漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0108440
漏洞标题：山东EMS源产递高危SQL注入漏洞
相关厂商：中国邮政集团公司信息技术局
漏洞作者： 黑暗游侠
提交时间：2015-04-21 18:03
修复时间：2015-06-06 08:16
公开时间：2015-06-06 08:16
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-04-21： 细节已通知厂商并且等待厂商处理中
2015-04-22： 厂商已经确认，细节仅向厂商公开
2015-05-02： 细节向核心白帽子及相关领域专家公开
2015-05-12： 细节向普通白帽子公开
2015-05-22： 细节向实习白帽子公开
2015-06-06： 细节向公众公开
简要描述：
山东EMS源产递高危SQL注入漏洞，包括邮件、护照、高考、社保、录取通知等等数据库
详细说明：
POC：
用户、商家只是庞大数据库中的一部分而已。
漏洞证明：
<code>Database: WJM_EN
[97 tables]
+------------------------------------------------------------------------------------------+
| KS_ADPlace |
| KS_Adiplist |
| KS_Admin |
| KS_Advertise |
| KS_Announce |
| KS_Article |
| KS_Blog |
| KS_BlogClass |
| KS_BlogComment |
| KS_BlogInfo |
| KS_BlogMessage |
| KS_BlogMusic |
| KS_BlogTemplate |
| KS_BlogType |
| KS_Channel |
| KS_Class |
| KS_Comment |
| KS_Config |
| KS_Delivery |
| KS_Digg |
| KS_DiggList |
| KS_DownLoad |
| KS_DownParam |
| KS_DownSer |
| KS_EnterPrise |
| KS_EnterPrisePro |
| KS_EnterpriseNews |
| KS_ExtChannel |
| KS_Favorite |
| KS_Field |
| KS_Flash |
| KS_Form |
| KS_FormField |
| KS_Form_EMS_OL |
| KS_Friend |
| KS_GQ |
| KS_GQType |
| KS_GQ_Class |
| KS_GuestBoard |
| KS_GuestBook |
| KS_GuestReply |
| KS_InnerLink |
| KS_JSFile |
| KS_KeyWords |
| KS_Label |
| KS_LabelFolder |
| KS_Link |
| KS_LinkFolder |
| KS_Log |
| KS_LogDeliver |
| KS_LogEdays |
| KS_LogInvoice |
| KS_LogMoney |
| KS_LogPoint |
| KS_MSClass |
| KS_MSSClass |
| KS_MSSinger |
| KS_MSSongList |
| KS_MSSongWord |
| KS_MSSpecial |
| KS_MSSpecialComment |
| KS_MSUserAddWord |
| KS_MediaServer |
| KS_Message |
| KS_Movie |
| KS_MovieOnline |
| KS_MovieParam |
| KS_Online |
| KS_Order |
| KS_OrderItem |
| KS_Origin |
| KS_PaymentPlat |
| KS_PaymentType |
| KS_Photo |
| KS_PhotoClass |
| KS_PhotoVote |
| KS_Photoxc |
| KS_Photozp |
| KS_ProPrice |
| KS_Product |
| KS_RssUrl |
| KS_SiteCount |
| KS_Special |
| KS_Team |
| KS_TeamClass |
| KS_TeamTopic |
| KS_TeamUsers |
| KS_Template |
| KS_U_gongqiupingtai |
| KS_U_jinanshipin |
| KS_User |
| KS_UserCard |
| KS_UserClass |
| KS_UserForm |
| KS_UserGroup |
| KS_Vote |
| dtproperties |
+------------------------------------------------------------------------------------------+
Database: EMSERPNEAR
[334 tables]
+------------------------------------------------------------------------------------------+
| CW_View_Order_product |
| Card_Order_liPingCard |
| Card_in_goods_out_storage |
| CheckIsHealth |
| EMS_API_Errorlog |
| EMS_API_User |
| EMS_Business_analysis |
| EMS_Business_analysis_picture |
| EMS_Business_analysis_view |
| EMS_Buy_OfficeTools |
| EMS_Buy_OfficeTools_View |
| EMS_Buy_OfficeTools_XX |
| EMS_CG_GongYingXinXi |
| EMS_CG_HeiMingDan |
| EMS_CK_FenLei |
| EMS_CaiGou_FuKuan_MingXi |
| EMS_Chuku_class_View |
| EMS_DingdanKehu |
| EMS_GongYingShang_HeTong |
| EMS_Goods_be_packed_good |
| EMS_Goods_be_packed_order |
| EMS_Instigated_fromstorage_order |
| EMS_Instigated_order |
| EMS_Instigated_tostorage_order |
| EMS_JBSZ_PinPai |
| EMS_JBSZ_QuYu |
| EMS_KEHU_fenpei |
| EMS_LiCard_Class |
| EMS_Li_Goods |
| EMS_Lipinquan_card |
| EMS_Log |
| EMS_Order_log |
| EMS_Orders_YinShang |
| EMS_Personal_Mail |
| EMS_Personal_Message |
| EMS_Personal_PublicMail |
| EMS_Personal_Work |
| EMS_Product |
| EMS_ProductType |
| EMS_QRcode_product |
| EMS_StorageWay |
| EMS_TradeMark |
| EMS_User_Funds |
| EMS_XT_Dept |
| EMS_XT_User |
| EMS_XT_UserGroup |
| EMS_XT_UserGroup_Buy |
| EMS_XT_UserGroup_Fund |
| EMS_XT_UserGroup_KeHu |
| EMS_XT_UserGroup_Sell |
| EMS_XT_UserGroup_Storage |
| EMS_XT_UserGroup_WuLiu |
| EMS_XiaoShou_KeHu |
| EMS_XiaoShou_KeHu_temp |
| EMS_YeWu_HuJiao_orders |
| EMS_YiDongHuiZhiDan |
| EMS_assembly_part |
| EMS_assembly_product |
| EMS_auditingtable |
| EMS_buy_order |
| EMS_buy_order_damage |
| EMS_buy_order_gift |
| EMS_buy_order_return |
| EMS_buygood_record |
| EMS_buyordergood |
| EMS_buyordergood_damage |
| EMS_buyordergood_gift |
| EMS_buyordergood_return |
| EMS_call_center_phone_record |
| EMS_card_Order |
| EMS_check_good_table |
| EMS_check_order_table |
| EMS_instigated_buygood_record |
| EMS_instigated_fromstorage_goods |
| EMS_instigated_goods |
| EMS_instigated_tostorage_goods |
| EMS_office_buygood_record |
| EMS_office_sell_order |
| EMS_office_sellgood_record |
| EMS_office_storage_order |
| EMS_orders_TuiHuanHuo |
| EMS_outstock_goods |
| EMS_outstock_order |
| EMS_sell_OfficeTools |
| EMS_sell_OfficeTools_XX |
| EMS_sell_delivery |
| EMS_selldelivery |
| EMS_selldelivery_gift |
| EMS_storage_modify1 |
| EMS_storage_order |
| EMS_storage_type |
| EMS_supermarketorder |
| EMS_supermarketsellgood |
| EmsTaobaoLog |
| EmsTaobaoOrders |
| EmsTaobaoShop |
| EmsTaobaoTrade |
| EmsTaobaoUser |
| Ems_GongYingShang_lianxiren |
| Ems_guest_type_table |
| Ems_manual_fee_type |
| Ems_partition_batch |
| Ems_partition_batch1 |
| Ems_partition_batch_Call_center_order_list |
| Ems_partition_batch_Call_center_order_list_storage_info |
| Ems_phone_record |
| Ems_see_all_sell_order_group |
| GK_Admin |
| GK_SchoolInfo |
| GK_StuInfo |
| GK_Stu_EMS |
| GK_log |
| GouWuQuan |
| INGNET_DataSourceType |
| INGNET_PersonnelData |
| INGNET_PersonnelData_column_name |
| INGNET_PersonnelData_temp |
| JDFQ |
| KS_ADPlace |
| KS_Adiplist |
| KS_Admin |
| KS_Advertise |
| KS_Announce |
| KS_Article |
| KS_Blog |
| KS_BlogClass |
| KS_BlogComment |
| KS_BlogInfo |
| KS_BlogMessage |
| KS_BlogMusic |
| KS_BlogTemplate |
| KS_BlogType |
| KS_Bm_Yw_List |
| KS_Channel |
| KS_Class |
| KS_Comment |
| KS_Config |
| KS_Delivery |
| KS_Digg |
| KS_DiggList |
| KS_DownLoad |
| KS_DownParam |
| KS_DownSer |
| KS_EnterPrise |
| KS_EnterPrisePro |
| KS_EnterpriseNews |
| KS_ExtChannel |
| KS_Favorite |
| KS_Field |
| KS_Flash |
| KS_Form |
| KS_FormField |
| KS_Form_111 |
| KS_Form_EMS_OL |
| KS_Form_gjh |
| KS_Friend |
| KS_GQ |
| KS_GQType |
| KS_GQ_Class |
| KS_GuestBoard |
| KS_GuestBook |
| KS_GuestReply |
| KS_InnerLink |
| KS_JSFile |
| KS_KeyWords |
| KS_Label |
| KS_LabelFolder |
| KS_Link |
| KS_LinkFolder |
| KS_Log |
| KS_LogDeliver |
| KS_LogEdays |
| KS_LogInvoice |
| KS_LogMoney |
| KS_LogPoint |
| KS_MSClass |
| KS_MSSClass |
| KS_MSSinger |
| KS_MSSongList |
| KS_MSSongWord |
| KS_MSSpecial |
| KS_MSSpecialComment |
| KS_MSUserAddWord |
| KS_MediaServer |
| KS_Message |
| KS_Movie |
| KS_MovieOnline |
| KS_MovieParam |
| KS_Online |
| KS_Order |
| KS_OrderItem |
| KS_Order_List |
| KS_Order_List1 |
| KS_Order_List2 |
| KS_Origin |
| KS_PaymentPlat |
| KS_PaymentType |
| KS_Photo |
| KS_PhotoClass |
| KS_PhotoVote |
| KS_Photoxc |
| KS_Photozp |
| KS_ProPrice |
| KS_Product_View |
| KS_RssUrl |
| KS_ShopCoupon |
| KS_ShopCouponUser |
| KS_SiteCount |
| KS_Special |
| KS_Team |
| KS_TeamClass |
| KS_TeamTopic |
| KS_TeamUsers |
| KS_Template |
| KS_U_gongqiupingtai |
| KS_U_jinanshipin |
| KS_User |
| KS_UserCard |
| KS_UserClass |
| KS_UserForm |
| KS_UserGroup |
| KS_Vote |
| KS_Yw_List |
| MB_ddzp |
| MB_mbzg |
| Origin_report |
| Origin_report_storage |
| Test |
| TuiHuanHuo_BianHao_View |
| User_Company |
| User_Personal |
| XMShenBao1_View |
| XMShenBao_1 |
| XT_User_Dept_All_view |
| ZAdmin |
| Z_Stu_EMS |
| Z_log |
| a |
| aa |
| aspnet_Applications |
| aspnet_Membership |
| aspnet_Paths |
| aspnet_PersonalizationAllUsers |
| aspnet_PersonalizationPerUser |
| aspnet_Profile |
| aspnet_Roles |
| aspnet_SchemaVersions |
| aspnet_Users |
| aspnet_UsersInRoles |
| aspnet_WebEvent_Events |
| b |
| buy_warehousing_good_gather |
| cardType_out_storage |
| cc |
| daily_report |
| dingdan |
| dtproperties |
| ems_DingDan |
| ems_JBSZ_DanWei |
| ems_YeWuZiJin_View_Zy |
| ems_call_center_authority |
| ems_orders_product |
| ems_orders_product_cangku_view |
| ems_outstock_goods_backup |
| ems_outstock_goods_backup2 |
| ems_outstock_goods_total |
| ems_outstorage_printer_manage |
| ems_xt_user_temp |
| ems_yewu_hujiao_orders_and_Ems_partition_batch_Call_center_order_list_storage_info_view1 |
| export |
| find_buyprice_and_sellprice |
| find_office_storage_goodgatherview |
| find_storage_goodgatherview |
| getCangku |
| get_selledgood_storage_info_and_sellinfo |
| get_selledgood_storage_info_and_sellinfo_gather |
| get_selledgood_storage_info_and_sellinfo_gather2 |
| gongyingshang_excel |
| good_assembly |
| ingnet_EMS_buy_order |
| ingnet_EMS_buyordergood |
| ingnet_EMS_code_way |
| ingnet_EMS_custom |
| ingnet_EMS_customType |
| ingnet_EMS_goods |
| ingnet_EMS_goodsType |
| ingnet_EMS_outstock_goods |
| ingnet_EMS_outstock_order |
| ingnet_EMS_storage_power |
| ingnet_buy_order |
| ingnet_buyordergood |
| ingnet_daily |
| ingnet_excel_name |
| ingnet_goods |
| ingnet_guest_OftenQuery |
| ingnet_guest_origin_type_manage |
| ingnet_guest_type_table |
| ingnet_selldelivery_PackGood |
| ingnet_selled_good_info |
| ingnet_storageArea |
| ingnet_storageCach |
| ingnet_storagePlace |
| ingnet_storagePlaceInfo |
| ingnet_total |
| item_orders_info |
| ks_class_product |
| ks_originAndHeiMingDan |
| ks_product |
| ks_product_temp |
| mb_proinfo |
| nosupplier_good_assembly |
| outstock_storagename_view |
| passport |
| printer_in_storage_view |
| report |
| report_yewuyuan |
| search_yidong |
| sysdiagrams |
| text_service |
| user_department |
| vw_aspnet_Applications |
| vw_aspnet_MembershipUsers |
| vw_aspnet_Profiles |
| vw_aspnet_Roles |
| vw_aspnet_Users |
| vw_aspnet_UsersInRoles |
| vw_aspnet_WebPartState_Paths |
| vw_aspnet_WebPartState_Shared |
| vw_aspnet_WebPartState_User |
| wrong_total |
| wrong_total2 |
| yidong_ems_search |
| yidong_logs |
| 查询 |
+------------------------------------------------------------------------------------------+
Database: EMSERP
[441 tables]
+------------------------------------------------------------------------------------------+
| CW_View_Order_product |
| Card_Order_liPingCard |
| Card_in_goods_out_storage |
| CheckIsHealth |
| EMS_API_Configuration |
| EMS_API_Errorlog |
| EMS_API_User |
| EMS_APIpostInfoLog |
| EMS_BillNo |
| EMS_BillNo_Info |
| EMS_Bllno_UsersTable |
| EMS_BookPickUp |
| EMS_Business_analysis |
| EMS_Business_analysis_picture |
| EMS_Business_analysis_view |
| EMS_Buy_OfficeTools |
| EMS_Buy_OfficeTools_View |
| EMS_Buy_OfficeTools_XX |
| EMS_CG_GongYingXinXi |
| EMS_CG_HeiMingDan |
| EMS_CK_FenLei |
| EMS_CaiGou_FuKuan_MingXi |
| EMS_Chuku_class_View |
| EMS_CodJunction |
| EMS_CustomerInfor |
| EMS_DingdanKehu |
| EMS_DirectOutStorage |
| EMS_GongYingShang_HeTong |
| EMS_Goods_be_packed_good |
| EMS_Goods_be_packed_order |
| EMS_Instigated_fromstorage_order |
| EMS_Instigated_order |
| EMS_Instigated_tostorage_order |
| EMS_InternationalMail |
| EMS_Inventory |
| EMS_InventoryLog |
| EMS_JBSZ_PinPai |
| EMS_JBSZ_QuYu |
| EMS_KEHU_fenpei |
| EMS_LiCard_Class |
| EMS_Li_Goods |
| EMS_Lipinquan_card |
| EMS_Log |
| EMS_MJorders |
| EMS_MJproductInfo |
| EMS_MailOnline |
| EMS_MailTimeLimit |
| EMS_MailWarning |
| EMS_MailYuyue |
| EMS_Merchants_Bank |
| EMS_OrderOperateLog |
| EMS_Order_City_Cell |
| EMS_Order_log |
| EMS_Orders_YinShang |
| EMS_Personal_Mail |
| EMS_Personal_Message |
| EMS_Personal_PublicMail |
| EMS_Personal_Work |
| EMS_PickingListDI |
| EMS_PreStcok |
| EMS_PreStock |
| EMS_Product |
| EMS_ProductType |
| EMS_QRcode_product |
| EMS_SendSMS |
| EMS_ShouJiInfomation |
| EMS_StorageWay |
| EMS_TCKD_info |
| EMS_TCKD_result |
| EMS_TempPhoneCode |
| EMS_TradeMark |
| EMS_User_Funds |
| EMS_WaiBao_QQBuy_Shop |
| EMS_Waibao_Jingdong_Shop |
| EMS_WuLiu_OrderId_Temp |
| EMS_XT_Dept |
| EMS_XT_User |
| EMS_XT_UserGroup |
| EMS_XT_UserGroup_Buy |
| EMS_XT_UserGroup_Fund |
| EMS_XT_UserGroup_KeHu |
| EMS_XT_UserGroup_Sell |
| EMS_XT_UserGroup_Storage |
| EMS_XT_UserGroup_WuLiu |
| EMS_XiaoShou_KeHu |
| EMS_XiaoShou_KeHu_temp |
| EMS_YDHZ_User |
| EMS_YDHZ_Userimg |
| EMS_YDHZ_img |
| EMS_YD_WL_PostBack |
| EMS_YD_backInfo |
| EMS_YeWu_HuJiao_orders |
| EMS_YiDongHuiZhiDan |
| EMS_YiDong_WuLiuManages |
| EMS_amountincome_info |
| EMS_assembly_part |
| EMS_assembly_product |
| EMS_auditingtable |
| EMS_billnoTable07161 |
| EMS_buy_order |
| EMS_buy_order_damage |
| EMS_buy_order_gift |
| EMS_buy_order_return |
| EMS_buygood_record |
| EMS_buyordergood |
| EMS_buyordergood_damage |
| EMS_buyordergood_gift |
| EMS_buyordergood_return |
| EMS_call_center_phone_record |
| EMS_card_Order |
| EMS_check_good_table |
| EMS_check_order_table |
| EMS_instigated_buygood_record |
| EMS_instigated_fromstorage_goods |
| EMS_instigated_goods |
| EMS_instigated_tostorage_goods |
| EMS_mailTrack |
| EMS_office_buygood_record |
| EMS_office_sell_order |
| EMS_office_sellgood_record |
| EMS_office_storage_order |
| EMS_orders_TuiHuanHuo |
| EMS_orders_product |
| EMS_outstock_goods |
| EMS_outstock_order |
| EMS_pickingList |
| EMS_productTransform |
| EMS_receivepostdata |
| EMS_sell_OfficeTools |
| EMS_sell_OfficeTools_XX |
| EMS_selldelivery |
| EMS_selldelivery_gift |
| EMS_storage_modify1 |
| EMS_storage_order |
| EMS_storage_type |
| EMS_supermarketorder |
| EMS_supermarketsellgood |
| EMS_userAndCustomer |
| EmsTaobaoLog |
| EmsTaobaoOrders |
| EmsTaobaoShop |
| EmsTaobaoTrade |
| EmsTaobaoUser |
| Ems_GongYingShang_lianxiren |
| Ems_Sdcollection |
| Ems_guest_type_table |
| Ems_manual_fee_type |
| Ems_partition_batch |
| Ems_partition_batch1 |
| Ems_partition_batch_Call_center_order_list |
| Ems_partition_batch_Call_center_order_list_storage_info |
| Ems_phone_record |
| Ems_see_all_sell_order_group |
| GK_Admin |
| GK_SchoolInfo |
| GK_StuInfo |
| GK_Stu_EMS |
| GK_log |
| GouWuQuan |
| INGNET_DataSourceType |
| INGNET_PersonnelData |
| INGNET_PersonnelData_column_name |
| INGNET_PersonnelData_temp |
| JDFQ |
| KS_ADPlace |
| KS_Adiplist |
| KS_Admin |
| KS_Advertise |
| KS_Announce |
| KS_Article |
| KS_Blog |
| KS_BlogClass |
| KS_BlogComment |
| KS_BlogInfo |
| KS_BlogMessage |
| KS_BlogMusic |
| KS_BlogTemplate |
| KS_BlogType |
| KS_Bm_Yw_List |
| KS_Channel |
| KS_Class |
| KS_Comment |
| KS_Config |
| KS_Delivery |
| KS_Digg |
| KS_DiggList |
| KS_DownLoad |
| KS_DownParam |
| KS_DownSer |
| KS_EnterPrise |
| KS_EnterPrisePro |
| KS_EnterpriseNews |
| KS_ExtChannel |
| KS_Favorite |
| KS_Field |
| KS_Flash |
| KS_Form |
| KS_FormField |
| KS_Form_111 |
| KS_Form_EMS_OL |
| KS_Form_gjh |
| KS_Friend |
| KS_GQ |
| KS_GQType |
| KS_GQ_Class |
| KS_GuestBoard |
| KS_GuestBook |
| KS_GuestReply |
| KS_InnerLink |
| KS_JSFile |
| KS_KeyWords |
| KS_Label |
| KS_LabelFolder |
| KS_Link |
| KS_LinkFolder |
| KS_Log |
| KS_LogDeliver |
| KS_LogEdays |
| KS_LogInvoice |
| KS_LogMoney |
| KS_LogPoint |
| KS_MSClass |
| KS_MSSClass |
| KS_MSSinger |
| KS_MSSongList |
| KS_MSSongWord |
| KS_MSSpecial |
| KS_MSSpecialComment |
| KS_MSUserAddWord |
| KS_MediaServer |
| KS_Message |
| KS_Movie |
| KS_MovieOnline |
| KS_MovieParam |
| KS_Online |
| KS_Order |
| KS_OrderItem |
| KS_Order_List |
| KS_Order_List1 |
| KS_Order_List2 |
| KS_Origin |
| KS_PaymentPlat |
| KS_PaymentType |
| KS_Photo |
| KS_PhotoClass |
| KS_PhotoVote |
| KS_Photoxc |
| KS_Photozp |
| KS_ProPrice |
| KS_Product_View |
| KS_RssUrl |
| KS_ShopCoupon |
| KS_ShopCouponUser |
| KS_SiteCount |
| KS_Special |
| KS_Team |
| KS_TeamClass |
| KS_TeamTopic |
| KS_TeamUsers |
| KS_Template
修复方案：
版权声明：转载请注明来源 黑暗游侠@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：5
确认时间：2015-04-22 08:15
厂商回复：
谢谢
最新状态：
暂无