当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0142554

漏洞标题:运营商安全之中国电信某站SQL注入(涉及9个库,43万用户数据泄露)

相关厂商:中国电信

漏洞作者: Xmyth_夏洛克

提交时间:2015-09-23 14:02

修复时间:2015-11-09 16:20

公开时间:2015-11-09 16:20

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-23: 细节已通知厂商并且等待厂商处理中
2015-09-25: 厂商已经确认,细节仅向厂商公开
2015-10-05: 细节向核心白帽子及相关领域专家公开
2015-10-15: 细节向普通白帽子公开
2015-10-25: 细节向实习白帽子公开
2015-11-09: 细节向公众公开

简要描述:

2333333

详细说明:

存在注入URL
http://**.**.**.**:9080/home/index.action?recStaff=dldxzqkhb&storeId=13464&systemId=1
参数systemId为注入点
涉及9个库

dbs.png


漏洞证明:

400多个表,43万用户数据

Database: OTO_JT
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| ATTRINST | 1491899 |
| SCHEDULE_JOB_LOG | 1324602 |
| USERS | 430913 |
| STORECENT_0512 | 286340 |
| TB_MINI_PAGE_PICTURE_0512 | 159625 |
| STORECENT | 151211 |
| TB_MINI_REQUEST_LOG | 129173 |
| TB_MINI_WEBSITE_LOG | 98924 |
| CATGPENREL | 90268 |
| LISTPRICE_0512 | 88093 |
| OFFER_0512 | 88076 |
| CATENTRY_0512 | 86675 |
| TB_FR_SERV_CALL_LOG | 73342 |
| CATENTREL_0512 | 71678 |
| TB_SM_PRIVGRANTS | 57851 |
| BP_STEPTASK | 49539 |
| TB_MINI_TRAN_CONFIG_0512 | 35697 |
| TB_MINI_WEBSITE_PAGE_0512 | 34729 |
| CPORD_ITEMS | 34380 |
| BP_TASK | 28874 |
| ADDRBOOK | 27375 |
| ORDER_COMMENT | 26679 |
| PPC_PAYMENT | 26236 |
| PACK_STATLOG | 25299 |
| CATENTRY_0918 | 24768 |
| CATENTREL | 22484 |
| CATENTREL_0922 | 22417 |
| CATENTREL_0918 | 19134 |
| PACKITEMS | 18236 |
| TB_CMS_RESOURCE | 17801 |
| PROMO_CDPOOL | 17366 |
| ORDER_APPLYINFO | 16636 |
| SCHEDULE_BUSIPROC_LOG | 15907 |
| ORDER_INVOICE | 15655 |
| TB_CMS_CHANNEL | 14774 |
| SALEINFO_ITEM | 13682 |
| ORDERITEMS_0512 | 11304 |
| CPORD_CRM_SUB | 11024 |
| LISTPRICE | 11018 |
| OFFER | 11002 |
| CATENTRY | 9488 |
| PROMO_USAGE | 9418 |
| CRM_PROCESS_ORDERS | 9412 |
| TB_PM_OPER_LOG | 9194 |
| CPORD_WAIT_SENDBACK_HIST | 8936 |
| TB_MINI_WEBSITE_STYLE_0512 | 8268 |
| TB_MINI_WEBSITE_STYLE_20150428 | 8226 |
| TB_MINI_PAGE_PICTURE | 8096 |
| TB_MINI_PAGE_ATTR_0512 | 6696 |
| PHONENUMBER | 6564 |
| TB_SM_STAFFPOST_0512 | 6491 |
| STAT_ORDERITEMS_SETTLEMENT | 6226 |
| TB_SM_STAFFPOST_20150428 | 6117 |
| USER_LOGIN_LOG | 5980 |
| PACKINFO | 5790 |
| TB_SM_MINI_PRIVGRANTS | 5658 |
| TB_SM_MINI_PRIVGRANTS_0512 | 5570 |
| TB_SM_MINI_PRIVGRANTS_20150506 | 5568 |
| TB_MINI_PUBLISH_TASK_HIST | 5314 |
| USERREG | 5183 |
| USERPROF | 5182 |
| SHIPINFO | 5164 |
| ADDRESS | 5163 |
| INVENTORY | 5102 |
| TB_SM_MINI_PRIVGRANTS_20150428 | 5050 |
| TB_SM_SYSSTAFF_0512 | 4845 |
| ORDER_CATENTRY_REL_0512 | 4843 |
| ORDERS_0512 | 4632 |
| TB_SM_LOGINSESS | 4560 |
| TB_SM_SYSSTAFF_20150428 | 4506 |
| TB_MINI_CAT_TYPE | 4480 |
| PROMO_ELEATTR_INST | 4116 |
| STOREPMD | 3946 |
| CPORD_CRM_APPLY | 3882 |
| TB_MINI_STAFF_REC_0512 | 3874 |
| STOREPMD_0512 | 3824 |
| ORDERITEM_ADJUST | 3736 |
| ORDER_ADJUST | 3729 |
| ORDERITEMS_0918 | 3397 |
| CPORD_CALL_LOG | 3379 |
| TB_MINI_WEBSITE_STYLE_0918 | 3223 |
| TB_SM_LOGINSESS_HIST | 3163 |
| STOREPMD_20150428 | 3148 |
| TB_MINI_REGION | 3147 |
| TB_MINI_REGION_20150428 | 3147 |
| STORERELA_0512 | 3107 |
| STORE_0512 | 3063 |
| TB_MINI_PAGE_TEXT_0512 | 2813 |
| SALEINFO_REG | 2800 |
| STORERELA_20150428 | 2742 |
| STORE_20150428 | 2695 |
| TB_MINI_WEBSITE_0512 | 2629 |
| TB_MINI_WEBSITE_20150428 | 2592 |
| PROMO_ELERELA | 2549 |
| TB_MINI_WEBSITE_PAGE | 2373 |
| STORERELA_0918 | 2262 |
| STORE_0918 | 2220 |
| TB_SM_WORKPOST | 2125 |
| TB_MINI_PAGE_ATTR_0918 | 2104 |
| STOREPMD_0918 | 2068 |
| CATGROUP | 2018 |
| TB_SM_SYSSTAFF_0918 | 1968 |
| TB_MINI_REPORT | 1877 |
| TB_SM_MINI_PRIVGRANTS_0918 | 1771 |
| PPC_PAYINST | 1707 |
| TB_MINI_WEBSITE_LOG_0512 | 1619 |
| CATGRPREL | 1504 |
| STORECGRP | 1459 |
| CATENTRY_RELA | 1453 |
| TB_MINI_STAFF_REC_0918 | 1433 |
| ORDER_CATENTRY_REL_0918 | 1423 |
| STAT_ORDERS_SETTLEMENT | 1421 |
| TB_MINI_TRAN_CONFIG | 1407 |
| UPLOADFILE | 1383 |
| ORDERS_0918 | 1226 |
| TB_FR_ANALY_CUST_LOGIN | 1145 |
| ORDERITEMS | 1099 |
| IP_LATN_RELA | 1018 |
| TB_MINI_WEBSITE_0918 | 1016 |
| TB_MINI_QUESTION_DETAIL | 933 |
| TB_SM_SYSSTAFF | 905 |
| TB_SM_STAFFPOST | 887 |
| TB_MINI_ANALYSE | 800 |
| TB_MINI_PAGE_TEXT_0918 | 771 |
| PRIZE | 700 |
| INV_ADJUST | 685 |
| ORDER_CATENTRY_REL | 631 |
| CPORD_ASSIGNMENT | 604 |
| STORERELA | 599 |
| STORE | 554 |
| PNB_CHECK_INFO | 487 |
| TB_MINI_WEBSITE_STYLE | 486 |
| MODCOMPS_ACTION | 476 |
| CPORD_COMMENT | 471 |
| TB_PC_DICT | 466 |
| TB_MINI_PAGE_ATTR | 449 |
| SHPARRANGE | 442 |
| TMP_ACTION_LINK | 423 |
| TB_MINI_STAFF_WEBSITESTYLE | 408 |
| ACTION_LINK | 393 |
| CATEN_CRM_RELA | 382 |
| STAT_PPC_PAYINST | 381 |
| TB_SM_ORGAN | 358 |
| TB_PC_CITY | 326 |
| TB_PC_CITY_20150428 | 325 |
| CITY | 323 |
| CITY_20150428 | 323 |
| PROMO_TRIGGER | 319 |
| PRIZE_CODE_SEQ | 318 |
| TB_MINI_ARTICLE | 313 |
| FRAME_TB_CONFIG_CONTENT | 305 |
| PNB_STATLOG | 274 |
| CALLBACK_ORDER_RELA | 273 |
| TB_SM_MODCOMPS | 260 |
| ORDERS | 255 |
| PLAN_INFO_SETTING | 247 |
| ATTRIBUTE | 230 |
| FRAME_TB_INTERFACE_INIT_PARA | 229 |
| TB_FR_SERV_USER_AUTH | 226 |
| TB_FR_SERV_METHOD | 215 |
| TB_MINI_STAFF_REC | 211 |
| TB_SM_SYSMENU | 191 |
| TB_MINI_QUESTION_CUST | 187 |
| CALCODE | 174 |
| TB_SM_ERRLOGIN | 167 |
| TB_MINI_EXCEL_LOG | 154 |
| PROMO_ADDINFO | 152 |
| PROMOTION | 152 |
| CATEN_CRM_EQPT | 148 |
| ORDER_STATLOG | 145 |
| TB_SM_WORKPOST_20150428 | 144 |
| ORDER_CATEN_SOLD | 140 |
| SMS_SEND_QUEUE_HIST | 139 |
| TB_SM_MODULE | 135 |
| CALLBACKS | 134 |
| TB_MINI_WEBSITE | 120 |
| TB_MINI_STANDARD | 119 |
| SANALY_CATENTRY | 109 |
| TB_MINI_STAFF_REL_0512 | 104 |
| EXPORTFILE | 103 |
| SHIP_STATLOG | 101 |
| TB_FR_ANALY_ORDER_INFO | 92 |
| TB_PC_DICTTYPE | 87 |
| TB_MINI_PAGE_TEXT | 84 |
| TB_MINI_STAFF_REL_0918 | 83 |
| BP_TRANS | 77 |
| TB_MINI_PUBLISH_OBJ_RELA | 74 |
| ORDER_INVOICE_BAK | 72 |
| TB_FR_SERVINFO | 69 |
| ATTRVALUE | 66 |
| PROMO_STATLOG | 66 |
| BRAND | 63 |
| CATCLASS_BRAND | 62 |
| STAT_DOWNLOAD_FILES | 62 |
| PROMO_CDUSAGE | 60 |
| FRAME_TB_CONFIG_TYPE | 56 |
| TB_MINI_STAFF_REL | 54 |
| BP_FLOWSTEP | 53 |
| TB_MINI_QUESTION_TITLE_ITEM | 48 |
| TEST1 | 48 |
| PNBINV_WARN | 45 |
| FRAME_TB_INTERFACE_CONFIG | 44 |
| TB_MINI_PAGE_TEXT_BAKPAJT | 43 |
| BP_ACTION | 42 |
| FFMCENTER | 42 |
| FRAME_TB_INTERFACE_EVENT | 42 |
| INV_WARN | 41 |
| IP_WHITE | 40 |
| TB_MINI_TALK_ABOUT | 40 |
| TB_MINI_NOTICE_ROLES | 38 |
| CATCOMMENT | 36 |
| CATCOMMT_SCORE | 36 |
| FFMCENTER_PMD | 35 |
| TEST2 | 34 |
| WS_STAFF_SETTING | 33 |
| PROVINCE | 31 |
| PROVINCE_20150428 | 31 |
| TB_MINI_APPROVE | 31 |
| TB_MINI_PAGE_CAT | 28 |
| PROMO_ELEATTR | 26 |
| TB_SM_ORGAN_20150428 | 26 |
| SHIPMODE | 25 |
| SCHEDULE_JOB | 24 |
| TB_PC_LOG_CONFIG | 24 |
| PROMO_CDSPEC | 23 |
| STORECAT | 23 |
| TMP_CATGROUP | 23 |
| FRAME_TB_SM_ORGAN | 22 |
| SUPPLIER | 22 |
| QTYUNIT | 21 |
| TB_SM_ORGTYPE | 21 |
| ATTRVALUE_TYPE | 20 |
| BP_STEP | 20 |
| TB_MINI_QUESTION_TITLE | 19 |
| PROMO_ELEMENT | 18 |
| SANALY_TYPE | 18 |
| SHIPMENT_PAYMENT_LISTS | 18 |
| UPLOADFILE_SETTING | 18 |
| SEARCH_FILTER_ATTG_CHANNELREL | 17 |
| CATCLASS | 15 |
| TB_CMS_ARTICLE | 15 |
| ATTRGRP | 14 |
| TB_CMS_PUBLISH_TASK_HIST | 14 |
| ACTIVITY | 13 |
| TB_MINI_PAGE | 13 |
| PPC_PAYMETHOD | 12 |
| PRIZE_RESULT | 11 |
| SEARCH_FILTER_ATTRGROUPREL | 11 |
| SEARCH_FILTER_ATTRS | 11 |
| TB_CMS_PUBLISH_TASK | 11 |
| ORDER_BSNTYPE | 10 |
| ORDER_BSNTYPE_FLOW | 10 |
| PNB_CHECK_INFO_HIST | 10 |
| SHIPPER | 10 |
| TB_CMS_RESOURCE_LOG | 10 |
| TB_MINI_NOTICE | 10 |
| "CATALOG" | 9 |
| PROMO_PUBCD | 9 |
| SEARCH_FILTER_GROUP | 9 |
| TB_CMS_APPROVE | 9 |
| TB_CMS_APPROVE_ACT | 9 |
| PROMO_PROMOTYPE | 8 |
| TB_CMS_ARTICLE_EXTATTR | 8 |
| TB_MINI_QUESTION_CONF | 8 |
| BP_FLOW | 7 |
| LISTS_RECORDS | 7 |
| TMP_ROLE_POST | 7 |
| CATACT_RELA | 6 |
| SEARCH_FILTER_GROUPS | 6 |
| SEARCH_FILTER_GROUPSREL | 6 |
| SYS_ID_SERIAL | 6 |
| TB_CMS_APPREVENT_PRIVI | 6 |
| TB_MINI_QUESTION | 6 |
| TB_MINI_WEBSITE_SYN_HIST | 6 |
| TB_CMS_TEMPLATE_ATTR | 5 |
| TB_MINI_STYLE_SYSTEM | 5 |
| TB_MINI_WX_TOKEN | 5 |
| REFUNDMENT_LISTS | 4 |
| SEARCH_FILTER_USAGE | 4 |
| TB_MINI_PUBLISH_TASK | 4 |
| BP_BUSITYPE | 3 |
| CPORD_WAIT_ACCNBR | 3 |
| FRAME_TBSYSTEMSTATICVALUE | 3 |
| PNB_LOCKED | 3 |
| PNB_RESERVE | 3 |
| PROMO_GROUP | 3 |
| SEARCH_FILTER_MATCH_TYPE | 3 |
| SEND_TEMPLATE | 3 |
| TB_CMS_ARTICLE_ATTRVALUE | 3 |
| TB_CMS_RESOURCE_PAGE | 3 |
| TB_CMS_TEMPLATE | 3 |
| TB_MINI_STYLE | 3 |
| TB_SM_ORGAN_HIST | 3 |
| BP_FLOWRULE | 2 |
| EXPORTFILE_SETTING | 2 |
| OBJCACHE_SETTING | 2 |
| PAYMENT_LISTS | 2 |
| STAGEPAY_CHECK | 2 |
| TB_MINI_WEBSITE_TEMPLATE | 2 |
| CALRULE | 1 |
| CALVALUE | 1 |
| CPORD_WAIT_SENDBACK | 1 |
| FRAME_TB_FILTER_PARAM | 1 |
| FRAME_TB_FILTER_URL | 1 |
| PRIZE_RATE | 1 |
| SHPAREA | 1 |
| TB_CMS_TAG | 1 |
| TB_CMS_TAG_RELA | 1 |
| TB_FR_SERV_USER | 1 |
| TB_MINI_PICTUREMANAGER | 1 |
+--------------------------------+---------+


43万.png


修复方案:

过滤

版权声明:转载请注明来源 Xmyth_夏洛克@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-09-25 16:18

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT向中国电信集团公司通报,由其后续协调网站管理部门处置。

最新状态:

暂无