当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-019280

漏洞标题：某省物流信息平台SQL注射漏洞可泄露全省信息

相关厂商：某省政府

漏洞作者： 带馅儿馒头

提交时间：2013-02-27 17:56

修复时间：2013-04-13 17:57

公开时间：2013-04-13 17:57

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-02-27： 细节已通知厂商并且等待厂商处理中
2013-03-02： 厂商已经确认，细节仅向厂商公开
2013-03-12： 细节向核心白帽子及相关领域专家公开
2013-03-22： 细节向普通白帽子公开
2013-04-01： 细节向实习白帽子公开
2013-04-13： 细节向公众公开

简要描述：

可造成全省物流信息泄露！

详细说明：

1.测试对象：四川省物流信息平台
2.以下几个均存在相同的情况；
http://118.123.242.34/u.php 四川省物流信息平台用户管理系统
http://118.123.242.34/u.php/cms 四川省物流信息报送系统
http://118.123.242.34/u.php/work 四川省物流信息平台重点项目申报系统
http://118.123.242.34/u.php/logent 四川省物流信息平台重点联系企业申报系统
http://118.123.242.34/u.php/expert 四川省物流信息平台专家申报系统
3.获取到的数据库信息；

1.png


4.正好与下列情况对应；

2.png


5.随便跑了一个库，没钱破解MD5，-_-||

Database: main
[242 tables]
+--------------------------------------+
| ecp_apply                            |
| p8_46_                               |
| p8_46_buy                            |
| p8_46_click_log                      |
| p8_acl                               |
| p8_admin_log                         |
| p8_admin_menu                        |
| p8_area                              |
| p8_ask_answer_                       |
| p8_ask_answer_data                   |
| p8_ask_answer_follow                 |
| p8_ask_answer_poller                 |
| p8_ask_answer_votes                  |
| p8_ask_attachment                    |
| p8_ask_category_                     |
| p8_ask_expertors                     |
| p8_ask_item_                         |
| p8_ask_item_addition                 |
| p8_ask_item_data                     |
| p8_ask_item_favorites                |
| p8_ask_item_itemtags                 |
| p8_ask_item_poller                   |
| p8_ask_item_push                     |
| p8_ask_item_tags                     |
| p8_ask_item_unverified               |
| p8_ask_member                        |
| p8_ask_statistics                    |
| p8_attachment                        |
| p8_cache                             |
| p8_client_                           |
| p8_client_log                        |
| p8_cluster_call_queue                |
| p8_cluster_client                    |
| p8_cluster_client_admin_login_hash   |
| p8_cluster_log                       |
| p8_cluster_server_cms_item_category  |
| p8_cluster_server_cms_item_push_item |
| p8_cluster_service                   |
| p8_cluster_service_config            |
| p8_cms_assist_category_              |
| p8_cms_assist_category_list          |
| p8_cms_attachment                    |
| p8_cms_category                      |
| p8_cms_item                          |
| p8_cms_item_article_                 |
| p8_cms_item_article_addon            |
| p8_cms_item_attribute                |
| p8_cms_item_comment                  |
| p8_cms_item_comment_id               |
| p8_cms_item_comment_unverified       |
| p8_cms_item_copy                     |
| p8_cms_item_digg                     |
| p8_cms_item_down_                    |
| p8_cms_item_down_addon               |
| p8_cms_item_member                   |
| p8_cms_item_member_collection        |
| p8_cms_item_mood                     |
| p8_cms_item_mood_data                |
| p8_cms_item_pay                      |
| p8_cms_item_photo_                   |
| p8_cms_item_photo_addon              |
| p8_cms_item_product_                 |
| p8_cms_item_product_addon            |
| p8_cms_item_progress                 |
| p8_cms_item_search                   |
| p8_cms_item_tag                      |
| p8_cms_item_tag_item                 |
| p8_cms_item_unverified               |
| p8_cms_item_video_                   |
| p8_cms_item_video_addon              |
| p8_cms_member                        |
| p8_cms_model                         |
| p8_cms_model_field                   |
| p8_cms_order                         |
| p8_config                            |
| p8_credit                            |
| p8_credit_log                        |
| p8_credit_member                     |
| p8_credit_rule                       |
| p8_credit_rule_log                   |
| p8_credit_rule_log_cache             |
| p8_crontab_                          |
| p8_cservice_                         |
| p8_cservice_reply                    |
| p8_dict                              |
| p8_dict_cond                         |
| p8_dict_score                        |
| p8_expert_attachment                 |
| p8_expert_category                   |
| p8_expert_field                      |
| p8_expert_item                       |
| p8_expert_item_article_              |
| p8_expert_item_article_addon         |
| p8_expert_item_attribute             |
| p8_expert_item_comment               |
| p8_expert_item_comment_id            |
| p8_expert_item_comment_unverified    |
| p8_expert_item_digg                  |
| p8_expert_item_fromdown_             |
| p8_expert_item_fromdown_addon        |
| p8_expert_item_member                |
| p8_expert_item_member_collection     |
| p8_expert_item_mood                  |
| p8_expert_item_mood_data             |
| p8_expert_item_pay                   |
| p8_expert_item_progress              |
| p8_expert_item_search                |
| p8_expert_item_tag                   |
| p8_expert_item_tag_item              |
| p8_expert_item_unverified            |
| p8_expert_item_unwork                |
| p8_expert_item_work_                 |
| p8_expert_item_work_addon            |
| p8_expert_item_work_field            |
| p8_expert_member                     |
| p8_expert_model                      |
| p8_expert_model_field                |
| p8_filter_word                       |
| p8_forms_item                        |
| p8_forms_item_jixiaobiaoyan          |
| p8_forms_item_peixinbaoming          |
| p8_forms_item_peixunfangang          |
| p8_forms_item_tiang                  |
| p8_forms_model                       |
| p8_forms_model_field                 |
| p8_friendlink_link                   |
| p8_friendlink_sort                   |
| p8_guestbook_                        |
| p8_guestbook_category                |
| p8_homepage_block                    |
| p8_homepage_menu                     |
| p8_homepage_view                     |
| p8_investigation                     |
| p8_investigation_                    |
| p8_label                             |
| p8_log                               |
| p8_logent_attachment                 |
| p8_logent_category                   |
| p8_logent_item                       |
| p8_logent_item_article_              |
| p8_logent_item_article_addon         |
| p8_logent_item_attribute             |
| p8_logent_item_comment               |
| p8_logent_item_comment_id            |
| p8_logent_item_comment_unverified    |
| p8_logent_item_digg                  |
| p8_logent_item_fromdown_             |
| p8_logent_item_fromdown_addon        |
| p8_logent_item_member                |
| p8_logent_item_member_collection     |
| p8_logent_item_mood                  |
| p8_logent_item_mood_data             |
| p8_logent_item_pay                   |
| p8_logent_item_progress              |
| p8_logent_item_search                |
| p8_logent_item_tag                   |
| p8_logent_item_tag_item              |
| p8_logent_item_unverified            |
| p8_logent_item_unwork                |
| p8_logent_item_work_                 |
| p8_logent_item_work_addon            |
| p8_logent_member                     |
| p8_logent_model                      |
| p8_logent_model_field                |
| p8_mail_queue                        |
| p8_member                            |
| p8_member_buy_role                   |
| p8_member_friend                     |
| p8_member_friend_category            |
| p8_member_friend_unverified          |
| p8_member_getpasswd                  |
| p8_member_menu                       |
| p8_member_recharge                   |
| p8_member_recharge_card              |
| p8_member_role                       |
| p8_message                           |
| p8_module                            |
| p8_navigation_menu                   |
| p8_notify_                           |
| p8_notify_sign_in                    |
| p8_page_                             |
| p8_pagecache                         |
| p8_pay_interface                     |
| p8_pay_log                           |
| p8_pay_member_interface              |
| p8_pay_order                         |
| p8_pay_order_lock                    |
| p8_plugin                            |
| p8_role                              |
| p8_role_group                        |
| p8_role_group_1_data                 |
| p8_role_group_2_data                 |
| p8_role_group_3_data                 |
| p8_role_group_4_data                 |
| p8_role_group_5_data                 |
| p8_role_group_6_data                 |
| p8_role_group_7_data                 |
| p8_role_group_field                  |
| p8_session                           |
| p8_special_                          |
| p8_special_category                  |
| p8_sphinx                            |
| p8_spider_category                   |
| p8_spider_item                       |
| p8_spider_item_addon                 |
| p8_spider_rule                       |
| p8_system                            |
| p8_vote_                             |
| p8_vote_option                       |
| p8_vote_voter                        |
| p8_work_attachment                   |
| p8_work_category                     |
| p8_work_item                         |
| p8_work_item_article_                |
| p8_work_item_article_addon           |
| p8_work_item_attribute               |
| p8_work_item_comment                 |
| p8_work_item_comment_id              |
| p8_work_item_comment_unverified      |
| p8_work_item_digg                    |
| p8_work_item_fromdown_               |
| p8_work_item_fromdown_addon          |
| p8_work_item_member                  |
| p8_work_item_member_collection       |
| p8_work_item_mood                    |
| p8_work_item_mood_data               |
| p8_work_item_pay                     |
| p8_work_item_progress                |
| p8_work_item_search                  |
| p8_work_item_tag                     |
| p8_work_item_tag_item                |
| p8_work_item_unverified              |
| p8_work_item_unwork                  |
| p8_work_item_work_                   |
| p8_work_item_work_addon              |
| p8_work_item_work_opinion            |
| p8_work_item_work_progress           |
| p8_work_item_work_score              |
| p8_work_member                       |
| p8_work_model                        |
| p8_work_model_field                  |
| v_expert_item_work_field             |
+--------------------------------------+


未进一步测试！

漏洞证明：

修复方案：

版权声明：转载请注明来源 带馅儿馒头@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2013-03-02 00:12

厂商回复：

CNVD确认并复现所述多个实例情况，同时确认为通用软件漏洞(尚未能精确评估影响范围)，已在3月1日下发转由CNCERT四川分中心协调网站运行维护方处置。
按完全影响机密性，部分影响可用性和完整性进行评分，基本危害评分8.97，发现技术难度系数1.0，涉及行业或单位影响系数1.7，综合rank=8.97*1.7=15.249

最新状态：

暂无