漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-087398
漏洞标题：某企业建站系统存在SQL注入（影响国内成千上万企业站）1-3处
相关厂商：良精科技
漏洞作者： 路人甲
提交时间：2014-12-17 14:53
修复时间：2015-03-17 14:54
公开时间：2015-03-17 14:54
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-12-17： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-03-17： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
RT
详细说明：
该系统是有良精科技技术有限公司开发的，由于影响范围比较大，强烈建议移交国家应急中心去于良精协调
良精官网：http://www.liangjing.org/qiyejianzhan/Ch/ProductClass-2.html
案例搜索方法：谷歌：inurl:Chinese/ProductShow.asp?ArticleID=
官方demo：http://admin.asp99.cn/2008/Chinese/index.asp由于有WAF所以不能直接工具注入，我就不用demo演示了
注入点1：
http://www.leige.com.cn/Chinese/ProductShow.asp?ArticleID=601
http://218.4.48.253/Chinese/ProductShow.asp?ArticleID=192
http://www.ccm-hardware.com/chinese/ProductShow.asp?ArticleID=159
http://www.yike.com.cn/chinese/ProductShow.asp?ArticleID=878
http://www.hengtongchemical.com/chinese/ProductShow.asp?ArticleID=12
http://www.ssllt.com/llt/Chinese/ProductShow.asp?ArticleID=190
http://www.jllgs.com/chinese/ProductShow.asp?ArticleID=188
http://www.joinluck.com/Chinese/ProductShow.asp?ArticleID=151
http://www.jsdydj.cn/Chinese/ProductShow.asp?ArticleID=173
http://www.sh-q.com.cn/Chinese/ProductShow.asp?ArticleID=193
http://www.ruidongyb.com/Chinese/ProductShow.asp?ArticleID=138
http://www.99smsoft.com/Chinese/ProductShow.asp?ArticleID=176
http://www.wmt.com.cn/chinese/ProductShow.asp?ArticleID=274
http://www.mhtsoft.com/Chinese/ProductShow.asp?ArticleID=204
http://www.wuzhouyiyao.com/Chinese/ProductShow.asp?ArticleID=188
http://www.csf.net.cn/2008/chinese/ProductShow.asp?ArticleID=223
http://www.cdsysoft.cn/Chinese/ProductShow.asp?ArticleID=175
http://www.high-hot.cn/Chinese/ProductShow.asp?ArticleID=158
http://www.bjztxy.com/Chinese/ProductShow.asp?ArticleID=144
http://www.tzymjx.com/chinese/ProductShow.asp?ArticleID=255
http://www.pabx.cn/chinese/ProductShow.asp?ArticleID=165
http://jsxf.com.cn/Chinese/ProductShow.asp?ArticleID=196
http://www.tgbjs.com/Chinese/ProductShow.asp?ArticleID=140
http://www.zhmachinery.com/Chinese/ProductShow.asp?ArticleID=178
http://www.goldcode.cn/chinese/ProductShow.asp?ArticleID=370
注入点2：
http://www.ccm-hardware.com/chinese/Product.asp?BigClassName=%B9%A4%BE%DF%BF%DB
http://www.leige.com.cn/Chinese/Product.asp?BigClassName=%B8%F4%D2%F4%B2%C4%C1%CF
http://www.yike.com.cn/chinese/Product.asp?BigClassName=%D6%A7%BC%DC%CF%B5%C1%D0
http://www.hengtongchemical.com/chinese/Product.asp?BigClassName=%BB%AF%B9%A4%B2%FA%C6%B7
http://www.jllgs.com/chinese/Product.asp?BigClassName=%B8%D6%CB%BF%C9%FE%CF%B5%C1%D0
http://www.joinluck.com/Chinese/Product.asp?BigClassName=LED%D3%A6%D3%C3%B2%FA%C6%B7
http://www.jsdydj.cn/Chinese/Product.asp?BigClassName=%D6%B1%C1%F7%B5%E7%BB%FA
http://www.ssllt.com/llt/Chinese/Product.asp?BigClassName=%C6%FB%B3%B5%D3%B0%D2%F4%D3%C3%C6%B7
http://www.sh-q.com.cn/Chinese/Product.asp?BigClassName=CAD%20%BC%C6%CB%E3%BB%FA%B8%A8%D6%FA%C9%E8%BC%C6
http://www.ruidongyb.com/Chinese/Product.asp?BigClassName=%D1%B9%C1%A6%B1%ED%BB%FA%D0%BE
http://www.99smsoft.com/Chinese/Product.asp?BigClassName=%D7%DB%BA%CF%C8%ED%BC%FE%CF%B5%C1%D0
http://www.wmt.com.cn/chinese/Product.asp?BigClassName=%B8%DC%B8%CB%D6%B8%CA%BE%B1%ED
http://www.wuzhouyiyao.com/Chinese/Product.asp?BigClassName=%C8%AB%B9%FA%D5%D0%C9%CC%C6%B7%D6%D6
http://www.mhtsoft.com/Chinese/Product.asp?BigClassName=%D0%DD%CF%D0/%B2%CD%D2%FB
http://www.csf.net.cn/2008/chinese/Product.asp?BigClassName=%CA%E0%D6%E1
http://www.cdsysoft.cn/Chinese/Product.asp?BigClassName=%B0%F1%C9%CF%CB%E3%C3%FC%CF%B5%C1%D0
http://www.bjztxy.com/Chinese/Product.asp?BigClassName=%B9%AB%CB%BE%B2%FA%C6%B7
http://www.tzymjx.com/chinese/Product.asp?BigClassName=%C8%AB%D7%D4%B6%AF%B4%B5%C6%BF%BB%FA
http://www.pabx.cn/chinese/Product.asp?BigClassName=%B3%CC%BF%D8%B5%E7%BB%B0%BD%BB%BB%BB%BB%FA
http://jsxf.com.cn/Chinese/Product.asp?BigClassName=%B9%AB%C2%B7%B9%A4%B3%CC
http://www.zhmachinery.com/Chinese/Product.asp?BigClassName=%CF%E3%D4%ED%C9%FA%B2%FA%C9%E8%B1%B8
http://www.goldcode.cn/chinese/Product.asp?BigClassName=%B5%E7%B6%AF%B3%B5%B5%A5%CF%F2%B7%C0%B5%C1%C6%F7
注入点3：
http://www.leige.com.cn/Chinese/NewsInfo.asp?Action=Co&id=126
http://www.zhongjinalu.com/chinese/NewsInfo.asp?Action=Co&id=95
http://www.yike.com.cn/chinese/NewsInfo.asp?Action=Co&id=107
http://www.get-extrusion.com/chinese/NewsInfo.asp?Action=Co&id=148
http://www.cuiquan.com/chinese/NewsInfo.asp?Action=Co&id=20
http://www.joinluck.com/Chinese/NewsInfo.asp?Action=Co&ID=105
http://www.toshiba-gtbs.com/Chinese/NewsInfo.asp?Action=Co&id=85
http://www.powerteck.com.cn/Chinese/NewsInfo.asp?Action=Co&id=102
http://yj183.com/mgjx/chinese/NewsInfo.asp?Action=Co&id=89
http://www.shzxyy.com/chinese/NewsInfo.asp?Action=Co&ID=129
http://www.chang-de.com/CN/NewsInfo.asp?Action=Co&id=117
http://www.zjxcxj.com/Chinese/NewsInfo.asp?Action=Co&id=95
http://www.hengtongchemical.com/chinese/NewsInfo.asp?Action=Co&id=674
http://www.simyi.com/chinese/newsinfo.asp?action=Co&id=134
http://www.cn-yule.com/chinese/NewsInfo.asp?Action=Co&id=100
http://www.tang-ju.com/chinese/NewsInfo.asp?Action=Co&id=96
http://www.z-hope.com/Chinese/NewsInfo.asp?Action=Co&ID=89
http://www.goldcode.cn/chinese/NewsInfo.asp?Action=Co&id=107
http://www.zhmachinery.com/Chinese/NewsInfo.asp?Action=Co&ID=145
http://www.greating-fortune.com/cn/NewsInfo.asp?Action=Co&id=83
http://www.tgbjs.com/Chinese/NewsInfo.asp?Action=Co&ID=91
http://cnxiongfeng.com/cn/NewsInfo.asp?Action=Co&ID=103
漏洞证明：
我就随便演示几个站了
http://www.jsdydj.cn/Chinese/ProductShow.asp?ArticleID=173
http://www.cdsysoft.cn/Chinese/ProductShow.asp?ArticleID=175
http://www.jsdydj.cn/Chinese/Product.asp?BigClassName=%D6%B1%C1%F7%B5%E7%BB%FA
http://www.cdsysoft.cn/Chinese/Product.asp?BigClassName=%B0%F1%C9%CF%CB%E3%C3%FC%CF%B5%C1%D0
http://www.cdsysoft.cn/Chinese/NewsInfo.asp?Action=Co&id=127
http://www.jsdydj.cn/Chinese/NewsInfo.asp?Action=Co&id=86
修复方案：
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝