某政府建设工程质量监督系统20处SQL注入打包和任意用户密码重置(下篇)

漏洞概要

缺陷编号:WooYun-2015-0121304

漏洞标题:某政府建设工程质量监督系统20处SQL注入打包和任意用户密码重置(下篇)

相关厂商:中国建筑科学研究院建研科技股份有限公司

漏洞作者:独孤求败

提交时间:2015-06-20 11:32

公开时间:2015-09-21 08:52

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

Tags标签:

漏洞详情

披露状态:

2015-06-20: 细节已通知厂商并且等待厂商处理中
2015-06-23: 厂商已经确认,细节仅向厂商公开
2015-06-26: 细节向第三方安全合作伙伴开放(绿盟科技、唐朝安全巡航、无声信息)
2015-08-17: 细节向核心白帽子及相关领域专家公开
2015-08-27: 细节向普通白帽子公开
2015-09-06: 细节向实习白帽子公开
2015-09-21: 细节向公众公开

简要描述:

rt:还有个中篇忘记发了,

详细说明:

某政府建设工程质量监督系统20处SQL注入打包和任意用户密码重置(下篇)。20处SQL注入,包含16处POST注入,4处GET注入。案例如下所示:http://**.**.**.**/INFOBLXX.aspx**.**.**.**:81/INFOBLXX.aspxhttp://**.**.**.**/INFOBLXX.aspxhttp://**.**.**.**/INFOBLXX.aspxhttp://**.**.**.**/INFOBLXX.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdSgyuanList.aspx**.**.**.**:81/pkpmbs/jdmanage/TJdSgyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdSgyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdSgyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdSgyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShejidanweiList.aspx**.**.**.**:81/pkpmbs/jdmanage/TJdShejidanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShejidanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShejidanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShejidanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShentudanweiList.aspx**.**.**.**:81/pkpmbs/jdmanage/TJdShentudanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShentudanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShentudanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShentudanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShigongdanweiList.aspx**.**.**.**:81/pkpmbs/jdmanage/TJdShigongdanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShigongdanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShigongdanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdShigongdanweiList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdXmjlList.aspx**.**.**.**:81/pkpmbs/jdmanage/TJdXmjlList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdXmjlList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdXmjlList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdXmjlList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdZjyuanList.aspx**.**.**.**:81/pkpmbs/jdmanage/TJdZjyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdZjyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdZjyuanList.aspxhttp://**.**.**.**/pkpmbs/jdmanage/TJdZjyuanList.aspxhttp://**.**.**.**/pkpmbs/manager/userfolderlist.aspx**.**.**.**:81/pkpmbs/manager/userfolderlist.aspxhttp://**.**.**.**/pkpmbs/manager/userfolderlist.aspxhttp://**.**.**.**/pkpmbs/manager/userfolderlist.aspxhttp://**.**.**.**/pkpmbs/manager/userfolderlist.aspxhttp://**.**.**.**//pkpmbs/portal/InfocontentList.aspx**.**.**.**:81//pkpmbs/portal/InfocontentList.aspxhttp://**.**.**.**//pkpmbs/portal/InfocontentList.aspxhttp://**.**.**.**//pkpmbs/portal/InfocontentList.aspxhttp://**.**.**.**//pkpmbs/portal/InfocontentList.aspxhttp://**.**.**.**//pkpmbs/portal/InfoContentTreeList.aspx**.**.**.**:81/pkpmbs/portal/InfoContentTreeList.aspxhttp://**.**.**.**/pkpmbs/portal/InfoContentTreeList.aspxhttp://**.**.**.**/pkpmbs/portal/InfoContentTreeList.aspxhttp://**.**.**.**/pkpmbs/portal/InfoContentTreeList.aspxhttp://**.**.**.**//pkpmbs/portal/YzgcList.aspx**.**.**.**:81//pkpmbs/portal/YzgcList.aspxhttp://**.**.**.**/pkpmbs/portal/YzgcList.aspxhttp://**.**.**.**/pkpmbs/portal/YzgcList.aspxhttp://**.**.**.**/pkpmbs/portal/YzgcList.aspxhttp://**.**.**.**/pkpmbs//jdmanage/jdprojarchivesmenulist.aspx**.**.**.**:81/pkpmbs//jdmanage/jdprojarchivesmenulist.aspxhttp://**.**.**.**/pkpmbs//jdmanage/jdprojarchivesmenulist.aspxhttp://**.**.**.**/pkpmbs//jdmanage/jdprojarchivesmenulist.aspxhttp://**.**.**.**/pkpmbs//jdmanage/jdprojarchivesmenulist.aspxhttp://**.**.**.**/pkpmbs//jdmanage/GlobalItmViewOutColList.aspx**.**.**.**:81/pkpmbs//jdmanage/GlobalItmViewOutColList.aspxhttp://**.**.**.**/pkpmbs//jdmanage/GlobalItmViewOutColList.aspxhttp://**.**.**.**/pkpmbs//jdmanage/GlobalItmViewOutColList.aspxhttp://**.**.**.**/pkpmbs//jdmanage/GlobalItmViewOutColList.aspxhttp://**.**.**.**//pkpmbs/jddoc/googlemap/addProjectLocation.aspx**.**.**.**:81/pkpmbs/jddoc/googlemap/addProjectLocation.aspxhttp://**.**.**.**/pkpmbs/jddoc/googlemap/addProjectLocation.aspxhttp://**.**.**.**/pkpmbs/jddoc/googlemap/addProjectLocation.aspxhttp://**.**.**.**/pkpmbs/jddoc/googlemap/addProjectLocation.aspxhttp://**.**.**.**//pkpmbs/jddoc/googlemap/AddGPS.aspx**.**.**.**:81//pkpmbs/jddoc/googlemap/AddGPS.aspxhttp://**.**.**.**//pkpmbs/jddoc/googlemap/AddGPS.aspxhttp://**.**.**.**//pkpmbs/jddoc/googlemap/AddGPS.aspxhttp://**.**.**.**//pkpmbs/jddoc/googlemap/AddGPS.aspxhttp://**.**.**.**/pkpmbs/manager/sysuserlist.aspx**.**.**.**:81/pkpmbs/manager/sysuserlist.aspxhttp://**.**.**.**/pkpmbs/manager/sysuserlist.aspxhttp://**.**.**.**/pkpmbs/manager/sysuserlist.aspxhttp://**.**.**.**/pkpmbs/manager/sysuserlist.aspxhttp://**.**.**.**//pkpmbs/consmodel/TBpModifyLogList.aspx?ClassName=CESChttp://**.**.**.**//pkpmbs/consmodel/TBpModifyLogList.aspx?ClassName=CESChttp://**.**.**.**//pkpmbs/consmodel/TBpModifyLogList.aspx?ClassName=CESChttp://**.**.**.**//pkpmbs/consmodel/TBpModifyLogList.aspx?ClassName=CESC**.**.**.**:81//pkpmbs/consmodel/TBpModifyLogList.aspx?ClassName=CESChttp://**.**.**.**/pkpmbs/jddoc/iSignature/Signature_DocEdit.aspx?exist=&page=1&ITMID=&CODE=**.**.**.**:81/pkpmbs/jddoc/iSignature/Signature_DocEdit.aspx?exist=&page=1&ITMID=&CODE=http://**.**.**.**/pkpmbs/jddoc/iSignature/Signature_DocEdit.aspx?exist=&page=1&ITMID=&CODE=http://**.**.**.**/pkpmbs/jddoc/iSignature/Signature_DocEdit.aspx?exist=&page=1&ITMID=&CODE=http://**.**.**.**/pkpmbs/jddoc/iSignature/Signature_DocEdit.aspx?exist=&page=1&ITMID=&CODE=http://**.**.**.**/pkpmbs/CMQuery/CommonManager/QueryParameterList.aspx?queryid=1http://**.**.**.**//pkpmbs/CMQuery/CommonManager/QueryParameterList.aspx?queryid=1http://**.**.**.**//pkpmbs/CMQuery/CommonManager/QueryParameterList.aspx?queryid=1http://**.**.**.**//pkpmbs/CMQuery/CommonManager/QueryParameterList.aspx?queryid=1**.**.**.**:81//pkpmbs/CMQuery/CommonManager/QueryParameterList.aspx?queryid=1http://**.**.**.**/pkpmbs/CMQuery/QueryParameter.aspx?__queryid__=VdCc%2biXrsP0%3d**.**.**.**//pkpmbs/CMQuery/QueryParameter.aspx?__queryid__=VdCc%2biXrsP0%3dhttp://**.**.**.**//pkpmbs/CMQuery/QueryParameter.aspx?__queryid__=VdCc%2biXrsP0%3dhttp://**.**.**.**/pkpmbs/CMQuery/QueryParameter.aspx?__queryid__=VdCc%2biXrsP0%3dhttp://**.**.**.**/pkpmbs/CMQuery/QueryParameter.aspx?__queryid__=VdCc%2biXrsP0%3d

漏洞证明:

SQL注入漏洞证明:POST例:http://**.**.**.**/INFOBLXX.aspx搜索:单引号注入报错

手工注入:搜索 1' and @@version=1 and '%'=' 报错曝出数据库版本

搜索 1' and db_name()=1 and '%'=' 报错曝出数据库表名

GET注入例:http://**.**.**.**//pkpmbs/consmodel/TBpModifyLogList.aspx?ClassName=CESC

全站任意用户密码重置:越权查看:http://**.**.**.**/pkpmbs/manager/sysuserlist.aspx越权修改密码:http://**.**.**.**/pkpmbs/manager/modiuserpwd.aspx两处越权综合利用,可修改任意会员密码等其他信息。证明如下:

修复方案:

.....

漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-06-2308:50

厂商回复:

CNVD确认并复现所述情况,根据实测案例,已经转由CNCERT下发给吉林和黑龙江分中心,由其后续协调网站管理单位处置.

最新状态:

暂无

评价