当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0188876

漏洞标题:百姓大药房漏洞#危及2000W个人详细信息(姓名/身份证/手机号/住址/会员卡余额)

相关厂商:老百姓大药房

漏洞作者: 路人甲

提交时间:2016-03-25 10:26

修复时间:2016-05-09 10:26

公开时间:2016-05-09 10:26

漏洞类型:系统/服务补丁不及时

危害等级:高

自评Rank:12

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-03-25: 积极联系厂商并且等待厂商认领中,细节不对外公开
2016-05-09: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

rtrtrt

详细说明:

mask 区域
1.http://**.**.**/>


老百姓大药房7001反序列getshell

mask 区域
1.http://**.**.**/bea_wls_internal/a.jspx


MIMA:

mask 区域
*****zz*****


jdbc:oracle:thin:@10.254.0.146:1521:lbxolap
user:lbxhis
pass:{AES}ziIISr2E1vCdE2SA+48aNIyasIRD1RK8F9OORvxn4TBgmOkKi76pVJSYS9bCWfXx


MIMA:

mask 区域
*****read*****


部分表数据量统计

HISDATA	A_STOCK_DETAIL	3570128461
HISDATA T_POS_BILL_DETAIL 1155551516
HISDATA T_STOCK_201601 890063764
HISDATA T_STOCK_201602 826416956
HISDATA T_STOCK_201512 790399099
HISDATA T_STOCK_201603 775068805
HISDATA T_STOCK_201511 724544542
HISDATA T_STOCK_201510 659636373
HISDATA T_POS_GOODSALL_SUM 655613225
HISDATA T_POS_GOODS_SUM 655221592
HISDATA T_POS_GOODSALL_SUM_T 654967156
HISDATA T_POS_GOODSSUM_D 648417790
HISDATA T_STOCK_AMOUNT_201601 648087113
HISDATA T_STOCK_AMOUNT_201512 636144320
HISDATA T_STOCK_201509 600728809
HISDATA T_STOCK_AMOUNT_201602 590456738
HISDATA T_STOCK_AMOUNT_201510 589867404
HISDATA T_STOCK_AMOUNT_201511 587396940
HISDATA T_STOCK_AMOUNT_201508 562387286
HISDATA T_POS_BILL_PAYMENT 540166452
HISDATA T_STOCK_AMOUNT_201507 538663138
HISDATA T_STOCK_201508 538050648
HISDATA T_POS_BILL_HEADER 530081576
HISDATA T_STOCK_AMOUNT_201509 520222497
HISDATA T_STOCK_AMOUNT_201503 478476333
HISDATA T_STOCK_AMOUNT_201603 473918083
HISDATA T_STOCK_AMOUNT_201501 469689254
HISDATA T_MEMBER_POS_DETAIL 469217972
HISDATA T_STOCK_AMOUNT_201506 469043653
HISDATA T_STOCK_AMOUNT_201412 460221867
HISDATA T_STOCK_201507 458597587
HISDATA T_STOCK_AMOUNT_201505 457048794
HISDATA T_STOCK_AMOUNT_201504 444774748
HISDATA T_STOCK_AMOUNT_201410 438986793
HISDATA T_STOCK_AMOUNT_201502 432937570
HISDATA T_SAP_STOCK_201601 429395501
HISDATA T_STOCK_AMOUNT_201411 426812070
HISDATA T_SAP_STOCK_201511 425766859
HISDATA T_SAP_STOCK_201602 423721560
HISDATA T_SAP_STOCK_201512 418815342
HISDATA T_STOCK_201506 418431632
HISDATA T_STOCK_AMOUNT_201409 414384264
HISDATA T_STOCK_AMOUNT_201408 405839049
HISDATA T_STOCK_AMOUNT_201407 396889295
HISDATA T_STOCK_AMOUNT_201406 376297965
HISDATA T_SAP_STOCK_201510 374631044
HISDATA T_STOCK_AMOUNT_201405 373592301
HISDATA T_STOCK_AMOUNT_201403 368641090
HISDATA T_BILL_DETAIL 365996320
HISDATA T_STOCK_AMOUNT_201404 363036127
HISDATA T_SAP_STOCK_201509 361598796
HISDATA T_BILL_HEADER_DETAIL 360998486
HISDATA T_SAP_STOCK_201603 357223097
HISDATA T_STOCK_AMOUNT_201401 352235245
HISDATA T_SAP_STOCK_201508 349996558
HISDATA T_STOCK_201505 349390501
HISDATA T_STOCK_AMOUNT_201312 335524605
HISDATA T_BILL_HEADER_DETAIL_T 328323292
HISDATA T_STOCK_AMOUNT_201310 324673755
HISDATA T_STOCK_AMOUNT_201308 324517666
HISDATA T_STOCK_AMOUNT_201311 318228079
HISDATA T_SAP_STOCK_201507 315988960
HISDATA T_STOCK_AMOUNT_201307 314177740
HISDATA T_SAP_STOCK_201506 310389836
HISDATA T_STOCK_AMOUNT_201309 309906787
HISDATA T_STOCK_AMOUNT_201305 302661933
HISDATA T_STOCK_AMOUNT_201306 298106844
HISDATA T_SAP_STOCK_201505 296883509
HISDATA T_STOCK_201504 296690395
HISDATA T_STOCK_AMOUNT_201303 293712310
HISDATA T_STOCK_AMOUNT_201304 288957146
HISDATA T_STOCK_AMOUNT_201301 287627978
HISDATA T_STOCK_AMOUNT_201402 287371748
HISDATA T_SAP_STOCK_201504 285336045
HISDATA T_SAP_STOCK_201503 273378091
HISDATA T_POS_CLASS_SUM 265963498
HISDATA T_SAP_STOCK_201501 262178889
HISDATA T_STOCK_AMOUNT_201302 261884222
HISDATA T_STOCK_201503 245316717
HISDATA T_SAP_STOCK_201411 242621596
HISDATA T_SAP_STOCK_201502 242277731
HISDATA T_STOCK_201405 228912498
SAP T_POS_GOODSSUM_D 224055819
HISDATA T_SAP_STOCK_201409 223703491
HISDATA T_STOCK_201406 222780162
HISDATA T_STOCK_201403 219275462
HISDATA T_STOCK_201404 216695264
HISDATA T_MEMBER_POS_SUM_CLASS 216646339
HISDATA T_STOCK_201401 212878042
HISDATA T_SAP_STOCK_201410 212813655
HISDATA T_SAP_STOCK_201408 208290804
HISDATA T_MEMBER_BONUS_USED 200895896
HISDATA T_SAP_STOCK_201407 200155203
HISDATA T_SAP_STOCK_201406 181957128
HISDATA T_POS_DEPTSUM_D 178040867
HISDATA T_STOCK_201402 175843650
HISDATA T_SAP_STOCK_201404 173673912
HISDATA T_SAP_STOCK_201403 173326115
HISDATA T_SAP_STOCK_201405 156999587
HISDATA T_POS_GOODSALL_DEPTSUM 153452486
HISDATA T_SAP_STOCK_201401 150686355
HISDATA T_STORE_IN_RECV_DETAIL 140248116
HISDATA T_SAP_STOCK_201312 138249938
HISDATA T_POS_GOODSSUM_M 132779462
HISDATA T_POS_GOODSALL_SUM_M 127290241
HISDATA T_SAP_STOCK_201402 127045061
HISDATA T_SAP_STOCK_201311 125590046
HISDATA T_SAP_STOCK_201310 124399876
HISDATA T_SAP_STOCK_201309 119030934
HISDATA T_STOCK_201301 111665714
HISDATA T_STOCK_201303 108580372
HISDATA T_MEMBER_POS_DETAIL_M 106644271
HISDATA T_GOODS_BATCH 105361396
HISDATA T_STOCK_201304 104998091
HISDATA T_BILL_DETAIL_EXTRA 104062717
HISDATA T_STOCK_201302 100723059
HISDATA A_STOCK_SUM 95905964


W1.png


w2.png

漏洞证明:

部分表数据量统计

HISDATA	A_STOCK_DETAIL	3570128461
HISDATA T_POS_BILL_DETAIL 1155551516
HISDATA T_STOCK_201601 890063764
HISDATA T_STOCK_201602 826416956
HISDATA T_STOCK_201512 790399099
HISDATA T_STOCK_201603 775068805
HISDATA T_STOCK_201511 724544542
HISDATA T_STOCK_201510 659636373
HISDATA T_POS_GOODSALL_SUM 655613225
HISDATA T_POS_GOODS_SUM 655221592
HISDATA T_POS_GOODSALL_SUM_T 654967156
HISDATA T_POS_GOODSSUM_D 648417790
HISDATA T_STOCK_AMOUNT_201601 648087113
HISDATA T_STOCK_AMOUNT_201512 636144320
HISDATA T_STOCK_201509 600728809
HISDATA T_STOCK_AMOUNT_201602 590456738
HISDATA T_STOCK_AMOUNT_201510 589867404
HISDATA T_STOCK_AMOUNT_201511 587396940
HISDATA T_STOCK_AMOUNT_201508 562387286
HISDATA T_POS_BILL_PAYMENT 540166452
HISDATA T_STOCK_AMOUNT_201507 538663138
HISDATA T_STOCK_201508 538050648
HISDATA T_POS_BILL_HEADER 530081576
HISDATA T_STOCK_AMOUNT_201509 520222497
HISDATA T_STOCK_AMOUNT_201503 478476333
HISDATA T_STOCK_AMOUNT_201603 473918083
HISDATA T_STOCK_AMOUNT_201501 469689254
HISDATA T_MEMBER_POS_DETAIL 469217972
HISDATA T_STOCK_AMOUNT_201506 469043653
HISDATA T_STOCK_AMOUNT_201412 460221867
HISDATA T_STOCK_201507 458597587
HISDATA T_STOCK_AMOUNT_201505 457048794
HISDATA T_STOCK_AMOUNT_201504 444774748
HISDATA T_STOCK_AMOUNT_201410 438986793
HISDATA T_STOCK_AMOUNT_201502 432937570
HISDATA T_SAP_STOCK_201601 429395501
HISDATA T_STOCK_AMOUNT_201411 426812070
HISDATA T_SAP_STOCK_201511 425766859
HISDATA T_SAP_STOCK_201602 423721560
HISDATA T_SAP_STOCK_201512 418815342
HISDATA T_STOCK_201506 418431632
HISDATA T_STOCK_AMOUNT_201409 414384264
HISDATA T_STOCK_AMOUNT_201408 405839049
HISDATA T_STOCK_AMOUNT_201407 396889295
HISDATA T_STOCK_AMOUNT_201406 376297965
HISDATA T_SAP_STOCK_201510 374631044
HISDATA T_STOCK_AMOUNT_201405 373592301
HISDATA T_STOCK_AMOUNT_201403 368641090
HISDATA T_BILL_DETAIL 365996320
HISDATA T_STOCK_AMOUNT_201404 363036127
HISDATA T_SAP_STOCK_201509 361598796
HISDATA T_BILL_HEADER_DETAIL 360998486
HISDATA T_SAP_STOCK_201603 357223097
HISDATA T_STOCK_AMOUNT_201401 352235245
HISDATA T_SAP_STOCK_201508 349996558
HISDATA T_STOCK_201505 349390501
HISDATA T_STOCK_AMOUNT_201312 335524605
HISDATA T_BILL_HEADER_DETAIL_T 328323292
HISDATA T_STOCK_AMOUNT_201310 324673755
HISDATA T_STOCK_AMOUNT_201308 324517666
HISDATA T_STOCK_AMOUNT_201311 318228079
HISDATA T_SAP_STOCK_201507 315988960
HISDATA T_STOCK_AMOUNT_201307 314177740
HISDATA T_SAP_STOCK_201506 310389836
HISDATA T_STOCK_AMOUNT_201309 309906787
HISDATA T_STOCK_AMOUNT_201305 302661933
HISDATA T_STOCK_AMOUNT_201306 298106844
HISDATA T_SAP_STOCK_201505 296883509
HISDATA T_STOCK_201504 296690395
HISDATA T_STOCK_AMOUNT_201303 293712310
HISDATA T_STOCK_AMOUNT_201304 288957146
HISDATA T_STOCK_AMOUNT_201301 287627978
HISDATA T_STOCK_AMOUNT_201402 287371748
HISDATA T_SAP_STOCK_201504 285336045
HISDATA T_SAP_STOCK_201503 273378091
HISDATA T_POS_CLASS_SUM 265963498
HISDATA T_SAP_STOCK_201501 262178889
HISDATA T_STOCK_AMOUNT_201302 261884222
HISDATA T_STOCK_201503 245316717
HISDATA T_SAP_STOCK_201411 242621596
HISDATA T_SAP_STOCK_201502 242277731
HISDATA T_STOCK_201405 228912498
SAP T_POS_GOODSSUM_D 224055819
HISDATA T_SAP_STOCK_201409 223703491
HISDATA T_STOCK_201406 222780162
HISDATA T_STOCK_201403 219275462
HISDATA T_STOCK_201404 216695264
HISDATA T_MEMBER_POS_SUM_CLASS 216646339
HISDATA T_STOCK_201401 212878042
HISDATA T_SAP_STOCK_201410 212813655
HISDATA T_SAP_STOCK_201408 208290804
HISDATA T_MEMBER_BONUS_USED 200895896
HISDATA T_SAP_STOCK_201407 200155203
HISDATA T_SAP_STOCK_201406 181957128
HISDATA T_POS_DEPTSUM_D 178040867
HISDATA T_STOCK_201402 175843650
HISDATA T_SAP_STOCK_201404 173673912
HISDATA T_SAP_STOCK_201403 173326115
HISDATA T_SAP_STOCK_201405 156999587
HISDATA T_POS_GOODSALL_DEPTSUM 153452486
HISDATA T_SAP_STOCK_201401 150686355
HISDATA T_STORE_IN_RECV_DETAIL 140248116
HISDATA T_SAP_STOCK_201312 138249938
HISDATA T_POS_GOODSSUM_M 132779462
HISDATA T_POS_GOODSALL_SUM_M 127290241
HISDATA T_SAP_STOCK_201402 127045061
HISDATA T_SAP_STOCK_201311 125590046
HISDATA T_SAP_STOCK_201310 124399876
HISDATA T_SAP_STOCK_201309 119030934
HISDATA T_STOCK_201301 111665714
HISDATA T_STOCK_201303 108580372
HISDATA T_MEMBER_POS_DETAIL_M 106644271
HISDATA T_GOODS_BATCH 105361396
HISDATA T_STOCK_201304 104998091
HISDATA T_BILL_DETAIL_EXTRA 104062717
HISDATA T_STOCK_201302 100723059
HISDATA A_STOCK_SUM 95905964


W1.png


w2.png

修复方案:

更新补丁

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:15 (WooYun评价)