当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0150906

漏洞标题:中国一汽某服务管理系统sql注入漏洞(DBA权限)

相关厂商:中国第一汽车集团公司

漏洞作者: 路人甲

提交时间:2015-11-02 18:12

修复时间:2015-12-18 16:50

公开时间:2015-12-18 16:50

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-02: 细节已通知厂商并且等待厂商处理中
2015-11-03: 厂商已经确认,细节仅向厂商公开
2015-11-13: 细节向核心白帽子及相关领域专家公开
2015-11-23: 细节向普通白帽子公开
2015-12-03: 细节向实习白帽子公开
2015-12-18: 细节向公众公开

简要描述:

/**/

详细说明:

http://www.tjfaw2013.com/Manager/login.aspx


注册码这里存在注入

1.png


漏洞证明:

POST /Updatepwd.aspx HTTP/1.1
Host: www.tjfaw2013.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; rv:40.0) Gecko/20100101 Firefox/40.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://www.tjfaw2013.com/Updatepwd.aspx
Cookie: CNZZDATA2258211=cnzz_eid%3D539672135-1446279421-http%253A%252F%252Fwww.baidu.com%252F%26ntime%3D1446279421; ASP.NET_SessionId=elcg33fddtybwj55w4vo52fk; FrameWork_YOYO_Lzppcc-MessageValue=H4sIAAAAAAAEAO29B2AcSZYlJi9tynt/SvVK1+B0oQiAYBMk2JBAEOzBiM3mkuwdaUcjKasqgcplVmVdZhZAzO2dvPfee++999577733ujudTif33/8/XGZkAWz2zkrayZ4hgKrIHz9+fB8/In6NX/PX+DV+jf+bHvzE8xv9WvTP7/mszhb5d6v67Sj9ybxuimr52e54Z/xgvDNKT9Zlu67zz5b5uq2zcpS+XE/KYvp75ddvqrf58rPluix/XYD7XSyU8Um1WFXLfNk24y/ypsku8ifVu1+f2vwGv/8Xv/+boi3zX59+eVLNrn9D+nk2rZZvrlf5b4zP1m1bLZ8XTYsW+PQ3op/frYs2f1M9ffKb0h+vcsJn+XpaF6v21/w1f51f+9f4NX7NXxDtGnAZBMb4x/+ar6+bNl9Qg7LMpy2NsRl/ni/zupiO0d8fsPu970XBNNfN7/8iuywuMrz0VU0k+FB6ff/7v8GvCaR+PUL+1/hN/8s/++/9r//sP+I//yP/nv/6T/uz/8e/7w/+9X4d+vDhf/3X/HH/1d/4B/+Xf9Ef/F/8mX/Rf/Gn/1H/499Hf/6d/+Vf/Df8V3/DX/Zf/CF/1X/1D/yp//kf/pf/l3/OH+aa/Xl/NDf7g3/dX03TewNBMF2//mVWrvPf//f/NX4tYPJr/divh3/BEsmvg1//X0YvEOrX+/2JCxbNr/v7N8UP8t/g978USEStrdvh8b3vY3y/wW/wY+DEX1P//+vjD/4NZP91fuHtQAHQj/0G9M9v/Gv/uvhxy9d+XRaBSbt8k78jBqdf6EP+4NvFspVvaHp+c/zyND/PiDSvc1D/1yRG/zV+p2gnBMHwuPDUj+Gf/+of/NP+8z/3L/j1EsxnWV0Uy3HWrN79er8h/f27/Zd/yN/9n/+Rf+9/8cf90f/1n/I3/Nd/5B//X/wZf5Owk+UlcNEvJy7a2GGfh36NX/M3/H8Aq7PcOmAEAAA=
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 304
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE1OTUxOTQ1ODhkZCV7AKP6JCoUUBIT0EFZhrtVpEp%2B&__VIEWSTATEGENERATOR=30A6D3D5&__EVENTVALIDATION=%2FwEWBQK42%2FDNCQLs0bLrBgK%2Ft%2FHYDAKWwM6TBwKF2fXbA6MM5h3tPOINA1mj%2Fy0l%2F1d%2F14Vz&TextBox1=test&U_Pwd=123456a&U_Zcm=aaaaaaa&Button4=%E6%8F%90%E4%BA%A4


参数 U_Zcm

2.png


3.png


4.png


修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-11-03 16:49

厂商回复:

已经提交相关部门进行分析防护。

最新状态:

暂无