当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0112092

漏洞标题:某票务系统sql注入漏洞3处,影响大量商务网站#6

相关厂商:票友软件

漏洞作者: 路人甲

提交时间:2015-05-29 17:08

修复时间:2015-09-06 00:00

公开时间:2015-09-06 00:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-29: 细节已通知厂商并且等待厂商处理中
2015-06-03: 厂商已经确认,细节仅向厂商公开
2015-06-06: 细节向第三方安全合作伙伴开放
2015-07-28: 细节向核心白帽子及相关领域专家公开
2015-08-07: 细节向普通白帽子公开
2015-08-17: 细节向实习白帽子公开
2015-09-06: 细节向公众公开

简要描述:

又三处注入

详细说明:

票友软件 http://www.piaoyou.org/
票友软件是一款用于航空票务代理专用机票管理系统,集成网上订票管理、电话录音弹屏、企业差旅管理、同业订单管理、会员管理、积分管理、短信发送、员工管理、报表生成、财务管理等强大功能。
这里以官方演示站来进行演示
http://demo.piaoyou.org/
具体案例的话可以通过搜索
intitle:票友ERP管理系统 来进行寻找
用官方演示站演示账户密码登陆后
注入点位于统计汇总->航空公司销量表->更多条件->舱位、航班和起止地三处
生成报表
截包

POST /Finance/air_report.aspx HTTP/1.1
Host: demo.piaoyou.org
Proxy-Connection: keep-alive
Content-Length: 11997
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://demo.piaoyou.org
User-Agent: Mozilla/5.0 (Windows NT 5.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.89 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://demo.piaoyou.org/Finance/air_report.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4
Cookie: ASP.NET_SessionId=0rvo2dtrjzqzplvcv2vzu513; pycookie=loginname=admin&truename=%e7%b3%bb%e7%bb%9f%e7%ae%a1%e7%90%86%e5%91%98&flag=1&datagroup=&kefugroup=%e7%bd%91%e7%bb%9c%e9%83%a8&kpgroup=0&kpdian=none%7c%e5%a4%a9%e5%9c%b0%e8%a1%8c%7c%e4%b8%8d%e5%a4%9c%e5%9f%8e%7c%e4%bb%8a%e6%97%a5%e5%a4%a9%e4%b8%8b%e9%80%9a%7c%e5%8d%97%e8%88%aa%e7%bd%91%e7%ab%99%7c%e5%9b%bd%e8%88%aa%7c
__VIEWSTATE=%2FwEPDwULLTEwNzgwMzI5MzEPZBYCAgMPZBYIAgkPEA8WBh4NRGF0YVRleHRGaWVsZAUHY29tcGFueR4ORGF0YVZhbHVlRmllbGQFBmFpcm51bR4LXyFEYXRhQm91bmRnZBAVuQEUPeaJgOacieiIquepuuWFrOWPuD0S5rex5Zyz6Iiq56m65YWs5Y%2B4EuS4iua1t%2BiIquepuuWFrOWPuBjkuK3lm73lm73pmYXoiKrnqbrlhazlj7gS5bGx5Lic6Iiq56m65YWs5Y%2B4EuWbm%2BW3neiIquepuuWFrOWPuBLljqbpl6joiKrnqbrlhazlj7gS5Lic5pa56Iiq56m65YWs5Y%2B4EuaIkOmDveiIquepuuWFrOWPuBLljZfmlrnoiKrnqbrlhazlj7gS56Wl6bmP6Iiq56m65YWs5Y%2B4EuaYpeeni%2BiIquepuuWFrOWPuBLmvrPpl6joiKrnqbrlhazlj7gY6aaZ5riv5Lit5a%2BM6Iiq56m65YWs5Y%2B4GOS4reWbveWQieelpeiIquepuuWFrOWPuBjkuK3lm73kuJzmmJ%2FoiKrnqbrlhazlj7gS6aOe6bmw6Iiq56m65YWs5Y%2B4GOS4reWbveiBlOWQiOiIquepuuWFrOWPuBLph5Hpub%2FoiKrnqbrlhazlj7gS6YeN5bqG6Iiq56m65YWs5Y%2B4DOilv%2BmDqOiIquepugzljY7lpI%2FoiKrnqboS5Lit5Zu96KW%2F5Y2X6Iiq56m6EuWlpeWHr%2BiIquepuuWFrOWPuBLmtbfljZfoiKrnqbrlhazlj7gM6KW%2F6JeP6Iiq56m6DOebm%2BS7o%2BiIquepuhjms73opb%2FmrKfmtLLoiKrnqbrlhazlj7gS6L%2Bc5Lic6Iiq56m65YWs5Y%2B4G%2Bavm%2BmHjOWhlOWwvOS6muiIquepuuWFrOWPuA%2FljaHloZTlsJToiKrnqboY6Zi%2F6IGU6YWL5o%2BQ5ZOI5b636Iiq56m6Hue7tOWwlOS6rOWkp%2Bilv%2Ba0i%2BiIquepuuWFrOWPuBLpn6nkuproiKrnqbrlhazlj7gh5a2f5Yqg5ouJ6Iiq56m65YWs5Y%2B477yI5a2f6Iiq77yJJOe9l%2BmprOWwvOS6muiIquepuuWFrOWPuO%2B8iOe9l%2BiIqu%2B8iRLotorljZfoiKrnqbrlhazlj7gY5paw5Yeg5YaF5Lqa6Iiq56m65YWs5Y%2B4GOaWh%2BiOseeOi%2BWutuiIquepuuWFrOWPuBLml6XkuproiKrnqbrlhazlj7gS5bi46I2j6Iiq56m65YWs5Y%2B4FeS9m%2BW%2Bl%2Binkuepuui%2FkOWFrOWPuBXogq%2FlsLzkuproiKrnqbrlhazlj7gS5rW35Y2X6Iiq56m65YWs5Y%2B4GOWlpeael%2BWMueWFi%2BiIquepuuWFrOWPuCfopb%2Fnj63niZnvvIjkvIrmr5TliKnkuprvvInoiKrnqbrlhazlj7gS5Yaw5bKb6Iiq56m65YWs5Y%2B4IeWiqOilv%2BWTpeiIquepuuWFrOWPuO%2B8iOWiqOiIqu%2B8iSTnibnnq4vlsLzovr7lkozlpJrlt7Tlk6XoiKrnqbrlhazlj7gt5aeU5YaF55Ge5ouJ6Iiq56m65YWs5Y%2B477yI6Zi%2F5paH6JCo5YWs5Y%2B477yJFeWiqOilv%2BWTpeepuui%2FkOWFrOWPuBvlk6Xmlq%2Fovr7pu47liqDnqbrov5Dlhazlj7gb5aWl5pav54m55ouJ5bCU6Iiq56m65YWs5Y%2B4G%2BaRqea0m%2BWTpeeOi%2BWutuiIquepuuWFrOWPuBjpmL%2Flvrfph4zkuproiKrnqbrlhazlj7gS5aSN5YW06Iiq56m65YWs5Y%2B4FeiLj%2BmHjOWNl%2BiIquepuuWFrOWPuBXlpI%2FlqIHlpLfoiKrnqbrlhazlj7gb6buY6YeM6L%2Bq5oGp57qz6Iiq56m65YWs5Y%2B4GOe6s%2Bexs%2BavlOS6muiIquepuuWFrOWPuBXlnK3kuprpgqPoiKrnqbrlhazlj7gS56eY6bKB6Iiq56m65YWs5Y%2B4J%2BW3tOaLv%2BmprOepuui%2FkOWFrOWPuO%2B8iOenkeW4leWFrOWPuO%2B8iRvoi7Hlm73nsbPlvrflhbDoiKrnqbrlhazlj7gS5Yqg57qz6Iiq56m65YWs5Y%2B4GOS5jOWFueWIq%2BWFi%2BiIquepuuWFrOWPuBvkuYzmi4nlnK3lm73pmYXnqbrov5Dlhazlj7gS6YCa55So6Iiq56m65YWs5Y%2B4EueZveS7pOiIquepuuWFrOWPuBXpqazogLPku5boiKrnqbrlhazlj7gV6I6x57Si5omY6Iiq56m65YWs5Y%2B4FeiSgue9l%2Bael%2BiIquepuuWFrOWPuBLlpKfmuZboiKrnqbrlhazlj7gV5LmM5YWL5YWw6Iiq56m65YWs5Y%2B4GOmYv%2BabvOiIquepuuacjeWKoeWFrOWPuB7mlrDopb%2FlhbDlronloZ7nibnoiKrnqbrlhazlj7ge5pav5aiB5aOr5YWw55qH5a626Iiq56m65YWs5Y%2B4GOWdpuahkeWwvOS6muiIquepuuWFrOWPuBjljbHlnLDpqazmi4noiKrnqbrlhazlj7gY5rip54m55YaF5pu856m66L%2BQ5YWs5Y%2B4GOeOu%2BWIqee7tOS6muiIquepuuWFrOWPuBLph4zor7roiKrnqbrlhazlj7gS5qKF6JCo6Iiq56m65YWs5Y%2B4FeeOr%2BW3tOilv%2BiIquepuuWFrOWPuBvmrKfmtLLot6jlnLDljLroiKrnqbrlhazlj7gS5Y2a5pmu6Iiq56m65YWs5Y%2B4GOe%2BjuWbveilv%2BWNl%2BiIquepuuWFrOWPuBXlt7Tmi4nlnK3oiKrnqbrlhazlj7g55aeU5YaF55Ge5ouJ6Iiq56m65pyN5Yqh5YWs5Y%2B477yI5aGe5bCU57u05Lmf6JCo5YWs5Y%2B477yJEuiLj%2BS4ueiIquepuuWFrOWPuBLlvIDmma7oiKrnqbrlhazlj7gY5aGU5Y2h5Zu96ZmF6Iiq56m65YWs5Y%2B4FemprOaLiee7tOiIquepuuWFrOWPuBjogZTlkIjnjovlm73oiKrnqbrlhazlj7gV5pu85YWL5pav6Iiq56m65YWs5Y%2B4FeS4reilv%2BmDqOaNt%2Bi%2FkOWFrOWPuBXkuYzlubLovr7oiKrnqbrlhazlj7gV6Zi%2F5rSb5ZOI6Iiq56m65YWs5Y%2B4GOS4reWbveaWsOWNjuiIquepuuWFrOWPuBLkuIfog73mjbfov5Dlhazlj7gS54Gr54Ks6Iiq56m65YWs5Y%2B4EuWNjuS%2FoeiIquepuuWFrOWPuBLot6jmtbfnqbrov5Dlhazlj7gV5YWL572X5pav6Iiq56m65YWs5Y%2B4HuiKrOWFsOiIquepuuWFrOWPuO%2B8iOiKrOiIqu%2B8iSHku6XoibLliJfoiKrnqbrlhazlj7jvvIjku6XoiKrvvIkS5YyX5qyn6Iiq56m65YWs5Y%2B4HuiLseWbveiIquepuuWFrOWPuO%2B8iOiLseiIqu%2B8iRjlj6Tlt7Tnu5%2FkuIDoiKrnqbrlhazlj7gh5Y2i5qOu5aCh6Iiq56m65YWs5Y%2B477yI5Y2i6Iiq77yJJOW4g%2BaLieajruaWr%2BWNl%2Be%2Bjui%2FnOS4nOepuui%2FkOWFrOWPuBLlm73ms7DoiKrnqbrlhazlj7gV6YWL6ZW%2F5Zu96Iiq56m65YWs5Y%2B4IeWMiOeJmeWIqeiIquepuuWFrOWPuO%2B8iOWMiOiIqu%2B8iRXlt7TlsJTlubLoiKrnqbrlhazlj7gk5YWo5pel5pys6Iiq56m65YWs5Y%2B477yI5YWo5pel56m677yJHuW3tOWfuuaWr%2BWdpuWbvemZheiIquepuuWFrOWPuCTms7Dlm73lm73pmYXoiKrnqbrlhazlj7jvvIjms7DoiKrvvIkV56eR5aiB54m56Iiq56m65YWs5Y%2B4EuWKs%2Bi%2BvuiIquepuuWFrOWPuCfpqazmnaXopb%2FkuproiKrnqbrlhazlj7jvvIjpqazmnaXoiKrvvIkh5Zyf6ICz5YW26Iiq56m65YWs5Y%2B477yI5Zyf6Iiq77yJGOavm%2BmHjOaxguaWr%2BiIquepuuWFrOWPuCHlpaXlnLDliKnoiKrnqbrlhazlj7jvvIjlpaXoiKrvvIkV5aSq5bmz5rSL6Iiq56m65YWs5Y%2B4G%2BWwvOaziuWwlOeah%2BWutuiIquepuuWFrOWPuBLkuK3ljY7oiKrnqbrlhazlj7gY5qKF5bCU5pav5YWL6Iiq56m65YWs5Y%2B4GOe%2BjuWbveilv%2BmDqOiIquepuuWFrOWPuBjnuqbml6bnjovlrrboiKrnqbrlhazlj7gS5YWw5Y2h6Iiq56m65YWs5Y%2B4FeaWsOWKoOWdoeiIquepuuWFrOWPuBXplKHli5LlhYvoiKrnqbrlhazlj7gS5Lmf6Zeo6Iiq56m65YWs5Y%2B4GOWNmuiMqOeTpue6s%2BiIquepuuWFrOWPuBXloZTluIzmj5DoiKrnqbrlhazlj7gq5ouJ5b6356eR6Iiq56m65YWs5Y%2B477yI5bq35biD6Zu35YWs5Y%2B477yJEuS6mua0suiIquepuuWFrOWPuBXokaHokITniZnoiKrnqbrlhazlj7gY5YyX6aOO5YyX5pa56Iiq56m65YWs5Y%2B4FeeOr%2BiIquepuui%2FkOi%2Bk%2BWFrOWPuBLnjq%2FnkIPoiKrnqbrlhazlj7gS5aSn6Z%2Bp6Iiq56m65YWs5Y%2B4GOiOq%2BahkeavlOWFi%2BiIquepuuWFrOWPuBXpmL%2FmoLnlu7fnqbrov5Dlhazlj7ge5Y%2BZ5Yip5Lqa6Zi%2F5ouJ5Lyv6Iiq56m65YWs5Y%2B4G%2BWfg%2BWhnuS%2FhOavlOS6muiIquepuuWFrOWPuBLmtbfmub7oiKrnqbrlhazlj7gY6I235YWw546L5a626Iiq56m65YWs5Y%2B4EuS4reS4nOiIquepuuWFrOWPuBLln4Plj4roiKrnqbrlhazlj7gb5Yqg5Yip56aP5bC85Lqa6Iiq56m65YWs5Y%2B4EuazouWFsOiIquepuuWFrOWPuBXmr5TliKnml7boiKrnqbrlhazlj7gS5Y2X6Z2e6Iiq56m65YWs5Y%2B4EueRnuWjq%2BiIquepuuWFrOWPuBXmlrDopb%2FlhbDoiKrnqbrlhazlj7gh5r6z5aSn5Yip5Lqa5a6J5aGe54m56Iiq56m65YWs5Y%2B4Eumdnua0suiIquepuuWFrOWPuCrljbDluqbvvIjlm73pmYXvvInoiKrnqbrlhazlj7jvvIjljbDoiKrvvIkY5Lqa576O5Yip5Yqg6Iiq56m65YWs5Y%2B4EuWkp%2BmZhuiIquepuuWFrOWPuCHkuInop5LvvIjlvrflsJTloZTvvInoiKrnqbrlhazlj7gS6KW%2F5YyX6Iiq56m65YWs5Y%2B4IeWKoOaLv%2BWkp%2BiIquepuuWFrOWPuO%2B8iOWKoOiIqu%2B8iRvlpKfopb%2FmtIvoiKrnqbrov5DovpPlhazlj7ge5pel5pys6Iiq56m65YWs5Y%2B477yI5pel6Iiq77yJG%2BS%2FhOe9l%2BaWr%2BWbvemZheiIquepuuWFrOWPuCHogZTlkIjoiKrnqbrlhazlj7jvvIjnvo7ogZToiKrvvIkS5riv6b6Z6Iiq56m65YWs5Y%2B4EuaxieiOjuiIquepuuWFrOWPuCHokaHokITniZnoiKrnqbrlhazlj7jvvIjokaHoiKrvvIkY5aGe5rWm6Lev5pav6Iiq56m65YWs5Y%2B4GOmYv%2BaLieaWr%2BWKoOiIquepuuWFrOWPuBXlkIjkvJflm73oiKrnqbrlhazlj7gV55Om5Yqb5qC86Iiq56m65YWs5Y%2B4Eua4r%2Bm%2BmeiIquepuuWFrOWPuBXpmL%2FmoLnlu7foiKrnqbrlhazlj7gk5pm65Yip5Zu95a626Iiq56m65YWs5Y%2B477yI5pm66Iiq77yJM%2BeOu%2BWIqee7tOS6mu%2B8iOWKs%2BWfg%2BW%2Bt%2B%2B8ieiIquepuuWFrOWPuO%2B8iOeOu%2BiIqu%2B8iRXniLHlsJTlhbDoiKrnqbrlhazlj7gh5oSP5aSn5Yip6Iiq56m65YWs5Y%2B477yI5oSP6Iiq77yJHuazleWbveiIquepuuWFrOWPuO%2B8iOazleiIqu%2B8iRjljbDluqbnqbrov5DogqHku73lhazlj7gb5rKZ54m56Zi%2F5ouJ5Lyv6Iiq56m65YWs5Y%2B4FbkBFD3miYDmnInoiKrnqbrlhazlj7g9AzQ3OQM3NzQDOTk5Azc4MQM4NzYDNzMxAzc4MQM4MTEDNzg0Azg1OQM5Q0MDNjc1Azg1MQMwMTgDODgzA0FCQwM4MjIDODgwAzg3OAM4NDcDOTg5AzAwMAMwMDADODgwAzAwMAMxOTIDMjY3AzI2NQMyMjIDMDAwAzAwMAM5MzIDOTg4Azk5NwMyODEDNzM4AzY1NgM2NzIDNjg4AzY5NQM2OTYDNzA2A0MwNQMwNTADMDc1AzEwOAMxMzkDMTA2AzEyOAMxMzIDMTMzAzE0MwMxNDcDMTY1AzE3MAMxOTIDMTczAzE5MQMxODYDMjA2AzIxMAMyMzADMjM2AzIzNwMyNTADMjg2AzUyNQM2MjgDNjQzAzcyMQM3MzQDODQ2Azg5MQM5MTADOTQxAzE0MQMxOTcDMjQwAzI2NgMyNzUDMzg0AzUzMwM2NTMDNzE4AzkyOAM1MjYDNjkyAzk4NQMyMDADMzA2AzIwMgMxNjcDMTMwAzkxNgM0NTMDNjczAzMyNwNDMTcDOTU4AzY4MAM4MDMDOTQyAzcyNAMxMDUDMTE0AzExNwMxMjUDMTM2AzE0OQMxNTQDMTYwAzE3NgMxODIDMTk2AzIwNQMyMTQDMjE3AzIyOQMyMzEDMjMyAzIzNQMyMzkDMjU3AzI2MAMyODUDMjk3AzM0OQM0MDEDNTEyAzYwMwM2MTgDNjI5AzYzNQM2MzYDMTM1AzE0NQM1MzIDNjg1AzU4OQM5NzkDMDE1AzE4MAMwNjgDMDY5AzA3MAMwNzEDMDcyAzA3NAMwNzYDMDc3AzA3OAMwODADMDgyAzA4MwMwODUDMDg2AzA5MAMwOTIDMDk4AzAwMQMwMDUDMDA2AzAxMgMwMTQDNzQwAzEzMQM1NTUDMDE2AzAwMAMyMjADMDQ3AzA0OAMwMjcDMDM3AzA0MgMwNDMDMDQ0AzA0NQMwNTEDMDUzAzA1NQMwNTcDMDU4AzA2NRQrA7kBZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dkZAIPDxYCHgRUZXh0BTg8c2NyaXB0IHR5cGU9J3RleHQvamF2YXNjcmlwdCc%2BbG9hZGluZ19jbG9zZSgpOzwvc2NyaXB0PmQCEw8QDxYGHwAFBXB0eXBlHwEFBXB0eXBlHwJnZBAVBwg95omA5pyJPQnlm73lhoVCU1AJ5Zu96ZmFQlNQA0IyQgnlm6LpmJ%2FnpagG5YW25a6DDOWNh%2BiIseaNouW8gBUHAAnlm73lhoVCU1AJ5Zu96ZmFQlNQA0IyQgnlm6LpmJ%2FnpagG5YW25a6DDOWNh%2BiIseaNouW8gBQrAwdnZ2dnZ2dnZGQCGw88KwARAgAPFgQfAmceC18hSXRlbUNvdW50AgNkARAWABYAFgAWAmYPZBYIAgEPZBYiZg8PFgIfAwUCNzBkZAIBDw8WAh8DBQZKU1pWVEVkZAICDw8WAh8DBQ1OS0dIS0d8SEtHTktHZGQCAw8PFgIfAwULTVU3NjUsTVU3NjZkZAIEDw8WAh8DBQNULFRkZAIFDw8WAh8DBRU1LTA0IDA4OjAwLzUtMDkgMTg6MTVkZAIGDw8WAh8DBQ43ODEtOTI5NDczODk2NWRkAgcPDxYCHwMFBiZuYnNwO2RkAggPDxYCHwMFGkNBTlRSRUxML0FVQlJFWSBSRUFOTkEgQ0hEZGQCCQ8PFgIfAwUHMTg3MC4wMGRkAgoPDxYCHwMFBjI1My4wMGRkAgsPDxYCHwMFBjk3MC4wMGRkAgwPDxYCHwMFBjI1My4wMGRkAg0PDxYCHwMFBzIxMjMuMDBkZAIODw8WAh8DBQcxMTk0LjAwZGQCDw8PFgIfAwUGOTI5LjAwZGQCEA8PFgIfAwUJMjAxNS00LTMwZGQCAg9kFiJmDw8WAh8DBQI3MGRkAgEPDxYCHwMFBkpTWlZURWRkAgIPDxYCHwMFDU5LR0hLR3xIS0dOS0dkZAIDDw8WAh8DBQtNVTc2NSxNVTc2NmRkAgQPDxYCHwMFA1QsVGRkAgUPDxYCHwMFFTUtMDQgMDg6MDAvNS0wOSAxODoxNWRkAgYPDxYCHwMFDjc4MS05Mjk0NzM4OTY2ZGQCBw8PFgIfAwUGJm5ic3A7ZGQCCA8PFgIfAwUZQ0FOVFJFTEwvS0VMU09OIFRJR0VSIENIRGRkAgkPDxYCHwMFBjk3MC4wMGRkAgoPDxYCHwMFBjI1My4wMGRkAgsPDxYCHwMFBjk3MC4wMGRkAgwPDxYCHwMFBjI1My4wMGRkAg0PDxYCHwMFBzEyMjMuMDBkZAIODw8WAh8DBQcxMTk0LjAwZGQCDw8PFgIfAwUFMjkuMDBkZAIQDw8WAh8DBQkyMDE1LTQtMzBkZAIDD2QWImYPDxYCHwMFAjcwZGQCAQ8PFgIfAwUGSlNaVlRFZGQCAg8PFgIfAwUNTktHSEtHfEhLR05LR2RkAgMPDxYCHwMFC01VNzY1LE1VNzY2ZGQCBA8PFgIfAwUDVCxUZGQCBQ8PFgIfAwUVNS0wNCAwODowMC81LTA5IDE4OjE1ZGQCBg8PFgIfAwUONzgxLTkyOTQ3Mzg5NjdkZAIHDw8WAh8DBQYmbmJzcDtkZAIIDw8WAh8DBRZDQU5UUkVMTC9LRU5ORVROIEFBUk9OZGQCCQ8PFgIfAwUGOTcwLjAwZGQCCg8PFgIfAwUGMjUzLjAwZGQCCw8PFgIfAwUGOTcwLjAwZGQCDA8PFgIfAwUGMjUzLjAwZGQCDQ8PFgIfAwUHMTIyMy4wMGRkAg4PDxYCHwMFBzExOTQuMDBkZAIPDw8WAh8DBQUyOS4wMGRkAhAPDxYCHwMFCTIwMTUtNC0zMGRkAgQPZBYSZg8PFgIfAwUJ5oC756Wo5pWwZGQCAQ8PFgIfAwUBM2RkAgkPDxYCHwMFBDM4MTBkZAIKDw8WAh8DBQM3NTlkZAILDw8WAh8DBQQyOTEwZGQCDA8PFgIfAwUDNzU5ZGQCDQ8PFgIfAwUENDU2OWRkAg4PDxYCHwMFBDM1ODJkZAIPDw8WAh8DBQM5ODdkZBgBBQdhaXJfdGFiDzwrAAwBCAIBZIGlHEgaFqcYh9P1OYbqYAWEYNnbZ3zchyIf3%2BqmN7O%2B&__EVENTVALIDATION=%2FwEW0wECpLmNywUC%2BIS2qAQC54S2qAQC6OucxggCzdKOxAgCu82OxAgCxfXSwwcCxcPq7AMCxuSz9wgCqJCp0AkCl8XzpQMCpZqz7QoCpv6QsgECwODYmQECu%2F7osgEC8aT7WAKblpSuDQLxpK9YAvGk%2B1gCgqSXWALA4JSYAQK6%2FpiyAQLduvnOCQLkj7azCwKCpKdYAp3XqocPAszZtu0MApW6%2Fc4JAqez8fMKAv2dna0OApXXsocPAqC9%2FtkHArv%2B7LIBAuWdva0OAuWdva0OAv2dna0OAuWdva0OApCz1fMKAqq99tkHAuCPurMLApGz8fMKAuWdva0OAuWdva0OAqizjfMKApbXjocPAqG9ytkHAoyk%2B1gChNeihw8CiZacrg0ClbOd8woCg9eOhw8C5I%2BOswsCiZbsrg0Cipbwrg0CsY%2BSswsC5Z3Jrg4C%2Fo%2B2swsCnteuhw8Co%2F6AsgEChJbwrg0Cntemhw8CkLON8woCtdrq7gwCtdrm7gwCqb3%2B2QcC%2F4%2B6swsC5p3Brg4CkLPV8woCtdr67gwCi6T3WAKEltCuDQKFlvCuDQLnnbmtDgLnnbGtDgKFloSuDQKqveLZBwLnncmuDgKFltCuDQLjj6qzCwKD16aHDwK62ubuDALxpJNYAsDgyJkBApuWgK4NAoKk91gC%2Fp25rQ4Cg6SrWAKLpKtYAqm9ytkHAuedza4OAoWWmK4NAuCPtrMLAtzglJgBArna6u4MArra4u4MAoTXqocPApbXpocPAoiWiK4NApWz1fMKAveP8rMLAuedva0OAoaW8K4NApGz%2BfMKAqm99tkHAuadsa0OApyWjK4NArja4u4MArra%2Bu4MAqu95tkHAvu86tkHApbXuocPAuudna0OAszZ1u4MAqizifMKAsDgzJkBAv%2BPkrMLAtrgsJgBAqm96tkHAv%2BPqrMLAoSWhK4NAqP%2BnLIBAtrgwJkBAuadxa4OAoSWlK4NApCz2fMKAoSW7K4NAuCPkrMLAtvgsJgBAqq96tkHAqT%2BhLIBAoykr1gCkbON8woC4I%2BmswsCpP6AsgECqr362QcC553Frg4C4I%2FyswsCqr3K2QcCpf6csgECjqSbWAKUs%2FXzCgK62tbuDAKD16qHDwKo%2FoSyAQLkj6azCwKJloSuDQL%2Fj6azCwL%2Fj6KzCwKUs43zCgLkj%2FKzCwKn%2FuyyAQK7%2FpCyAQL%2Bj66zCwLmnZ2tDgKd17aHDwKi%2FpSyAQLlncGuDgKKpL9YAq%2BznfMKAtng2JkBAoOWlK4NAqi98tkHAp3XsocPAuWdna0OAq%2Bz2fMKArTatu0MAv6P8rMLAoOW0K4NAuWdma0OAq%2Bz1fMKAp3XiocPAoqkm1gC%2Fo%2BSswsCg5bwrg0Cr7P18woC2eCwmAEC7J3Nrg4Ci6SvWALjj76zCwKDloyuDQLlnb2tDgLnnbWtDgKovf7ZBwKd176HDwKovebZBwKoveLZBwKvs4nzCgK02ubuDALZ4MSZAQL%2Bj6KzCwKKpKdYArTa4u4MAv6PvrMLAqi9%2BtkHAp3XuocPAv6PurMLAoznisYGArursYYIAs%2Bpsq8NAoTd4uwCAoTd4u4OAt720sMHAsGky4cLAvmky8EHAuDWvYIFAq7d9ukPApS7zfEHAsfF3NICAr3vzu8MAsjvou8MApKl%2FqcBepQAFdhuiTGrW3mn4%2FEVaMaq5uR6uRrzPIMJ3Lbzjsw%3D&dtfs=1&sdate=2015-05-04&edate=2015-05-04&stype=%E5%B7%B2%E5%87%BA%E7%A5%A8&air=774&Button1=%E7%94%9F%E6%88%90%E6%8A%A5%E8%A1%A8&jpclass=&ptype=&cw=&hb=&secity=


可以看出是对参数cw,hb,secity过滤不严,导致注入

1.jpg


3.jpg


4.jpg


secity参数就不跑了
数据库

2.jpg


其他案例
上海航月航空票务中心
http://hy.4000211929.com/
上海东鑫航空票务
http://oa.dxtravel.cn/
吉日通旅行网
http://zw.jiritong.com/
北京保盛航空服务有限公司
http://sdn.4000211929.com/
上海迦南商务航空
http://jy.4000211929.com/
深圳崇正航空票务代理有限公司
http://cz.4000211929.com/
昕辰航空票务
http://oa.starstrip.net/
盐城民航售票处
http://oa.yccas.com/
上海程腾商务咨询有限公司
http://oa.cht-travel.com/
更多案例参考
http://piaoyou.org/case_web.htm

6.jpg

漏洞证明:

如上

修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2015-06-03 12:29

厂商回复:

CNVD确认所述情况,已经由CNVD通过网站公开联系方式向软件生产厂商通报。

最新状态:

暂无