当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0134376

漏洞标题：畅捷通某站SQL注入DBA权限涉及上万用户信息

相关厂商：畅捷通

漏洞作者： 几何黑店

提交时间：2015-08-16 16:55

修复时间：2015-10-01 13:56

公开时间：2015-10-01 13:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-16： 细节已通知厂商并且等待厂商处理中
2015-08-17： 厂商已经确认，细节仅向厂商公开
2015-08-27： 细节向核心白帽子及相关领域专家公开
2015-09-06： 细节向普通白帽子公开
2015-09-16： 细节向实习白帽子公开
2015-10-01： 细节向公众公开

简要描述：

畅捷通某站SQL注入DBA权限涉及上万用户信息

详细说明：

http://t.ufida.com.cn/Service.asmx?WSDL
http://tong.ufida.com.cn/Service.asmx?WSDL


POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/PRM_Support"
Content-Length: 950
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:PRM_Support>
           <urn:login_name>qkocfmsr</urn:login_name>
           <urn:company>Wooyun</urn:company>
           <urn:shengfen>8pbF19TX</urn:shengfen>
           <urn:lianxiren>1</urn:lianxiren>
           <urn:phone>555-666-0606</urn:phone>
           <urn:email>[email protected]</urn:email>
           <urn:address>3137 Laguna Street</urn:address>
           <urn:mobile>987-65-4329</urn:mobile>
        </urn:PRM_Support>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:shengfen

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/GetVerSionJSON"
Content-Length: 590
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:GetVerSionJSON>
           <urn:Product>-1</urn:Product>
        </urn:GetVerSionJSON>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:Product

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/SetBuddy"
Content-Length: 798
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:SetBuddy>
           <urn:login_name>guokotbt</urn:login_name>
           <urn:quancheng>1</urn:quancheng>
           <urn:jiancheng>1</urn:jiancheng>
           <urn:ShengFen>1</urn:ShengFen>
           <urn:DiShi>1</urn:DiShi>
           <urn:FenQu>-1</urn:FenQu>
        </urn:SetBuddy>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:FenQu

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/PRM_State"
Content-Length: 588
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:PRM_State>
           <urn:prm_id>C5uH79nj</urn:prm_id>
        </urn:PRM_State>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:prm_id

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/GetModuleJSON"
Content-Length: 588
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:GetModuleJSON>
           <urn:id>hZ33z5iD</urn:id>
        </urn:GetModuleJSON>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:id

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/GetOnlyBuddyInfoByFwCode"
Content-Length: 608
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:GetOnlyBuddyInfoByFwCode>
           <urn:Fw_Code>94102</urn:Fw_Code>
        </urn:GetOnlyBuddyInfoByFwCode>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:Fw_Code

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/PRM_Support"
Content-Length: 950
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:PRM_Support>
           <urn:login_name>coqgpkwu</urn:login_name>
           <urn:company>Wooyun</urn:company>
           <urn:shengfen>1</urn:shengfen>
           <urn:lianxiren>1</urn:lianxiren>
           <urn:phone>555-666-0606</urn:phone>
           <urn:email>[email protected]</urn:email>
           <urn:address>3137 Laguna Street</urn:address>
           <urn:mobile>987-65-4329</urn:mobile>
        </urn:PRM_Support>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:shengfen

漏洞证明：

QQ图片20150815205425.png


QQ图片20150815210455.png


QQ图片20150815210545.jpg

修复方案：

你懂的

版权声明：转载请注明来源 几何黑店@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-08-17 13:55

厂商回复：

感谢您对我们的关注和支持，该问题存在，我们正在修复。

最新状态：

暂无