecms_system_user |
| alecms_unser |
| alecms_webcase |
| alecms_webtable |
| menu |
+----------------------------------------------+
Database: account
[14 tables]
+----------------------------------------------+
| account_acc |
| account_continueweb |
| account_log |
| account_message |
| account_news |
| account_recordweb |
| account_resource |
| account_result |
| account_role |
| account_subscribe |
| account_unqualified |
| account_user |
| account_webmenu |
| account_webnumber |
+----------------------------------------------+
Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances |
| events_waits_current |
| events_waits_history |
| events_waits_history_long |
| events_waits_summary_by_instance |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name |
| file_instances |
| file_summary_by_event_name |
| file_summary_by_instance |
| mutex_instances |
| performance_timers |
| rwlock_instances |
| setup_consumers |
| setup_instruments |
| setup_timers |
| threads |
+----------------------------------------------+
Database: nchwhs
[13 tables]
+----------------------------------------------+
| user |
| ask |
| document |
| log |
| menu |
| role |
| singlearticle |
| site |
| unser |
| usergroup |
| usergroup_role |
| userinfo |
| userlog |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+----------------------------------------------+
Database: flowoams
[16 tables]
+----------------------------------------------+
| user |
| docover |
| grouprole |
| misfile |
| missive |
| officialanduser |
| officialfile |
| officialreceive |
| offimark |
| offinum |
| organization_table |
| pms_dictionary |
| pms_official_audit |
| role |
| usergroup |
| usermis |
+----------------------------------------------+
Database: information_schema
[40 tables]
+----------------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_STATS |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMPMEM_RESET |
| INNODB_CMP_RESET |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_TRX |
| KEY_COLUMN_USAGE |
| PARAMETERS |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+----------------------------------------------+

修复方案:

:-)

版权声明:转载请注明来源 老男孩@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:9

确认时间:2015-10-13 17:30

厂商回复:

CNVD确认所述情况,已经转由CNCERT下发给四川分中心,由其后续协调网站管理单位处置.

最新状态:

暂无