当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0115068

漏洞标题：某市从业人员预防性健康检查信息网注入

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-05-20 12:23

修复时间：2015-07-09 11:44

公开时间：2015-07-09 11:44

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-20： 细节已通知厂商并且等待厂商处理中
2015-05-25： 厂商已经确认，细节仅向厂商公开
2015-06-04： 细节向核心白帽子及相关领域专家公开
2015-06-14： 细节向普通白帽子公开
2015-06-24： 细节向实习白帽子公开
2015-07-09： 细节向公众公开

简要描述：

某市从业人员健康合格证查询网站存在sql注入,姓名,性别,身份证号码,发证日期,存在信息泄露风险。

详细说明：


POST /index.aspx HTTP/1.1
Host: www.jkz.sh.cn
Proxy-Connection: keep-alive
Content-Length: 3579
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.jkz.sh.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://www.jkz.sh.cn/index.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4
Cookie: ASP.NET_SessionId=akjbb43pl3shdg3x34w4y555
__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=%2FwEPDwUKMTY3NTQ5NzcyOA8WBB4EcXhkbQUGMzEwMTAxHg1wYWdlQ3VyckluZGV4AgEWAgIDD2QWGgIDDxAPFggeDURhdGFUZXh0RmllbGQFAk1DHgpEYXRhTWVtYmVyBQJNQx4ORGF0YVZhbHVlRmllbGQFBFFYRE0eC18hRGF0YUJvdW5kZ2QQFRMBIAbmsqrpu4QG5rKq5Y2iBuayquW%2BkAbmsqrplb8G5rKq6Z2ZBuayquaZrgbmsqrpl7gG5rKq6Jm5BuayquadqAbmsqrpl7UG5rKq5a6dBuayquWYiQbmsqrmtaYG5rKq6YeRBuayquadvgbmsqrpnZIG5rKq5aWJBuayquW0hxUTASAGMzEwMTAxBjMxMDEwMwYzMTAxMDQGMzEwMTA1BjMxMDEwNgYzMTAxMDcGMzEwMTA4BjMxMDEwOQYzMTAxMTAGMzEwMTEyBjMxMDExMwYzMTAxMTQGMzEwMTE1BjMxMDExNgYzMTAxMTcGMzEwMTE4BjMxMDEyMAYzMTAyMzAUKwMTZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2RkAg0PDxYCHgRUZXh0ZWRkAg8PDxYCHwZlZGQCEw8PFgIfBmVkZAIVDw8WAh8GZWRkAhcPDxYCHwZlZGQCGQ8PFgIfBmVkZAIbDw8WAh8GZWRkAh0PDxYCHwZlZGQCHw8PFgQfBgUx5oKo55qE5YGl5bq36K%2BB5bey6L%2BH5pyJ5pWI5pyfLOivt%2BmHjeaWsOWKnueQhuOAgh4HVmlzaWJsZWdkZAIhD2QWAmYPZBYCAgEPEA8WCB8CBQRRWE1DHwMFBFFYTUMfBAUEUVhETR8FZ2QQFRIJ6buE5rWm5Yy6CeWNoua5vuWMugnlvpDmsYfljLoJ6ZW%2F5a6B5Yy6CemdmeWuieWMugnmma7pmYDljLoJ6Ze45YyX5Yy6CeiZueWPo%2BWMugnmnajmtabljLoJ6Ze16KGM5Yy6CeWuneWxseWMugnlmInlrprljLoM5rWm5Lic5paw5Yy6CemHkeWxseWMugnmnb7msZ%2FljLoJ6Z2S5rWm5Yy6CeWliei0pOWMugnltIfmmI7ljr8VEgYzMTAxMDEGMzEwMTAzBjMxMDEwNAYzMTAxMDUGMzEwMTA2BjMxMDEwNwYzMTAxMDgGMzEwMTA5BjMxMDExMAYzMTAxMTIGMzEwMTEzBjMxMDExNAYzMTAxMTUGMzEwMTE2BjMxMDExNwYzMTAxMTgGMzEwMTIwBjMxMDIzMBQrAxJnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cWAWZkAiMPZBYCZg9kFgICAQ88KwANAQAPFgQfBWceC18hSXRlbUNvdW50AglkFgJmD2QWFmYPDxYCHwdoZGQCAQ9kFgRmDw8WAh8GBR7kuIrmtbfluILpu4TmtabljLrkuK3lv4PljLvpmaJkZAICDw8WAh8GBSQ2N2QwNjZlZC1jNjc5LTQxZGYtYTYwNy0wZDg4OTY0YTA4MDFkZAICD2QWBGYPDxYCHwYFJ%2BS4iua1t%2BW4gum7hOa1puWMuuS4reilv%2BWMu%2Be7k%2BWQiOWMu%2BmZomRkAgIPDxYCHwYFJGU5OTEwYmQ0LWUyN2UtNGYxMy05ZTdlLTI5M2EzNWJlMmZmYmRkAgMPZBYEZg8PFgIfBgUn5LiK5rW35Lit5Yy76I2v5aSn5a2m6ZmE5bGe5puZ5YWJ5Yy76ZmiZGQCAg8PFgIfBgUkMGFlZmQxNTYtN2IzOC00MjkxLWE1OGMtMjlkNWNmMmVkNjhhZGQCBA9kFgRmDw8WAh8GBTzkuIrmtbfluILpu4TmtabljLrljZfkuqzkuJzot6%2FooZfpgZPnpL7ljLrljavnlJ%2FmnI3liqHkuK3lv4NkZAICDw8WAh8GBSRhNzY0OGFjYi1iN2MyLTRhYjgtODQ5My00MmFmMmVjZDY1NWZkZAIFD2QWBGYPDxYCHwYFG%2BS4iua1t%2BW4gum7hOa1puWMuuS9k%2BajgOermWRkAgIPDxYCHwYFJDQzMTczODRkLTUwNTQtNDljOS1iNTk3LTQzMzg4NWQ4M2FhYmRkAgYPZBYEZg8PFgIfBgU55LiK5rW35biC6buE5rWm5Yy66JOs6I6x6Zeo6K%2BK6YOo77yI6buE5rWm5Yy65L2T5qOA56uZ77yJZGQCAg8PFgIfBgUkZDBhZmI0YWMtZWM5MS00N2NmLThhMGUtOTU3M2Y1MmQ1YmVhZGQCBw9kFgRmDw8WAh8GBRvkuIrmtbfluILnrKzkuozkurrmsJHljLvpmaJkZAICDw8WAh8GBSRiZTNiMGNlMC0zNGNkLTQyMWMtODBmMC1jYmZlNGRlY2Y2NjNkZAIID2QWBGYPDxYCHwYFIeS4iua1t%2BW4gum7hOa1puWMuuWmh%2BW5vOS%2FneWBpemZomRkAgIPDxYCHwYFJDY5Mjk0MGQwLTRlMjAtNGJjZi1iMWY4LWRlMjFlOWQ5OTg0NWRkAgkPZBYEZg8PFgIfBgUe5LiK5rW35biC6buE5rWm5Yy65Lic5Y2X5Yy76ZmiZGQCAg8PFgIfBgUkMzE5ZDk2OWUtNDlmYi00OTAwLWIyMmEtZTI0YWZkYjQ5YzMwZGQCCg8PFgIfB2hkZAIlD2QWAmYPZBYGAgEPDxYEHwYFBummlumhtR4HRW5hYmxlZGhkZAIDDw8WBB8GBQnkuIrkuIDpobUfCWhkZAIFDw8WAh8GBRvlvZPliY3nrKw6IDEg6aG1O%2BWFsTogMSDpobVkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAgUGaW1iSmt6BQZpbWJTZnoFBGd2SmcPPCsACgEIAgFksXH1ElGNcAuuO0Mow13KdCr7EKs%3D&__EVENTVALIDATION=%2FwEWNgLa8czrCgKHsMSjBwLKzKKPCQLKzLqPCQLKzK6PCQLKzNKPCQLKzKaPCQLKzKqPCQLKzN6PCQLKzMKPCQLJzL6PCQLJzLaPCQLJzLqPCQLJzK6PCQLJzNKPCQLJzKaPCQLJzKqPCQLJzN6PCQLMzL6PCQLLzNKqAgLnieDuCAKou7ikBQL0ieyvBQKbu8SiAgL4wLXQBgK10%2FmSBAK10%2BGSBAK10%2FWSBAK104mSBAK10%2F2SBAK10%2FGSBAK104WSBAK105mSBAK20%2BWSBAK20%2B2SBAK20%2BGSBAK20%2FWSBAK204mSBAK20%2F2SBAK20%2FGSBAK204WSBAKz0%2BWSBAK004m3DwLz2sTGCwLz2risDALz2uyWDQLz2qD1CwLz2vTWDALz2ui8DQLz2tz2CQLz2tDUCAK2hr2GDALyj%2B%2BLCwLpgeqhCAREuDW0Dkj%2B8Md%2FRgvdlzQHmVL%2F&ddlssqx=310103&txtJkzh=111&imbJkz.x=51&imbJkz.y=17&txtSfzh=&ddlQx=310101


sh.png


SA

sh2.png


is-dba

sh3.png

漏洞证明：


POST /index.aspx HTTP/1.1
Host: www.jkz.sh.cn
Proxy-Connection: keep-alive
Content-Length: 3579
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.jkz.sh.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://www.jkz.sh.cn/index.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4
Cookie: ASP.NET_SessionId=akjbb43pl3shdg3x34w4y555
__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=%2FwEPDwUKMTY3NTQ5NzcyOA8WBB4EcXhkbQUGMzEwMTAxHg1wYWdlQ3VyckluZGV4AgEWAgIDD2QWGgIDDxAPFggeDURhdGFUZXh0RmllbGQFAk1DHgpEYXRhTWVtYmVyBQJNQx4ORGF0YVZhbHVlRmllbGQFBFFYRE0eC18hRGF0YUJvdW5kZ2QQFRMBIAbmsqrpu4QG5rKq5Y2iBuayquW%2BkAbmsqrplb8G5rKq6Z2ZBuayquaZrgbmsqrpl7gG5rKq6Jm5BuayquadqAbmsqrpl7UG5rKq5a6dBuayquWYiQbmsqrmtaYG5rKq6YeRBuayquadvgbmsqrpnZIG5rKq5aWJBuayquW0hxUTASAGMzEwMTAxBjMxMDEwMwYzMTAxMDQGMzEwMTA1BjMxMDEwNgYzMTAxMDcGMzEwMTA4BjMxMDEwOQYzMTAxMTAGMzEwMTEyBjMxMDExMwYzMTAxMTQGMzEwMTE1BjMxMDExNgYzMTAxMTcGMzEwMTE4BjMxMDEyMAYzMTAyMzAUKwMTZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2RkAg0PDxYCHgRUZXh0ZWRkAg8PDxYCHwZlZGQCEw8PFgIfBmVkZAIVDw8WAh8GZWRkAhcPDxYCHwZlZGQCGQ8PFgIfBmVkZAIbDw8WAh8GZWRkAh0PDxYCHwZlZGQCHw8PFgQfBgUx5oKo55qE5YGl5bq36K%2BB5bey6L%2BH5pyJ5pWI5pyfLOivt%2BmHjeaWsOWKnueQhuOAgh4HVmlzaWJsZWdkZAIhD2QWAmYPZBYCAgEPEA8WCB8CBQRRWE1DHwMFBFFYTUMfBAUEUVhETR8FZ2QQFRIJ6buE5rWm5Yy6CeWNoua5vuWMugnlvpDmsYfljLoJ6ZW%2F5a6B5Yy6CemdmeWuieWMugnmma7pmYDljLoJ6Ze45YyX5Yy6CeiZueWPo%2BWMugnmnajmtabljLoJ6Ze16KGM5Yy6CeWuneWxseWMugnlmInlrprljLoM5rWm5Lic5paw5Yy6CemHkeWxseWMugnmnb7msZ%2FljLoJ6Z2S5rWm5Yy6CeWliei0pOWMugnltIfmmI7ljr8VEgYzMTAxMDEGMzEwMTAzBjMxMDEwNAYzMTAxMDUGMzEwMTA2BjMxMDEwNwYzMTAxMDgGMzEwMTA5BjMxMDExMAYzMTAxMTIGMzEwMTEzBjMxMDExNAYzMTAxMTUGMzEwMTE2BjMxMDExNwYzMTAxMTgGMzEwMTIwBjMxMDIzMBQrAxJnZ2dnZ2dnZ2dnZ2dnZ2dnZ2cWAWZkAiMPZBYCZg9kFgICAQ88KwANAQAPFgQfBWceC18hSXRlbUNvdW50AglkFgJmD2QWFmYPDxYCHwdoZGQCAQ9kFgRmDw8WAh8GBR7kuIrmtbfluILpu4TmtabljLrkuK3lv4PljLvpmaJkZAICDw8WAh8GBSQ2N2QwNjZlZC1jNjc5LTQxZGYtYTYwNy0wZDg4OTY0YTA4MDFkZAICD2QWBGYPDxYCHwYFJ%2BS4iua1t%2BW4gum7hOa1puWMuuS4reilv%2BWMu%2Be7k%2BWQiOWMu%2BmZomRkAgIPDxYCHwYFJGU5OTEwYmQ0LWUyN2UtNGYxMy05ZTdlLTI5M2EzNWJlMmZmYmRkAgMPZBYEZg8PFgIfBgUn5LiK5rW35Lit5Yy76I2v5aSn5a2m6ZmE5bGe5puZ5YWJ5Yy76ZmiZGQCAg8PFgIfBgUkMGFlZmQxNTYtN2IzOC00MjkxLWE1OGMtMjlkNWNmMmVkNjhhZGQCBA9kFgRmDw8WAh8GBTzkuIrmtbfluILpu4TmtabljLrljZfkuqzkuJzot6%2FooZfpgZPnpL7ljLrljavnlJ%2FmnI3liqHkuK3lv4NkZAICDw8WAh8GBSRhNzY0OGFjYi1iN2MyLTRhYjgtODQ5My00MmFmMmVjZDY1NWZkZAIFD2QWBGYPDxYCHwYFG%2BS4iua1t%2BW4gum7hOa1puWMuuS9k%2BajgOermWRkAgIPDxYCHwYFJDQzMTczODRkLTUwNTQtNDljOS1iNTk3LTQzMzg4NWQ4M2FhYmRkAgYPZBYEZg8PFgIfBgU55LiK5rW35biC6buE5rWm5Yy66JOs6I6x6Zeo6K%2BK6YOo77yI6buE5rWm5Yy65L2T5qOA56uZ77yJZGQCAg8PFgIfBgUkZDBhZmI0YWMtZWM5MS00N2NmLThhMGUtOTU3M2Y1MmQ1YmVhZGQCBw9kFgRmDw8WAh8GBRvkuIrmtbfluILnrKzkuozkurrmsJHljLvpmaJkZAICDw8WAh8GBSRiZTNiMGNlMC0zNGNkLTQyMWMtODBmMC1jYmZlNGRlY2Y2NjNkZAIID2QWBGYPDxYCHwYFIeS4iua1t%2BW4gum7hOa1puWMuuWmh%2BW5vOS%2FneWBpemZomRkAgIPDxYCHwYFJDY5Mjk0MGQwLTRlMjAtNGJjZi1iMWY4LWRlMjFlOWQ5OTg0NWRkAgkPZBYEZg8PFgIfBgUe5LiK5rW35biC6buE5rWm5Yy65Lic5Y2X5Yy76ZmiZGQCAg8PFgIfBgUkMzE5ZDk2OWUtNDlmYi00OTAwLWIyMmEtZTI0YWZkYjQ5YzMwZGQCCg8PFgIfB2hkZAIlD2QWAmYPZBYGAgEPDxYEHwYFBummlumhtR4HRW5hYmxlZGhkZAIDDw8WBB8GBQnkuIrkuIDpobUfCWhkZAIFDw8WAh8GBRvlvZPliY3nrKw6IDEg6aG1O%2BWFsTogMSDpobVkZBgCBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAgUGaW1iSmt6BQZpbWJTZnoFBGd2SmcPPCsACgEIAgFksXH1ElGNcAuuO0Mow13KdCr7EKs%3D&__EVENTVALIDATION=%2FwEWNgLa8czrCgKHsMSjBwLKzKKPCQLKzLqPCQLKzK6PCQLKzNKPCQLKzKaPCQLKzKqPCQLKzN6PCQLKzMKPCQLJzL6PCQLJzLaPCQLJzLqPCQLJzK6PCQLJzNKPCQLJzKaPCQLJzKqPCQLJzN6PCQLMzL6PCQLLzNKqAgLnieDuCAKou7ikBQL0ieyvBQKbu8SiAgL4wLXQBgK10%2FmSBAK10%2BGSBAK10%2FWSBAK104mSBAK10%2F2SBAK10%2FGSBAK104WSBAK105mSBAK20%2BWSBAK20%2B2SBAK20%2BGSBAK20%2FWSBAK204mSBAK20%2F2SBAK20%2FGSBAK204WSBAKz0%2BWSBAK004m3DwLz2sTGCwLz2risDALz2uyWDQLz2qD1CwLz2vTWDALz2ui8DQLz2tz2CQLz2tDUCAK2hr2GDALyj%2B%2BLCwLpgeqhCAREuDW0Dkj%2B8Md%2FRgvdlzQHmVL%2F&ddlssqx=310103&txtJkzh=111&imbJkz.x=51&imbJkz.y=17&txtSfzh=&ddlQx=310101


sh.png


SA

sh2.png


is-dba

sh3.png


修复方案：

防注入

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-05-25 11:43

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给上海分中心，由上海分中心后续协调网站管理单位处置。

最新状态：

暂无