当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0154379

漏洞标题：国家博物馆从xss到sql注入泄露50W+访客信息&&10W+用户信息（包括电话/身份证/邮箱等敏感数据）

相关厂商：中国博物馆

漏洞作者： 路人甲

提交时间：2015-11-20 20:44

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-20： 细节已通知厂商并且等待厂商处理中
2015-11-24： 厂商已经确认，细节仅向厂商公开
2015-12-04： 细节向核心白帽子及相关领域专家公开
2015-12-14： 细节向普通白帽子公开
2015-12-24： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

国家博物馆从xss到sql注入，泄露50W+访客信息&&10W+用户信息（包括电话/身份证/邮箱等敏感数据）

详细说明：

QQ20151109-1.png


首先国家博物馆反馈处存在xss

QQ20151119-1.png


可直接进入管理员后台

QQ20151109-3.png


QQ20151109-4.png


用户量好大，50W+

QQ20151119-2.png


该处存在注入

QQ20151119-3.png


sql server

QQ20151118-0.png


QQ20151118-1.png


dbo.WTCRM_HND_ContactRecordOld                   | 1939015 |
| dbo.WTCRM_HND_ContactRecordOld                   | 1939015 |
| dbo.WTCRM_HND_CustomerInfo                       | 1576796 |
| dbo.VS_SYS_LogInfo                               | 950017  |
| dbo.WTCRM_SYS_LogInfo                            | 950017  |
| dbo.WTCRM_HND_VerfiyRecord                       | 684513  |
| dbo.WTCRM_HND_ConsultRecord                      | 602475  |
| dbo.WTCRM_HND_SeverRecordDelete                  | 446428  |
| dbo.WTCRM_HND_WorkRecord                         | 270504  |
| dbo.WTCRM_HND_RelationInfo                       | 231078  |
| dbo.WTCRM_SYS_EmailRecord                        | 224168  |
| dbo.WTCRM_HND_AllocateDetail                     | 191325  |
| dbo.WTCRM_HND_AllocateDetail                     | 191325  |
| dbo.WTCRM_HND_TemporaryCustomer                  | 186692  |
| dbo.WTCRM_HND_CensusInfo                         | 127971  |
| dbo.WTCRM_HND_ModifyInfo                         | 109814  |
| dbo.WTCRM_HND_ServiceRecord                      | 100772  |
| dbo.WTCRM_HND_WorkExamine                        | 63592   |
| dbo.WTCRM_HND_logRespondNotice                   | 63558   |
| dbo.WTCRM_HND_WXTOpenRecord                      | 43034   |
| dbo.WTCRM_HND_OrderRecord                        | 30579   |
| dbo.WTCRM_HND_AdvertRecord                       | 25792   |
| dbo.WTCRM_HND_OrderInfo                          | 24946   |
| dbo.WTCRM_HND_OrderPrintRecord                   | 24536   |
| dbo.WTCRM_PEP_ResumeRecord                       | 21791   |
| dbo.WTCRM_SYS_BadWord                            | 19873   |
| dbo.WTCRM_HND_UpdateRecord                       | 19039   |
| dbo.WTCRM_HND_MemberKindAlter                    | 13759   |
| dbo.WTCRM_HND_VisitRecord                        | 12320   |
| dbo.WTCRM_HND_OrderFullRecord                    | 10035   |
| dbo.WTCRM_HND_logRespondContact                  | 9745    |
| dbo.WTCRM_HND_ContactExamine                     | 9732    |
| dbo.WTCRM_PEP_ResumeInfo                         | 9133    |
| dbo.WTCRM_HND_PerfectDegree                      | 7435    |
| dbo.WTCRM_HND_UserDelRecord                      | 7434    |
| dbo.WTCRM_HND_AppliRemind                        | 6916    |
| dbo.WTCRM_HND_OrderAssociate                     | 6303    |
| dbo.WTCRM_SYS_PostRecord                         | 5885    |
| dbo.WTCRM_SYS_KnowledgeRecord                    | 5800    |
| dbo.WTCRM_SYS_KnowledgeShare                     | 5061    |
| dbo.WTCRM_HND_MaintainCar                        | 4987    |
| dbo.WTCRM_HND_Repeal                             | 4953    |
| dbo.WTCRM_HND_ServeInfo                          | 3265    |
| dbo.WTCRM_SYS_ListAreas                          | 3177    |
| dbo.WTCRM_HND_SyncRecord                         | 3107    |
| dbo.WTCRM_HND_AppliRecord                        | 3058    |
| dbo.WTCRM_SYS_UserChangeRecord                   | 2696    |
| dbo.WTCRM_HND_OrderInvoice                       | 2646    |
| dbo.WTCRM_SYS_DepartureRecord                    | 2435    |
| dbo.WTCRM_SYS_SalerStore                         | 2373    |
| dbo.WTCRM_SYS_UserInfo                           | 2202    |
| dbo.VS_SYS_UserInfo                              | 2198    |
| dbo.WTCRM_SYS_InvoiceRequest                     | 1638    |
| dbo.WTCRM_HND_SaleInfoFW                         | 1626    |
| dbo.WTCRM_HND_SaleInfoFW                         | 1626    |
| dbo.WTCRM_PEP_Archives                           | 1315    |
| dbo.WTCRM_PEP_ExamineXZ                          | 1263    |
| dbo.WTCRM_HND_ProxyMaterialsDetail               | 1243    |
| dbo.WTCRM_HND_ProxyMaterialsDetail               | 1243    |
| dbo.WTCRM_HND_Application                        | 1172    |
| cdc.lsn_time_mapping                             | 990     |
| dbo.WTCRM_HND_OrderSpareMoney                    | 869     |
| dbo.WTCRM_HND_AdvertOrderChange                  | 799     |
| dbo.CallAuth                                     | 752     |
| dbo.Hangup                                       | 752     |
| dbo.WTCRM_FWF_Huo                                | 674     |
| dbo.WTCRM_SYS_ElementInfo                        | 671     |
| dbo.WTCRM_HND_SaleBusinessPlan                   | 489     |
| dbo.WTCRM_HND_ComplaintInfo                      | 438     |
| dbo.WTCRM_PEP_Examine                            | 393     |
| dbo.WTCRM_PEP_PayCheck                           | 384     |
| dbo.WTCRM_PEP_PayChange                          | 353     |
| dbo.WTCRM_SYS_Citys                              | 337     |
| dbo.WTCRM_FWF_wshiMainline                       | 313     |
| dbo.WTCRM_HND_JudgeOrder                         | 275     |
| dbo.WTCRM_PEP_ResignInfo                         | 268     |
| dbo.CallEstablish                                | 246     |
| dbo.WTCRM_PEP_Becomes                            | 240     |
| dbo.WTCRM_PEP_LogisticsGrade                     | 237     |
| dbo.WTCRM_PEP_ConnectInfo                        | 230     |
| dbo.WTCRM_FWF_VehicleLine                        | 209     |
| dbo.WTCRM_FWF_VehicleLine                        | 209     |
| dbo.WTCRM_SYS_Domain                             | 187     |
| dbo.WTCRM_SYS_Suggestion                         | 179     |
| dbo.WTCRM_HND_Impression                         | 174     |
| dbo.WTCRM_SYS_TeamInfo                           | 167     |
| dbo.WTCRM_SYS_GroupInfo                          | 137     |
| dbo.WTCRM_SYS_RoleInfo                           | 129     |
| dbo.WTCRM_SYS_SubStation                         | 120     |
| dbo.WTCRM_PEP_StationChange                      | 113     |
| dbo.WTCRM_PEP_SalerGrade                         | 95      |
| dbo.WTCRM_PEP_WebAndPosition                     | 88      |
| dbo.WTCRM_HND_ProxyInfo                          | 38      |
| dbo.WTCRM_SYS_AllAgents                          | 38      |
| dbo.WTCRM_SYS_OrderType                          | 37      |
| dbo.WTCRM_SYS_Materials                          | 34      |
| dbo.WTCRM_SYS_Provinces                          | 34      |
| cdc.captured_columns                             | 33      |
| dbo.WTCRM_HND_ContactExamineS                    | 33      |
| dbo.WTCRM_SYS_TargetSaler                        | 26      |
| dbo.WTCRM_HND_OrderVerify                        | 24      |
| dbo.WTCRM_SYS_Announcement                       | 24      |
| dbo.WTCRM_SYS_DepartmentInfo                     | 24      |
| dbo.WTCRM_HND_Elegant                            | 22      |
| dbo.WTCRM_SYS_OpenAreas                          | 21      |
| dbo.WTCRM_SYS_VOIDAPPID                          | 21      |
| dbo.WTCRM_SYS_KeyWords                           | 17      |
| dbo.WTCRM_SYS_CustomerProtected                  | 16      |
| dbo.WTCRM_HND_LinkLimits                         | 14      |
| dbo.WTCRM_HND_TechnologyLog                      | 14      |
| dbo.WTCRM_PEP_Wonderful                          | 14      |
| cdc.dbo_WTCRM_SYS_UserInfo_CT                    | 11      |
| dbo.WTCRM_SYS_Region                             | 8       |
| dbo.WTCRM_PEP_Recommend                          | 5       |
| dbo.WTCRM_SYS_BaseLimits                         | 4       |
| dbo.WTCRM_SYS_TemplateLimits                     | 4       |
| cdc.change_tables                                | 1       |
| cdc.index_columns                                | 1       |
| dbo.WTCRM_FWF_CarTolls                           | 1       |
| dbo.WTCRM_FWF_PeiHuo                             | 1       |
| dbo.WTCRM_HND_VipVehicleInfo                     | 1       |


QQ20151119-0.png


10W+用户信息，包括电话/身份证/邮箱等敏感数据

QQ20151118-2.png


漏洞证明：

已经证明

修复方案：

过滤&&权限呀

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-11-24 18:46

厂商回复：

CNVD未复现所述情况，已由CNVD通过网站管理方公开联系渠道向其邮件通报，由其后续提供解决方案。

最新状态：

暂无