当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-088860

漏洞标题:大汉jcms某处SQL注入漏洞一枚

相关厂商:南京大汉网络有限公司

漏洞作者: sex is not show

提交时间:2014-12-29 17:41

修复时间:2015-04-02 10:23

公开时间:2015-04-02 10:23

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-12-29: 细节已通知厂商并且等待厂商处理中
2015-01-03: 厂商主动忽略漏洞,细节向第三方安全合作伙伴开放
2015-02-27: 细节向核心白帽子及相关领域专家公开
2015-03-09: 细节向普通白帽子公开
2015-03-19: 细节向实习白帽子公开
2015-04-02: 细节向公众公开

简要描述:

RT

详细说明:

貌似通杀不少版本的~~ 直接分析了
漏洞文件:/jcms/jcms_files/jcms1/web2/site/module/comment/opr_getcount.jsp
漏洞参数:fn_Keywords
漏洞类型:SQL注入(GET型)
漏洞分析:
先看opr_getcount.jsp文件:

......//省掉前面无关代码
<%
response.setHeader("Pragma","No-cache");
response.setHeader("Cache-Control","no-cache");
response.setDateHeader("Expires", 0);
int colId = Convert.getParameterInt(request, "i_colid", 0);
int infoId = Convert.getParameterInt(request, "i_infoid", 0);
String pltype = Convert.getParameter(request, "pltype", "",true,true);//这个类型很重要,决定带入那个方法体

String strToPath = application.getRealPath("") + "/jcms_files/jcms" + strAppID+"/web"+strWebID+"/site/module/comment/";
String strIniPath = strToPath +"config/init.xml";
String strIpStyle = xmlFile.getContent("ipstyle", strIniPath);
int start = Convert.getParameterInt(request,"startrecord",1);
int iPerPage = Convert.getParameterInt(request,"perpage",10);
int groupsize = Convert.getParameterInt(request,"groupsize",8);
String c_uuid = Convert.getParameter(request,"c_uuid","",true,true);
int totalNum = 0;
String strCommentStyle = "";

String strKeywords = Convert.getParameter(request, "fn_Keywords", "");
String strScope = Convert.getParameter(request, "fn_Scope");
String strStartTime = Convert.getParameter(request, "starttime");
String strEndTime = Convert.getParameter(request, "endtime");
String strTpl_vc_Ip = Convert.getIp(request); //获取IPd地址
Jcms_Comment_InfoBLF commentBLF = new Jcms_Comment_InfoBLF(strAppID,strWebID);
Jcms_Comment_InfoBLF blf = new Jcms_Comment_InfoBLF(strAppID,strWebID);
ArrayList al = new ArrayList();
if("Y".equals(pltype)) {//当pltype为Y时,走这里
totalNum = blf.getTotalNum(strScope, strKeywords, colId, infoId, strStartTime, strEndTime);//这里进入getTotalNum(...)函数中
strCommentStyle = xmlFile.getContent("scriptcode", strIniPath);
// 原文
al = blf.getEnt(strScope, strKeywords, colId, infoId, strStartTime, strEndTime, start, iPerPage+1);
}
......


然后跟进getTotalNum(......)函数中:

public int getTotalNum(String strScope, String strKeywords, int colId, int infoId, String strStartTime, String strEndTime)
{
StringBuffer sbSql = new StringBuffer(128);
StringBuffer strConditionBuf = new StringBuffer(128);
try {
strScope = Convert.getValue(strScope);
strKeywords = Convert.getValue(strKeywords);
strStartTime = Convert.getValue(strStartTime);
strEndTime = Convert.getValue(strEndTime);
if (!strScope.equals("")) { ////strScope随意为下面中的一个,都能拼接进SQL语句,导致注入产生
if (strScope.equalsIgnoreCase("vc_infoTitle"))
{
strConditionBuf.append(" AND vc_infotitle LIKE '%" + strKeywords + "%'");
}
if (strScope.equalsIgnoreCase("vc_author"))
{
strConditionBuf.append(" AND vc_author LIKE '%" + strKeywords + "%'");
}
if (strScope.equalsIgnoreCase("t_content"))
{
strConditionBuf.append(" AND t_content LIKE '%" + strKeywords + "%'");
}
}
if ((strStartTime.length() > 0) && (strEndTime.length() > 0)) {
strConditionBuf.append(" AND c_createtime >= '" + strStartTime + "'")
.append(" AND c_createtime <= '" + strEndTime + "'");
}
else if ((strStartTime.length() > 0) && (strEndTime.length() == 0)) {
strConditionBuf.append(" AND c_createtime >= '" + strStartTime + "'");
}
else if ((strStartTime.length() == 0) && (strEndTime.length() > 0)) {
strConditionBuf.append(" AND c_createtime <= '" + strEndTime + "'");
}
sbSql.append("SELECT COUNT(i_id)")
.append(" FROM jcms_comment_info")
.append(" WHERE i_sid=0 AND b_ischeck=1")
.append(" AND b_iscallback=0")
.append(" AND i_columnid=").append(colId)
.append(" AND i_infoid=").append(infoId)
.append(strConditionBuf.toString());
String[][] strData = Manager.doQuery(this.strAppID, sbSql.toString());
if ((strData == null) || (strData.length == 0))
return 0;
return Convert.getStringValueInt(strData[0][0]);
} catch (Exception e) {
LogWriter.error("getEnt Error:" + e, Jcms_Comment_InfoBLF.class);
return 0;
} finally {
if ((sbSql != null) && (sbSql.length() > 0)) {
sbSql.delete(0, sbSql.length());
}
if ((strConditionBuf != null) && (strConditionBuf.length() > 0))
strConditionBuf.delete(0, strConditionBuf.length());
}
}


实例演示:
1.版本:VJCMS2.6.7[U9]
http://www.sqsc.gov.cn/jcms/jcms_files/jcms1/web2/site/module/comment/opr_getcount.jsp?fn_Keywords=q&starttime=&endtime=&pltype=Y&fn_Scope=vc_infoTitle

1.jpg


2.版本:VJCMS2.6.7[U9]-BJDEWGYXY[U3]
http://www.bisu.edu.cn/jcms/jcms_files/jcms1/web2/site/module/comment/opr_getcount.jsp?fn_Keywords=q&starttime=&endtime=&pltype=Y&fn_Scope=vc_infoTitle

1.jpg


3.版本:VJCMS2.6.3-ZZSZF[U11]
http://xfxzz.zaozhuang.gov.cn/jcms/jcms_files/jcms1/web2/site/module/comment/opr_getcount.jsp?fn_Keywords=q&starttime=&endtime=&pltype=Y&fn_Scope=vc_infoTitle

1.jpg


4.版本:VJCMS2.6.7[U6]
http://sha.sinotrans.com/jcms/jcms_files/jcms1/web2/site/module/comment/opr_getcount.jsp?fn_Keywords=q&starttime=&endtime=&pltype=Y&fn_Scope=vc_infoTitle

1.jpg


5.版本:VJCMS2.6.3-ZZSZF[U11]
http://ipad.zaozhuang.gov.cn/jcms/jcms_files/jcms1/web2/site/module/comment/opr_getcount.jsp?fn_Keywords=q&starttime=&endtime=&pltype=Y&fn_Scope=vc_infoTitle

1.jpg


漏洞证明:

见详细把

修复方案:

参数过滤,参数化查询

版权声明:转载请注明来源 sex is not show@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-04-02 10:23

厂商回复:

最新状态:

暂无


漏洞评价:

评论

  1. 2015-05-05 09:58 | 影刺 ( 实习白帽子 | Rank:67 漏洞数:25 | 关注web安全)

    好隐蔽的地方