当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0171641

漏洞标题：国电南瑞捷鸿某站点命令执行（涉及大量工作人员信息报表/可扫描内网主机）

相关厂商：国家电网公司

漏洞作者： 路人甲

提交时间：2016-01-21 16:42

修复时间：2016-03-07 10:49

公开时间：2016-03-07 10:49

漏洞类型：命令执行

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-21： 细节已通知厂商并且等待厂商处理中
2016-01-23： 厂商已经确认，细节仅向厂商公开
2016-02-02： 细节向核心白帽子及相关领域专家公开
2016-02-12： 细节向普通白帽子公开
2016-02-22： 细节向实习白帽子公开
2016-03-07： 细节向公众公开

简要描述：

详细说明：

http://211.160.21.126:7002/EICS/jsp/login.jsp 存在命令执行，
通过数据库配置发现大量工作人员信息和工作信息，报表数据。还可以扫描内网。

漏洞证明：

11111.png

xinxi.png

xinxi1.png

xinxi2.png

xinxi3.png

<url>jdbc:oracle:thin:@192.168.61.87:1521:NRJH</url>
    <driver-name>oracle.jdbc.OracleDriver</driver-name>
    <properties>
      <property>
        <name>user</name>
        <value>PJMG</value>
      </property>
    </properties>
    <password-encrypted>{AES}q+mI4dSjEEHeNfeU6dr6O6aKHvdbANXsvrpxIv6uiAw=</password-encrypted> nrjh_829oa

数据库配置

http://211.160.21.126:7002/EICS/1.jspx 9635789

http://127.0.0.6 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.1 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.2 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.4 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.7 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.3 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.5 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.8 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.9 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.10 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.12 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.11 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.13 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.15 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.139 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.140 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.141 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.142 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.143 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.144 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.172 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.171 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.173 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.174 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.175 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.176 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.209 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.210 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.212 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.211 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.213 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.214 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.215 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.216 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.217 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.218 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.219 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.220 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.221 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.222 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.223 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.224 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.225 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.226 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.227 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.243 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.244 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.245 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.246 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.247 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.248 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.249 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.250 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.252 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.253 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.254 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.251 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.255 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.203 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.202 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.206 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.205 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.207 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.208 >> >>Apache/2.2.23 (Unix) DAV/2 SVN/1.6.9 >>Success
http://127.0.0.256 >> Redirect>>nginx >>Success

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2016-01-23 11:04

厂商回复：

谢谢

最新状态：

暂无

漏洞评价：

评价