当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0102422

漏洞标题：某学校综合管理系统通用SQL注入漏洞影响众多学校

相关厂商：上海安脉计算机科技有限公司

漏洞作者： 路人甲

提交时间：2015-03-20 10:27

修复时间：2015-06-23 08:42

公开时间：2015-06-23 08:42

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：13

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-20： 细节已通知厂商并且等待厂商处理中
2015-03-25： 厂商已经确认，细节仅向厂商公开
2015-03-28： 细节向第三方安全合作伙伴开放
2015-05-19： 细节向核心白帽子及相关领域专家公开
2015-05-29： 细节向普通白帽子公开
2015-06-08： 细节向实习白帽子公开
2015-06-23： 细节向公众公开

简要描述：

某学校综合管理系统通用SQL注入漏洞影响众多学校

详细说明：

系统名称：学校综合管理平台
厂商：上海安脉计算机科技有限公司
关键字：版权所有：上海安脉计算机科技有限公司
系统架构：ASPX+MSSQL
漏洞文件：OA/repair/staticStat.aspx
注入参数：seldep
枚举部分案例：
http://anmai.net:81/OA/repair/staticStat.aspx
http://jwxx.am.jsedu.sh.cn/ANMAI/OA/repair/staticStat.aspx
http://bssyxxgl.eicbs.com/OA/repair/staticStat.aspx
http://cjzx.am.jsedu.sh.cn/OA/repair/staticStat.aspx
http://glpt.nhshs.edu.sh.cn/OA/repair/staticStat.aspx
http://218.78.241.80/anmai/OA/repair/staticStat.aspx
http://www.aqyz.net/anmai/OA/repair/staticStat.aspx
http://218.22.96.74:8899/anmai/OA/repair/staticStat.aspx
http://120.69.153.68:8002/anmai654202_458357247/OA/repair/staticStat.aspx
http://222.82.229.202:2010/anmai/OA/repair/staticStat.aspx
http://58.118.20.5/anmai/OA/repair/staticStat.aspx
http://124.228.32.115:81/OA/repair/staticStat.aspx
http://luoxzx.am.jsedu.sh.cn/OA/repair/staticStat.aspx
http://www.syzxyz.com:8008/OA/repair/staticStat.aspx
等等。。
漏洞验证：
这里以http://anmai.net:81/OA/repair/staticStat.aspx为例：

1.png


数据包如下：

POST /OA/repair/staticStat.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 1059
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/OA/repair/staticStat.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=fu3lhr45p5kavo553cyi5wyb; ASPSESSIONIDASDDBCCB=MGJJNPBDKFGIGGBABKJHKHIA
__VIEWSTATE=dDwtMTQyOTUxMjY1NDt0PDtsPGk8MT47PjtsPHQ8O2w8aTw1PjtpPDc%2BO2k8OT47PjtsPHQ8O2w8aTwwPjs%2BO2w8dDw7bDxpPDE%2BOz47bDx0PHQ8O3Q8aTwxOT47QDxcZTvmlZnliqHlpIQ75oC75Yqh5aSEO%2BaVmeeglOWupDvmoKHplb%2FlrqQ75pWZ5a2m5aSEO%2BaVmeiCsuWkhDvmoKHlip7lhazlrqQ756eR56CU5aSEO%2BS9k%2BiCsue7hDvpooTlpIflubTnuqfnu4Q75Yid5LiA5bm057qn57uEO%2BWIneS6jOW5tOe6p%2Be7hDvliJ3kuInlubTnuqfnu4Q76auY5LiA5bm057qn57uEO%2BmrmOS6jOW5tOe6p%2Be7hDvpq5jkuInlubTnuqfnu4Q75L%2Bh5oGv5Lit5b%2BDO%2Bezu%2Be7n%2BeuoeeQhuWRmDs%2BO0A8XGU7MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQ7MTU7MTY7MTc7MDs%2BPjs%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPFZpc2libGU7PjtsPG88Zj47Pj47bDxpPDA%2BOz47bDx0PDtsPGk8Mz47PjtsPHQ8dDw7O0BTeXN0ZW0uSW50MzIsIG1zY29ybGliLCBWZXJzaW9uPTEuMC41MDAwLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OTxpPDA%2BOz4%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPHN0eWxlOz47bDxXSURUSDogMTAwJVw7Qk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZTs%2BPjs7Pjs%2BPjs%2BPjtsPHJhZGlvMTtyYWRpbzI7Pj5Nli1yl6lyIm7SIU0%2BarPM%2F2%2ByPQ%3D%3D&isOK=&aa=1&seldep=2&fullname=aaaaa&startdate1=2015-03-09&enddate1=2015-03-18


相关代码如下：

1.png


1.png


当前数据库：

2.png

漏洞证明：

http://anmai.net:81/OA/repair/staticStat.aspx为例：

1.png


数据包如下：

POST /OA/repair/staticStat.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 1059
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/OA/repair/staticStat.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=fu3lhr45p5kavo553cyi5wyb; ASPSESSIONIDASDDBCCB=MGJJNPBDKFGIGGBABKJHKHIA
__VIEWSTATE=dDwtMTQyOTUxMjY1NDt0PDtsPGk8MT47PjtsPHQ8O2w8aTw1PjtpPDc%2BO2k8OT47PjtsPHQ8O2w8aTwwPjs%2BO2w8dDw7bDxpPDE%2BOz47bDx0PHQ8O3Q8aTwxOT47QDxcZTvmlZnliqHlpIQ75oC75Yqh5aSEO%2BaVmeeglOWupDvmoKHplb%2FlrqQ75pWZ5a2m5aSEO%2BaVmeiCsuWkhDvmoKHlip7lhazlrqQ756eR56CU5aSEO%2BS9k%2BiCsue7hDvpooTlpIflubTnuqfnu4Q75Yid5LiA5bm057qn57uEO%2BWIneS6jOW5tOe6p%2Be7hDvliJ3kuInlubTnuqfnu4Q76auY5LiA5bm057qn57uEO%2BmrmOS6jOW5tOe6p%2Be7hDvpq5jkuInlubTnuqfnu4Q75L%2Bh5oGv5Lit5b%2BDO%2Bezu%2Be7n%2BeuoeeQhuWRmDs%2BO0A8XGU7MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQ7MTU7MTY7MTc7MDs%2BPjs%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPFZpc2libGU7PjtsPG88Zj47Pj47bDxpPDA%2BOz47bDx0PDtsPGk8Mz47PjtsPHQ8dDw7O0BTeXN0ZW0uSW50MzIsIG1zY29ybGliLCBWZXJzaW9uPTEuMC41MDAwLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OTxpPDA%2BOz4%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPHN0eWxlOz47bDxXSURUSDogMTAwJVw7Qk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZTs%2BPjs7Pjs%2BPjs%2BPjtsPHJhZGlvMTtyYWRpbzI7Pj5Nli1yl6lyIm7SIU0%2BarPM%2F2%2ByPQ%3D%3D&isOK=&aa=1&seldep=2&fullname=aaaaa&startdate1=2015-03-09&enddate1=2015-03-18


相关代码如下：

1.png


1.png


当前数据库：

2.png

修复方案：

如上！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-03-25 08:41

厂商回复：

暂未建立与软件生产厂商直接处置渠道,待认领.

最新状态：

暂无