当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-087404

漏洞标题:某企业建站系统存在SQL注入(影响国内成千上万企业站)4-6处

相关厂商:良精科技

漏洞作者: 路人甲

提交时间:2014-12-17 15:02

修复时间:2015-03-17 15:04

公开时间:2015-03-17 15:04

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-12-17: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-03-17: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

RT

详细说明:

该系统是有良精科技技术有限公司开发的,由于影响范围比较大,强烈建议移交国家应急中心去于良精协调
良精官网:http://www.liangjing.org/qiyejianzhan/Ch/ProductClass-2.html
案例搜索方法
谷歌:inurl:Chinese/ProductShow.asp?ArticleID=

QQ图片20141216174328.jpg


案例:
注入点1:
http://www.shzxyy.com/chinese/FaqInfo.asp?ID=76
http://www.joinluck.com/Chinese/FaqInfo.asp?id=74
http://www.z-hope.com/Chinese/FaqInfo.asp?id=76
http://www.wmt.com.cn/chinese/FaqInfo.asp?id=76
http://www.autochair.cn/au/Chinese/FaqInfo.asp?id=76
http://www.fjjyarts.com/chinese/FaqInfo.asp?id=86
http://guard.net.cn/cn/index/FaqInfo.asp?id=268
http://www.fishmedicine.com.cn/Chinese/FaqInfo.asp?id=89
http://www.newcam-olym.com/Chinese/FaqInfo.asp?id=106
http://www.cdsysoft.cn/Chinese/FaqInfo.asp?id=3
http://www.wuzhouyiyao.com/Chinese/FaqInfo.asp?id=2
http://www.zhonglifurniture.com/Chinese/FaqInfo.asp?id=76
http://www.lrdyf.com/chinese/FaqInfo.asp?id=73
http://www.kchzhz.com/chinese/FaqInfo.asp?id=76
http://www.99smsoft.com/Chinese/FaqInfo.asp?id=2
http://www.xxctmy.com/chinese/FaqInfo.asp?id=88
http://www.zh-rx.com/zhrx/Chinese/FaqInfo.asp?id=73
http://www.xinjihai.com/Chinese/FaqInfo.asp?id=81
http://www.hngfz.com/Chinese/FaqInfo.asp?id=78
http://www.zqtm.cn/service/faqInfo.asp?id=4
http://www.ennanna.com/chinese/FaqInfo.asp?id=80
http://www.jllgs.com/chinese/FaqInfo.asp?id=76
http://www.sh-q.com.cn/Chinese/FaqInfo.asp?id=73
http://www.jmjjgc.com/chinese/FaqInfo.asp?id=89
http://www.scxoy.com/Chinese/FaqInfo.asp?id=73
http://www.cscl.cn/Chinese/FaqInfo.asp?id=73
http://www.pinganxiaofang.cn/Chinese/FaqInfo.asp?id=15
http://www.lopo.com.cn/chinese/FaqInfo.asp?id=74
注入点2:
http://www.leige.com.cn/English/En_ProductShow.asp?ArticleID=601
http://www.zhongjinalu.com/English/En_ProductShow.asp?ArticleID=314
http://www.yike.com.cn/English/en_ProductShow.asp?ArticleID=878
http://www.cuiquan.com/English/En_ProductShow.asp?ArticleID=180
http://www.joinluck.com//English/En_ProductShow.asp?ArticleID=149
http://www.hengtongchemical.com/english/En_ProductShow.asp?ArticleID=11
http://www.fumingwei.com/English/En_ProductShow.asp?ArticleID=24
http://www.watsin.com.cn/English/En_ProductShow.asp?ArticleID=169
http://www.yunntong.com/english/En_ProductShow.asp?ArticleID=25
http://www.taishantyre.com/English/En_ProductShow.asp?ArticleID=132
http://www.mme.com.cn/English/En_ProductShow.asp?ArticleID=287
http://www.totemamusement.com/English/En_ProductShow.asp?ArticleID=432
http://www.z-hope.com/English/En_ProductShow.asp?ArticleID=152
http://www.wishfuloptical.com/English/En_ProductShow.asp?ArticleID=219
http://www.jingliangroup.com/english/En_ProductShow.asp?ArticleID=138
http://www.pandaintl.com.cn/en/En_ProductShow.asp?ArticleID=579
http://www.medicn.cn/english/En_ProductShow.asp?ArticleID=281
http://www.hanbo.cc/udisk/english/En_ProductShow.asp?ArticleID=1140
http://www.zhihefrp.com/English/En_ProductShow.asp?ArticleID=143
http://www.scrfast.com/English/En_ProductShow.asp?ArticleID=319
http://www.ldfibre.cn/English/En_ProductShow.asp?ArticleID=171
http://www.binzim.net/English/En_ProductShow.asp?ArticleID=607
http://www.kalifon.com/en/En_ProductShow.asp?ArticleID=140
http://www.zhmachinery.com/En/En_ProductShow.asp?ArticleID=174
注入点3:
http://www.zhongjinalu.com/English/En_Product.asp?EnBigClassName=Smoke%20foil
http://www.yike.com.cn/English/En_Product.asp?EnBigClassName=Stand%20Series
http://www.joinluck.com//English/En_Product.asp?EnBigClassName=LED-Based%20Products
http://www.hengtongchemical.com/english/En_Product.asp?EnBigClassName=hg
http://www.yunntong.com/english/En_Product.asp?EnBigClassName=Anti-decubitus\Pump
http://www.watsin.com.cn/English/En_Product.asp?EnBigClassName=GeneTime
http://www.fumingwei.com/English/En_Product.asp?EnBigClassName=For%20Medical
http://www.taishantyre.com/English/En_Product.asp?EnBigClassName=CAR%20TYRE%20SERIES
http://www.mme.com.cn/English/En_Product.asp?EnBigClassName=mobile%20series
http://www.totemamusement.com/English/En_Product.asp?EnBigClassName=PRODUCTS
http://www.z-hope.com/English/En_Product.asp?EnBigClassName=cable%20recovery%20equipment
http://www.wishfuloptical.com/English/En_Product.asp?EnBigClassName=CR39%20Resin%20Lens
http://www.jingliangroup.com/english/En_Product.asp?EnBigClassName=Lens%20edger
http://www.pandaintl.com.cn/en/En_Product.asp?EnBigClassName=LCD%20Panel
http://www.medicn.cn/English/En_Product.asp?EnBigClassName=Intermediates/Chemicals
http://www.hanbo.cc/udisk/english/En_Product.asp?EnBigClassName=USB%20FLASH%20DRIVES
http://www.zhihefrp.com/English/En_Product.asp?EnBigClassName=National%20defense
http://www.scrfast.com/English/En_Product.asp?EnBigClassName=WASHERS
http://www.binzim.net/English/En_Product.asp?BigClassName=Ultrasonic%20Beauty%20Instrument
http://www.kalifon.com/en/En_Product.asp?EnBigClassName=New%20products
http://www.zhmachinery.com/En/En_Product.asp?EnBigClassName=Laundry%20Soap%20Machine

漏洞证明:

我就随便演示几个站了
http://www.newcam-olym.com/Chinese/FaqInfo.asp?id=106

QQ图片20141216174710.jpg


http://www.kchzhz.com/chinese/FaqInfo.asp?id=76

QQ图片20141216174841.jpg


http://www.leige.com.cn/English/En_ProductShow.asp?ArticleID=601

QQ图片20141216175052.jpg


http://www.yike.com.cn/English/en_ProductShow.asp?ArticleID=878

QQ图片20141216175209.jpg


http://www.zhongjinalu.com/English/En_Product.asp?EnBigClassName=Smoke%20foil

QQ图片20141216175647.jpg

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝