当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0188876

漏洞标题：百姓大药房漏洞#危及2000W个人详细信息(姓名/身份证/手机号/住址/会员卡余额)

相关厂商：老百姓大药房

漏洞作者： 路人甲

提交时间：2016-03-25 10:26

修复时间：2016-05-09 10:26

公开时间：2016-05-09 10:26

漏洞类型：系统/服务补丁不及时

危害等级：高

自评Rank：12

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-03-25： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-05-09： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

rtrtrt

详细说明：



mask 区域


1.http://**.**.**/>


老百姓大药房7001反序列getshell



mask 区域


1.http://**.**.**/bea_wls_internal/a.jspx


MIMA:

mask 区域 
*****zz*****


jdbc:oracle:thin:@10.254.0.146:1521:lbxolap
user:lbxhis
pass:{AES}ziIISr2E1vCdE2SA+48aNIyasIRD1RK8F9OORvxn4TBgmOkKi76pVJSYS9bCWfXx


MIMA:

mask 区域 
*****read*****


部分表数据量统计

HISDATA	A_STOCK_DETAIL	3570128461
HISDATA	T_POS_BILL_DETAIL	1155551516
HISDATA	T_STOCK_201601	890063764
HISDATA	T_STOCK_201602	826416956
HISDATA	T_STOCK_201512	790399099
HISDATA	T_STOCK_201603	775068805
HISDATA	T_STOCK_201511	724544542
HISDATA	T_STOCK_201510	659636373
HISDATA	T_POS_GOODSALL_SUM	655613225
HISDATA	T_POS_GOODS_SUM	655221592
HISDATA	T_POS_GOODSALL_SUM_T	654967156
HISDATA	T_POS_GOODSSUM_D	648417790
HISDATA	T_STOCK_AMOUNT_201601	648087113
HISDATA	T_STOCK_AMOUNT_201512	636144320
HISDATA	T_STOCK_201509	600728809
HISDATA	T_STOCK_AMOUNT_201602	590456738
HISDATA	T_STOCK_AMOUNT_201510	589867404
HISDATA	T_STOCK_AMOUNT_201511	587396940
HISDATA	T_STOCK_AMOUNT_201508	562387286
HISDATA	T_POS_BILL_PAYMENT	540166452
HISDATA	T_STOCK_AMOUNT_201507	538663138
HISDATA	T_STOCK_201508	538050648
HISDATA	T_POS_BILL_HEADER	530081576
HISDATA	T_STOCK_AMOUNT_201509	520222497
HISDATA	T_STOCK_AMOUNT_201503	478476333
HISDATA	T_STOCK_AMOUNT_201603	473918083
HISDATA	T_STOCK_AMOUNT_201501	469689254
HISDATA	T_MEMBER_POS_DETAIL	469217972
HISDATA	T_STOCK_AMOUNT_201506	469043653
HISDATA	T_STOCK_AMOUNT_201412	460221867
HISDATA	T_STOCK_201507	458597587
HISDATA	T_STOCK_AMOUNT_201505	457048794
HISDATA	T_STOCK_AMOUNT_201504	444774748
HISDATA	T_STOCK_AMOUNT_201410	438986793
HISDATA	T_STOCK_AMOUNT_201502	432937570
HISDATA	T_SAP_STOCK_201601	429395501
HISDATA	T_STOCK_AMOUNT_201411	426812070
HISDATA	T_SAP_STOCK_201511	425766859
HISDATA	T_SAP_STOCK_201602	423721560
HISDATA	T_SAP_STOCK_201512	418815342
HISDATA	T_STOCK_201506	418431632
HISDATA	T_STOCK_AMOUNT_201409	414384264
HISDATA	T_STOCK_AMOUNT_201408	405839049
HISDATA	T_STOCK_AMOUNT_201407	396889295
HISDATA	T_STOCK_AMOUNT_201406	376297965
HISDATA	T_SAP_STOCK_201510	374631044
HISDATA	T_STOCK_AMOUNT_201405	373592301
HISDATA	T_STOCK_AMOUNT_201403	368641090
HISDATA	T_BILL_DETAIL	365996320
HISDATA	T_STOCK_AMOUNT_201404	363036127
HISDATA	T_SAP_STOCK_201509	361598796
HISDATA	T_BILL_HEADER_DETAIL	360998486
HISDATA	T_SAP_STOCK_201603	357223097
HISDATA	T_STOCK_AMOUNT_201401	352235245
HISDATA	T_SAP_STOCK_201508	349996558
HISDATA	T_STOCK_201505	349390501
HISDATA	T_STOCK_AMOUNT_201312	335524605
HISDATA	T_BILL_HEADER_DETAIL_T	328323292
HISDATA	T_STOCK_AMOUNT_201310	324673755
HISDATA	T_STOCK_AMOUNT_201308	324517666
HISDATA	T_STOCK_AMOUNT_201311	318228079
HISDATA	T_SAP_STOCK_201507	315988960
HISDATA	T_STOCK_AMOUNT_201307	314177740
HISDATA	T_SAP_STOCK_201506	310389836
HISDATA	T_STOCK_AMOUNT_201309	309906787
HISDATA	T_STOCK_AMOUNT_201305	302661933
HISDATA	T_STOCK_AMOUNT_201306	298106844
HISDATA	T_SAP_STOCK_201505	296883509
HISDATA	T_STOCK_201504	296690395
HISDATA	T_STOCK_AMOUNT_201303	293712310
HISDATA	T_STOCK_AMOUNT_201304	288957146
HISDATA	T_STOCK_AMOUNT_201301	287627978
HISDATA	T_STOCK_AMOUNT_201402	287371748
HISDATA	T_SAP_STOCK_201504	285336045
HISDATA	T_SAP_STOCK_201503	273378091
HISDATA	T_POS_CLASS_SUM	265963498
HISDATA	T_SAP_STOCK_201501	262178889
HISDATA	T_STOCK_AMOUNT_201302	261884222
HISDATA	T_STOCK_201503	245316717
HISDATA	T_SAP_STOCK_201411	242621596
HISDATA	T_SAP_STOCK_201502	242277731
HISDATA	T_STOCK_201405	228912498
SAP	T_POS_GOODSSUM_D	224055819
HISDATA	T_SAP_STOCK_201409	223703491
HISDATA	T_STOCK_201406	222780162
HISDATA	T_STOCK_201403	219275462
HISDATA	T_STOCK_201404	216695264
HISDATA	T_MEMBER_POS_SUM_CLASS	216646339
HISDATA	T_STOCK_201401	212878042
HISDATA	T_SAP_STOCK_201410	212813655
HISDATA	T_SAP_STOCK_201408	208290804
HISDATA	T_MEMBER_BONUS_USED	200895896
HISDATA	T_SAP_STOCK_201407	200155203
HISDATA	T_SAP_STOCK_201406	181957128
HISDATA	T_POS_DEPTSUM_D	178040867
HISDATA	T_STOCK_201402	175843650
HISDATA	T_SAP_STOCK_201404	173673912
HISDATA	T_SAP_STOCK_201403	173326115
HISDATA	T_SAP_STOCK_201405	156999587
HISDATA	T_POS_GOODSALL_DEPTSUM	153452486
HISDATA	T_SAP_STOCK_201401	150686355
HISDATA	T_STORE_IN_RECV_DETAIL	140248116
HISDATA	T_SAP_STOCK_201312	138249938
HISDATA	T_POS_GOODSSUM_M	132779462
HISDATA	T_POS_GOODSALL_SUM_M	127290241
HISDATA	T_SAP_STOCK_201402	127045061
HISDATA	T_SAP_STOCK_201311	125590046
HISDATA	T_SAP_STOCK_201310	124399876
HISDATA	T_SAP_STOCK_201309	119030934
HISDATA	T_STOCK_201301	111665714
HISDATA	T_STOCK_201303	108580372
HISDATA	T_MEMBER_POS_DETAIL_M	106644271
HISDATA	T_GOODS_BATCH	105361396
HISDATA	T_STOCK_201304	104998091
HISDATA	T_BILL_DETAIL_EXTRA	104062717
HISDATA	T_STOCK_201302	100723059
HISDATA	A_STOCK_SUM	95905964


W1.png


w2.png

漏洞证明：

部分表数据量统计

HISDATA	A_STOCK_DETAIL	3570128461
HISDATA	T_POS_BILL_DETAIL	1155551516
HISDATA	T_STOCK_201601	890063764
HISDATA	T_STOCK_201602	826416956
HISDATA	T_STOCK_201512	790399099
HISDATA	T_STOCK_201603	775068805
HISDATA	T_STOCK_201511	724544542
HISDATA	T_STOCK_201510	659636373
HISDATA	T_POS_GOODSALL_SUM	655613225
HISDATA	T_POS_GOODS_SUM	655221592
HISDATA	T_POS_GOODSALL_SUM_T	654967156
HISDATA	T_POS_GOODSSUM_D	648417790
HISDATA	T_STOCK_AMOUNT_201601	648087113
HISDATA	T_STOCK_AMOUNT_201512	636144320
HISDATA	T_STOCK_201509	600728809
HISDATA	T_STOCK_AMOUNT_201602	590456738
HISDATA	T_STOCK_AMOUNT_201510	589867404
HISDATA	T_STOCK_AMOUNT_201511	587396940
HISDATA	T_STOCK_AMOUNT_201508	562387286
HISDATA	T_POS_BILL_PAYMENT	540166452
HISDATA	T_STOCK_AMOUNT_201507	538663138
HISDATA	T_STOCK_201508	538050648
HISDATA	T_POS_BILL_HEADER	530081576
HISDATA	T_STOCK_AMOUNT_201509	520222497
HISDATA	T_STOCK_AMOUNT_201503	478476333
HISDATA	T_STOCK_AMOUNT_201603	473918083
HISDATA	T_STOCK_AMOUNT_201501	469689254
HISDATA	T_MEMBER_POS_DETAIL	469217972
HISDATA	T_STOCK_AMOUNT_201506	469043653
HISDATA	T_STOCK_AMOUNT_201412	460221867
HISDATA	T_STOCK_201507	458597587
HISDATA	T_STOCK_AMOUNT_201505	457048794
HISDATA	T_STOCK_AMOUNT_201504	444774748
HISDATA	T_STOCK_AMOUNT_201410	438986793
HISDATA	T_STOCK_AMOUNT_201502	432937570
HISDATA	T_SAP_STOCK_201601	429395501
HISDATA	T_STOCK_AMOUNT_201411	426812070
HISDATA	T_SAP_STOCK_201511	425766859
HISDATA	T_SAP_STOCK_201602	423721560
HISDATA	T_SAP_STOCK_201512	418815342
HISDATA	T_STOCK_201506	418431632
HISDATA	T_STOCK_AMOUNT_201409	414384264
HISDATA	T_STOCK_AMOUNT_201408	405839049
HISDATA	T_STOCK_AMOUNT_201407	396889295
HISDATA	T_STOCK_AMOUNT_201406	376297965
HISDATA	T_SAP_STOCK_201510	374631044
HISDATA	T_STOCK_AMOUNT_201405	373592301
HISDATA	T_STOCK_AMOUNT_201403	368641090
HISDATA	T_BILL_DETAIL	365996320
HISDATA	T_STOCK_AMOUNT_201404	363036127
HISDATA	T_SAP_STOCK_201509	361598796
HISDATA	T_BILL_HEADER_DETAIL	360998486
HISDATA	T_SAP_STOCK_201603	357223097
HISDATA	T_STOCK_AMOUNT_201401	352235245
HISDATA	T_SAP_STOCK_201508	349996558
HISDATA	T_STOCK_201505	349390501
HISDATA	T_STOCK_AMOUNT_201312	335524605
HISDATA	T_BILL_HEADER_DETAIL_T	328323292
HISDATA	T_STOCK_AMOUNT_201310	324673755
HISDATA	T_STOCK_AMOUNT_201308	324517666
HISDATA	T_STOCK_AMOUNT_201311	318228079
HISDATA	T_SAP_STOCK_201507	315988960
HISDATA	T_STOCK_AMOUNT_201307	314177740
HISDATA	T_SAP_STOCK_201506	310389836
HISDATA	T_STOCK_AMOUNT_201309	309906787
HISDATA	T_STOCK_AMOUNT_201305	302661933
HISDATA	T_STOCK_AMOUNT_201306	298106844
HISDATA	T_SAP_STOCK_201505	296883509
HISDATA	T_STOCK_201504	296690395
HISDATA	T_STOCK_AMOUNT_201303	293712310
HISDATA	T_STOCK_AMOUNT_201304	288957146
HISDATA	T_STOCK_AMOUNT_201301	287627978
HISDATA	T_STOCK_AMOUNT_201402	287371748
HISDATA	T_SAP_STOCK_201504	285336045
HISDATA	T_SAP_STOCK_201503	273378091
HISDATA	T_POS_CLASS_SUM	265963498
HISDATA	T_SAP_STOCK_201501	262178889
HISDATA	T_STOCK_AMOUNT_201302	261884222
HISDATA	T_STOCK_201503	245316717
HISDATA	T_SAP_STOCK_201411	242621596
HISDATA	T_SAP_STOCK_201502	242277731
HISDATA	T_STOCK_201405	228912498
SAP	T_POS_GOODSSUM_D	224055819
HISDATA	T_SAP_STOCK_201409	223703491
HISDATA	T_STOCK_201406	222780162
HISDATA	T_STOCK_201403	219275462
HISDATA	T_STOCK_201404	216695264
HISDATA	T_MEMBER_POS_SUM_CLASS	216646339
HISDATA	T_STOCK_201401	212878042
HISDATA	T_SAP_STOCK_201410	212813655
HISDATA	T_SAP_STOCK_201408	208290804
HISDATA	T_MEMBER_BONUS_USED	200895896
HISDATA	T_SAP_STOCK_201407	200155203
HISDATA	T_SAP_STOCK_201406	181957128
HISDATA	T_POS_DEPTSUM_D	178040867
HISDATA	T_STOCK_201402	175843650
HISDATA	T_SAP_STOCK_201404	173673912
HISDATA	T_SAP_STOCK_201403	173326115
HISDATA	T_SAP_STOCK_201405	156999587
HISDATA	T_POS_GOODSALL_DEPTSUM	153452486
HISDATA	T_SAP_STOCK_201401	150686355
HISDATA	T_STORE_IN_RECV_DETAIL	140248116
HISDATA	T_SAP_STOCK_201312	138249938
HISDATA	T_POS_GOODSSUM_M	132779462
HISDATA	T_POS_GOODSALL_SUM_M	127290241
HISDATA	T_SAP_STOCK_201402	127045061
HISDATA	T_SAP_STOCK_201311	125590046
HISDATA	T_SAP_STOCK_201310	124399876
HISDATA	T_SAP_STOCK_201309	119030934
HISDATA	T_STOCK_201301	111665714
HISDATA	T_STOCK_201303	108580372
HISDATA	T_MEMBER_POS_DETAIL_M	106644271
HISDATA	T_GOODS_BATCH	105361396
HISDATA	T_STOCK_201304	104998091
HISDATA	T_BILL_DETAIL_EXTRA	104062717
HISDATA	T_STOCK_201302	100723059
HISDATA	A_STOCK_SUM	95905964


W1.png


w2.png

修复方案：

更新补丁

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)