某学校综合管理系统通用SQL注入漏洞影响众多学校

2015-03-20T00:00:00
ID SSV:95597
Type seebug
Reporter Root
Modified 2015-03-20T00:00:00

Description

简要描述:

某学校综合管理系统通用SQL注入漏洞影响众多学校

详细说明:

系统名称:学校综合管理平台 厂商:上海安脉计算机科技有限公司 关键字:版权所有:上海安脉计算机科技有限公司 系统架构:ASPX+MSSQL 漏洞文件:OA/repair/staticStat.aspx 注入参数:seldep 枚举部分案例: http://anmai.net:81/OA/repair/staticStat.aspx http://jwxx.am.jsedu.sh.cn/ANMAI/OA/repair/staticStat.aspx http://bssyxxgl.eicbs.com/OA/repair/staticStat.aspx http://cjzx.am.jsedu.sh.cn/OA/repair/staticStat.aspx http://glpt.nhshs.edu.sh.cn/OA/repair/staticStat.aspx http://218.78.241.80/anmai/OA/repair/staticStat.aspx http://www.aqyz.net/anmai/OA/repair/staticStat.aspx http://218.22.96.74:8899/anmai/OA/repair/staticStat.aspx http://120.69.153.68:8002/anmai654202_458357247/OA/repair/staticStat.aspx http://222.82.229.202:2010/anmai/OA/repair/staticStat.aspx http://58.118.20.5/anmai/OA/repair/staticStat.aspx http://124.228.32.115:81/OA/repair/staticStat.aspx http://luoxzx.am.jsedu.sh.cn/OA/repair/staticStat.aspx http://www.syzxyz.com:8008/OA/repair/staticStat.aspx 等等。。 漏洞验证: 这里以http://anmai.net:81/OA/repair/staticStat.aspx为例:

<img src="https://images.seebug.org/upload/201503/19194012ce8b1be5ad5a912422c78cfdc17a5c9a.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

数据包如下:

POST /OA/repair/staticStat.aspx HTTP/1.1 Host: anmai.net:81 Proxy-Connection: keep-alive Content-Length: 1059 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://anmai.net:81 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://anmai.net:81/OA/repair/staticStat.aspx Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8 Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=fu3lhr45p5kavo553cyi5wyb; ASPSESSIONIDASDDBCCB=MGJJNPBDKFGIGGBABKJHKHIA __VIEWSTATE=dDwtMTQyOTUxMjY1NDt0PDtsPGk8MT47PjtsPHQ8O2w8aTw1PjtpPDc%2BO2k8OT47PjtsPHQ8O2w8aTwwPjs%2BO2w8dDw7bDxpPDE%2BOz47bDx0PHQ8O3Q8aTwxOT47QDxcZTvmlZnliqHlpIQ75oC75Yqh5aSEO%2BaVmeeglOWupDvmoKHplb%2FlrqQ75pWZ5a2m5aSEO%2BaVmeiCsuWkhDvmoKHlip7lhazlrqQ756eR56CU5aSEO%2BS9k%2BiCsue7hDvpooTlpIflubTnuqfnu4Q75Yid5LiA5bm057qn57uEO%2BWIneS6jOW5tOe6p%2Be7hDvliJ3kuInlubTnuqfnu4Q76auY5LiA5bm057qn57uEO%2BmrmOS6jOW5tOe6p%2Be7hDvpq5jkuInlubTnuqfnu4Q75L%2Bh5oGv5Lit5b%2BDO%2Bezu%2Be7n%2BeuoeeQhuWRmDs%2BO0A8XGU7MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQ7MTU7MTY7MTc7MDs%2BPjs%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPFZpc2libGU7PjtsPG88Zj47Pj47bDxpPDA%2BOz47bDx0PDtsPGk8Mz47PjtsPHQ8dDw7O0BTeXN0ZW0uSW50MzIsIG1zY29ybGliLCBWZXJzaW9uPTEuMC41MDAwLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OTxpPDA%2BOz4%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPHN0eWxlOz47bDxXSURUSDogMTAwJVw7Qk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZTs%2BPjs7Pjs%2BPjs%2BPjtsPHJhZGlvMTtyYWRpbzI7Pj5Nli1yl6lyIm7SIU0%2BarPM%2F2%2ByPQ%3D%3D&isOK=&aa=1&seldep=2&fullname=aaaaa&startdate1=2015-03-09&enddate1=2015-03-18

相关代码如下:

<img src="https://images.seebug.org/upload/201503/19194109f77eee87c9788b198d31c57bc6bc1a66.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201503/19194200a3341be217f1bfa0023b6885938373f4.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

当前数据库:

<img src="https://images.seebug.org/upload/201503/19194211b6ad51e6b97fb56a18d8afd019cda5a0.png" alt="2.png" width="600" onerror="javascript:errimg(this);">

漏洞证明:

http://anmai.net:81/OA/repair/staticStat.aspx为例:

<img src="https://images.seebug.org/upload/201503/19194012ce8b1be5ad5a912422c78cfdc17a5c9a.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

数据包如下:

POST /OA/repair/staticStat.aspx HTTP/1.1 Host: anmai.net:81 Proxy-Connection: keep-alive Content-Length: 1059 Cache-Control: max-age=0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8 Origin: http://anmai.net:81 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36 Content-Type: application/x-www-form-urlencoded Referer: http://anmai.net:81/OA/repair/staticStat.aspx Accept-Encoding: gzip, deflate Accept-Language: zh-CN,zh;q=0.8 Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=fu3lhr45p5kavo553cyi5wyb; ASPSESSIONIDASDDBCCB=MGJJNPBDKFGIGGBABKJHKHIA __VIEWSTATE=dDwtMTQyOTUxMjY1NDt0PDtsPGk8MT47PjtsPHQ8O2w8aTw1PjtpPDc%2BO2k8OT47PjtsPHQ8O2w8aTwwPjs%2BO2w8dDw7bDxpPDE%2BOz47bDx0PHQ8O3Q8aTwxOT47QDxcZTvmlZnliqHlpIQ75oC75Yqh5aSEO%2BaVmeeglOWupDvmoKHplb%2FlrqQ75pWZ5a2m5aSEO%2BaVmeiCsuWkhDvmoKHlip7lhazlrqQ756eR56CU5aSEO%2BS9k%2BiCsue7hDvpooTlpIflubTnuqfnu4Q75Yid5LiA5bm057qn57uEO%2BWIneS6jOW5tOe6p%2Be7hDvliJ3kuInlubTnuqfnu4Q76auY5LiA5bm057qn57uEO%2BmrmOS6jOW5tOe6p%2Be7hDvpq5jkuInlubTnuqfnu4Q75L%2Bh5oGv5Lit5b%2BDO%2Bezu%2Be7n%2BeuoeeQhuWRmDs%2BO0A8XGU7MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQ7MTU7MTY7MTc7MDs%2BPjs%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPFZpc2libGU7PjtsPG88Zj47Pj47bDxpPDA%2BOz47bDx0PDtsPGk8Mz47PjtsPHQ8dDw7O0BTeXN0ZW0uSW50MzIsIG1zY29ybGliLCBWZXJzaW9uPTEuMC41MDAwLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OTxpPDA%2BOz4%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPHN0eWxlOz47bDxXSURUSDogMTAwJVw7Qk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZTs%2BPjs7Pjs%2BPjs%2BPjtsPHJhZGlvMTtyYWRpbzI7Pj5Nli1yl6lyIm7SIU0%2BarPM%2F2%2ByPQ%3D%3D&isOK=&aa=1&seldep=2&fullname=aaaaa&startdate1=2015-03-09&enddate1=2015-03-18

相关代码如下:

<img src="https://images.seebug.org/upload/201503/19194109f77eee87c9788b198d31c57bc6bc1a66.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

<img src="https://images.seebug.org/upload/201503/19194200a3341be217f1bfa0023b6885938373f4.png" alt="1.png" width="600" onerror="javascript:errimg(this);">

当前数据库:

<img src="https://images.seebug.org/upload/201503/19194211b6ad51e6b97fb56a18d8afd019cda5a0.png" alt="2.png" width="600" onerror="javascript:errimg(this);">