当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0169550

漏洞标题：成都多个政府单位数据库泄露包含大量敏感信息

相关厂商：cncert国家互联网应急中心

漏洞作者： 路人甲

提交时间：2016-01-17 19:08

修复时间：2016-03-04 13:27

公开时间：2016-03-04 13:27

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-17： 细节已通知厂商并且等待厂商处理中
2016-01-20： 厂商已经确认，细节仅向厂商公开
2016-01-30： 细节向核心白帽子及相关领域专家公开
2016-02-09： 细节向普通白帽子公开
2016-02-19： 细节向实习白帽子公开
2016-03-04： 细节向公众公开

简要描述：

成都区党员干部现代远程教育网、成都市成华区工商联合会、成都市信访局、龙泉驿区人口和计划生育局和其他企业的
身份证号、单位、联系方式、家庭住址、党员编号、考试信息等多项敏感信息

详细说明：

http://**.**.**.**/introd_show.php?Artctxt_id=1398
available databases [12]:
[*] 962009dy@cdqydj  成都区党员干部现代远程教育网
[*] cd2011chqgslhm  成都市成华区工商联合会
[*] cdsqyqxfj2012   成都市信访局
[*] cdtlz@com2012  成都探路者
[*] cdtlz_articlescms 成都探路者
[*] information_schema
[*] keesoft_datask2010  包含党员敏感信息
[*] lqpop2011 龙泉驿区人口和计划生育局
[*] mysql
[*] phpmyadmin
[*] sq_fimiticoffice
[*] test
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 1675    |
| STATISTICS                            | 249     |
| KEY_COLUMN_USAGE                      | 195     |
| TABLES                                | 172     |
| TABLE_CONSTRAINTS                     | 161     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 126     |
| COLLATIONS                            | 126     |
| CHARACTER_SETS                        | 36      |
| USER_PRIVILEGES                       | 26      |
| SCHEMA_PRIVILEGES                     | 14      |
| SCHEMATA                              | 12      |
| VIEWS                                 | 2       |
+---------------------------------------+---------+
Database: cd2011chqgslhm
+---------------+---------+
| Table         | Entries |
+---------------+---------+
| news_articles | 1008    |
| ad_flash      | 79      |
| questbale     | 37      |
| news_class    | 35      |
| news_type     | 10      |
| stander_user  | 1       |
+---------------+---------+
Database: cdsqyqxfj2012
+------------------+---------+
| Table            | Entries |
+------------------+---------+
| serial_number    | 16796   |
| ms_articles      | 3835    |
| worklist         | 2215    |
| mangerview       | 1610    |
| ms_articles_copy | 1324    |
| news_articles    | 541     |
| ad_flash         | 169     |
| classview        | 167     |
| alext            | 115     |
| user_mark        | 89      |
| questbale        | 59      |
| psq_list         | 50      |
| questbale1       | 47      |
| frendlinks_tb    | 46      |
| alexstyle        | 25      |
| news_class       | 14      |
| psq_tbale        | 10      |
| news_type        | 9       |
| stander_user     | 9       |
| pricesales       | 6       |
| answ_tbale       | 1       |
| vister_tb        | 1       |
+------------------+---------+
Database: cdtlz_articlescms
+----------------------------+---------+
| Table                      | Entries |
+----------------------------+---------+
| tlzcms_guestbook           | 1402657 |
| tlzcms_feedback            | 173940  |
| tlzcms_uploads             | 4946    |
| tlzcms_flink               | 1067    |
| tlzcms_arctiny             | 485     |
| tlzcms_addonarticle        | 475     |
| tlzcms_archives            | 475     |
| tlzcms_product_orders      | 290     |
| tlzcms_product_orders_logs | 290     |
| tlzcms_sysconfig           | 89      |
| tlzcms_arccache            | 12      |
| tlzcms_arcatt              | 8       |
| tlzcms_arctype             | 8       |
| tlzcms_flinktype           | 8       |
| tlzcms_arcrank             | 6       |
| tlzcms_plus                | 5       |
| tlzcms_search_keywords     | 3       |
| tlzcms_vote                | 3       |
| tlzcms_admin               | 2       |
| tlzcms_admintype           | 2       |
| tlzcms_channeltype         | 2       |
| tlzcms_member              | 2       |
| tlzcms_mylang              | 2       |
| tlzcms_freelist            | 1       |
| tlzcms_homepageset         | 1       |
+----------------------------+---------+
Database: keesoft_datask2010
+--------------------+---------+
| Table              | Entries |
+--------------------+---------+
| credits_tb         | 2948    |
| partymember        | 929     |
| partycollective_tb | 617     |
| viedo_articles     | 541     |
| partycollective    | 425     |
| partymember_tb     | 130     |
| news_class         | 62      |
| classmenu          | 32      |
| news_type          | 26      |
| questbale          | 25      |
| frendlinks_tb      | 12      |
| news_articles      | 10      |
| class_smial        | 9       |
| psq_list           | 5       |
| organ_smail        | 4       |
| class_big          | 3       |
| questbale1         | 2       |
| stander_user       | 2       |
| creditbbs_tb1      | 1       |
| organ_big          | 1       |
| vister_tb          | 1       |
+--------------------+---------+
Database: lqpop2011
+---------------+---------+
| Table         | Entries |
+---------------+---------+
| news_articles | 208     |
| news_class    | 23      |
| news_type     | 15      |
| ad_flash      | 8       |
| frendlinks_tb | 5       |
| psq_list      | 5       |
| questbale     | 5       |
| psq_tbale     | 1       |
| stander_user  | 1       |
+---------------+---------+
Database: sq_fimiticoffice
+---------------+---------+
| Table         | Entries |
+---------------+---------+
| news_articles | 867     |
| ad_flash      | 317     |
| news_class    | 28      |
| news_type     | 15      |
| questbale     | 1       |
| stander_user  | 1       |
+---------------+---------+
Database: mysql
+---------------+---------+
| Table         | Entries |
+---------------+---------+
| help_relation | 724     |
| help_topic    | 458     |
| help_keyword  | 378     |
| help_category | 36      |
| user          | 2       |
| db            | 1       |
+---------------+---------+
Database: 962009dy@cdqydj
Table: examination_user
[13 columns]
+---------------+------------------+
| Column        | Type             |
+---------------+------------------+
| exam_achie    | smallint(4)      |
| exam_address  | char(50)         |
| exam_choice   | text             |
| exam_choice_n | smallint(4)      |
| exam_company  | char(30)         |
| exam_date     | date             |
| exam_id       | int(10) unsigned |
| exam_judge    | text             |
| exam_judge_n  | smallint(4)      |
| exam_names    | char(100)        |
| exam_radio    | text             |
| exam_radio_n  | smallint(4)      |
| exam_telphone | varchar(25)      |
+---------------+------------------+

漏洞证明：

QQ截图20160112175248.jpg






QQ截图20160112175341.jpg






QQ截图20160112175501.jpg






QQ截图20160112175652.jpg






QQ截图20160112175829.jpg






QQ截图20160113094047.jpg






QQ截图20160113102905.jpg






QQ截图20160113103156.jpg






QQ截图20160112172626.jpg

修复方案：

加装防火墙，过滤用户输入

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2016-01-20 14:37

厂商回复：

CNVD确认并复现所述情况,已经转由CNCERT下发给四川分中心,由其后续协调网站管理单位处置.

最新状态：

暂无

漏洞评价：

评价