当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-093264

漏洞标题：中国工信电信网码号平台注入可能导致申请人信息泄露

相关厂商：电信网码号管理系统

漏洞作者： 黑暗游侠

提交时间：2015-01-22 10:08

修复时间：2015-03-08 10:10

公开时间：2015-03-08 10:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-22： 细节已通知厂商并且等待厂商处理中
2015-01-26： 厂商已经确认，细节仅向厂商公开
2015-02-05： 细节向核心白帽子及相关领域专家公开
2015-02-15： 细节向普通白帽子公开
2015-02-25： 细节向实习白帽子公开
2015-03-08： 细节向公众公开

简要描述：

中国工信电信网码号平台注入可导致全国申请人信息泄露

详细说明：

http://www.miinac.gov.cn/components/newhome/index.jsp
首页登陆处未过滤，存在注入，有验证码？

8.png


数据包告诉我们一开始并没有验证验证码
so，直接注入，sqlmap跑

available databases [20]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] EXT
[*] EXTEL
[*] MDSYS
[*] NTS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TELNUMBER
[*] TEST
[*] TSMSYS
[*] WMSYS
[*] XDB
Database: EXTEL
[93 tables]
+--------------------------+
| ADJUSTWFCHECKINFO        |
| ADJUSTWORKFLOWINFO       |
| BASE_BILL                |
| BASE_DO                  |
| BASE_FLOW                |
| BASE_FLOW1               |
| BASE_FLOW_ACT            |
| BASE_FLOW_ACT1           |
| BASE_QUERY               |
| BILL_1                   |
| BILL_LOG                 |
| C_AUTHORIZATION          |
| C_BAD_RECORD             |
| C_BILLAUTHORITY          |
| C_BILL_LOG               |
| C_CODE                   |
| C_CODEEXTEND             |
| C_DIC                    |
| C_FOLDERALL              |
| C_GROUP                  |
| C_IPINFO                 |
| C_IPINFO_TMP             |
| C_LINKNAME               |
| C_LOCATION               |
| C_MIIACCOUNT             |
| C_MIIBILLDATE            |
| C_MIIBILLING             |
| C_MIIBILLLACK            |
| C_MIIBILLPAY             |
| C_MIICODE                |
| C_MIICODEFEERATE         |
| C_MIICODELIFESTAGEALL    |
| C_MIICODE_CHANGE         |
| C_MIICUSTOMER            |
| C_MIICUSTOMERTMP         |
| C_MIICUSTPAYINFO         |
| C_MIIFEESTANDARD         |
| C_MIINOTICEALL           |
| C_MIIORDER               |
| C_MIIPLAN                |
| C_MIIPLANUSAGE           |
| C_MIIPROJECT             |
| C_MIIQUALIFICATION       |
| C_MIIRATESTANDARD        |
| C_MIITEMPLATEFILE        |
| C_NOTICETYPE             |
| C_OPENINF                |
| C_PROVINCEREPORTS        |
| C_RELATION               |
| C_USER                   |
| EXCHANGE_TRI             |
| EXCHANGE_TRI_BACK        |
| EXPCMORDERINFO           |
| EXPORDERCHECK            |
| EX_INS_TRI_IN            |
| EX_MIDDLE_INSERT_TRIGGER |
| EX_UP_TRI_IN             |
| EX_UP_TRI_OUT            |
| EX_Y_CODE_OLD            |
| LOGGING_EVENT            |
| LOGGING_EVENT_EXCEPTION  |
| LOGGING_EVENT_PROPERTY   |
| MME_DICTIONARY           |
| MONTHLY_FEE              |
| MONTHLY_FEE_LOG          |
| M_CLCOMPARE              |
| M_CUSTOMER_GROUP         |
| M_GROUP_CUSTOMER_LINK    |
| M_LOG                    |
| M_LOG_CUSTOMER           |
| M_LOG_HISTORY            |
| M_LOG_INTEGRATION        |
| M_RELATION               |
| M_SWITCH                 |
| M_SWITCH_SEND            |
| M_TBLCOMPARE             |
| M_TEMPLATE               |
| M_TYPE_NEW               |
| R_NOTICE_USER            |
| R_PLAN_LOCALAREA         |
| R_USER_GROUP             |
| TEMP_NUM                 |
| TMP_CU                   |
| TMP_YC                   |
| TMP_YL                   |
| T_DOMAIN_NAME            |
| YEARCHECKCONFIG          |
| Y_CODEADJUST             |
| Y_CODEEXTEND             |
| Y_CODELICENSENUMBER      |
| Y_CODEUSAGE              |
| Y_CODE_ALL               |
| Y_LICENSENUMBER          |
+--------------------------+


9.png


漏洞证明：

http://www.miinac.gov.cn/components/newhome/index.jsp
首页登陆处未过滤，存在注入，有验证码？

8.png


数据包告诉我们一开始并没有验证验证码
so，直接注入，sqlmap跑

available databases [20]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] EXT
[*] EXTEL
[*] MDSYS
[*] NTS
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TELNUMBER
[*] TEST
[*] TSMSYS
[*] WMSYS
[*] XDB
Database: EXTEL
[93 tables]
+--------------------------+
| ADJUSTWFCHECKINFO        |
| ADJUSTWORKFLOWINFO       |
| BASE_BILL                |
| BASE_DO                  |
| BASE_FLOW                |
| BASE_FLOW1               |
| BASE_FLOW_ACT            |
| BASE_FLOW_ACT1           |
| BASE_QUERY               |
| BILL_1                   |
| BILL_LOG                 |
| C_AUTHORIZATION          |
| C_BAD_RECORD             |
| C_BILLAUTHORITY          |
| C_BILL_LOG               |
| C_CODE                   |
| C_CODEEXTEND             |
| C_DIC                    |
| C_FOLDERALL              |
| C_GROUP                  |
| C_IPINFO                 |
| C_IPINFO_TMP             |
| C_LINKNAME               |
| C_LOCATION               |
| C_MIIACCOUNT             |
| C_MIIBILLDATE            |
| C_MIIBILLING             |
| C_MIIBILLLACK            |
| C_MIIBILLPAY             |
| C_MIICODE                |
| C_MIICODEFEERATE         |
| C_MIICODELIFESTAGEALL    |
| C_MIICODE_CHANGE         |
| C_MIICUSTOMER            |
| C_MIICUSTOMERTMP         |
| C_MIICUSTPAYINFO         |
| C_MIIFEESTANDARD         |
| C_MIINOTICEALL           |
| C_MIIORDER               |
| C_MIIPLAN                |
| C_MIIPLANUSAGE           |
| C_MIIPROJECT             |
| C_MIIQUALIFICATION       |
| C_MIIRATESTANDARD        |
| C_MIITEMPLATEFILE        |
| C_NOTICETYPE             |
| C_OPENINF                |
| C_PROVINCEREPORTS        |
| C_RELATION               |
| C_USER                   |
| EXCHANGE_TRI             |
| EXCHANGE_TRI_BACK        |
| EXPCMORDERINFO           |
| EXPORDERCHECK            |
| EX_INS_TRI_IN            |
| EX_MIDDLE_INSERT_TRIGGER |
| EX_UP_TRI_IN             |
| EX_UP_TRI_OUT            |
| EX_Y_CODE_OLD            |
| LOGGING_EVENT            |
| LOGGING_EVENT_EXCEPTION  |
| LOGGING_EVENT_PROPERTY   |
| MME_DICTIONARY           |
| MONTHLY_FEE              |
| MONTHLY_FEE_LOG          |
| M_CLCOMPARE              |
| M_CUSTOMER_GROUP         |
| M_GROUP_CUSTOMER_LINK    |
| M_LOG                    |
| M_LOG_CUSTOMER           |
| M_LOG_HISTORY            |
| M_LOG_INTEGRATION        |
| M_RELATION               |
| M_SWITCH                 |
| M_SWITCH_SEND            |
| M_TBLCOMPARE             |
| M_TEMPLATE               |
| M_TYPE_NEW               |
| R_NOTICE_USER            |
| R_PLAN_LOCALAREA         |
| R_USER_GROUP             |
| TEMP_NUM                 |
| TMP_CU                   |
| TMP_YC                   |
| TMP_YL                   |
| T_DOMAIN_NAME            |
| YEARCHECKCONFIG          |
| Y_CODEADJUST             |
| Y_CODEEXTEND             |
| Y_CODELICENSENUMBER      |
| Y_CODEUSAGE              |
| Y_CODE_ALL               |
| Y_LICENSENUMBER          |
+--------------------------+


9.png


修复方案：

版权声明：转载请注明来源 黑暗游侠@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-01-26 15:02

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT向工信部通报。

最新状态：

暂无