当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0142385

漏洞标题：北京文惠卡主站SQL注入漏洞(支持UNION/用户信息泄漏)

相关厂商：北京文惠卡

漏洞作者： 路人甲

提交时间：2015-09-21 23:02

修复时间：2015-11-05 23:04

公开时间：2015-11-05 23:04

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-21： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-05： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

北京文惠卡，是根据北京文化消费特点与需求而开发的创新服务产品，是一个文化普惠项目。实名申请、商户广泛、多种打折、积分抽奖，为您的文化消费带来便捷和优惠

详细说明：

【注入点】：
http://www.bjwhk.com/index.php/home/search/search.html?key=88952634&=%E6%90%9C%E7%B4%A2
【sqlmap截图】：

1.jpg


用户详细信息

2.jpg


似乎涉及到了银行卡和money
【数据库】：

Database: bjwhk
[129 tables]
+------------------------------+
| thinkox_action               |
| thinkox_action_log           |
| thinkox_addons               |
| thinkox_advertising          |
| thinkox_advs                 |
| thinkox_attachment           |
| thinkox_attribute            |
| thinkox_auth_extend          |
| thinkox_auth_group           |
| thinkox_auth_group_access    |
| thinkox_auth_rule            |
| thinkox_avatar               |
| thinkox_caiji                |
| thinkox_caiji2               |
| thinkox_caiji3               |
| thinkox_caiji4               |
| thinkox_caiji5               |
| thinkox_card                 |
| thinkox_category             |
| thinkox_channel              |
| thinkox_check_info           |
| thinkox_config               |
| thinkox_district             |
| thinkox_document             |
| thinkox_document_article     |
| thinkox_document_download    |
| thinkox_event                |
| thinkox_event_attend         |
| thinkox_event_type           |
| thinkox_field                |
| thinkox_field_group          |
| thinkox_field_setting        |
| thinkox_file                 |
| thinkox_follow               |
| thinkox_footer_friendlylink  |
| thinkox_footer_gywhk         |
| thinkox_footer_lxwm          |
| thinkox_footer_yssm          |
| thinkox_footer_zcwhk         |
| thinkox_forum                |
| thinkox_forum_bookmark       |
| thinkox_forum_lzl_reply      |
| thinkox_forum_post           |
| thinkox_forum_post_reply     |
| thinkox_group                |
| thinkox_group_bookmark       |
| thinkox_group_dynamic        |
| thinkox_group_lzl_reply      |
| thinkox_group_member         |
| thinkox_group_notice         |
| thinkox_group_post           |
| thinkox_group_post_category  |
| thinkox_group_post_reply     |
| thinkox_group_type           |
| thinkox_hooks                |
| thinkox_issue                |
| thinkox_issue_content        |
| thinkox_item                 |
| thinkox_item_address         |
| thinkox_item_buy             |
| thinkox_item_category        |
| thinkox_item_config          |
| thinkox_item_hotzone         |
| thinkox_item_log             |
| thinkox_item_see             |
| thinkox_local_comment        |
| thinkox_member               |
| thinkox_menu                 |
| thinkox_message              |
| thinkox_model                |
| thinkox_picture              |
| thinkox_rank                 |
| thinkox_rank_user            |
| thinkox_search_active        |
| thinkox_search_qa            |
| thinkox_search_sh            |
| thinkox_search_tag           |
| thinkox_seo_rule             |
| thinkox_shangjia             |
| thinkox_shangjia_logo        |
| thinkox_shangjia_quyu        |
| thinkox_shangjia_type        |
| thinkox_shop                 |
| thinkox_shop_address         |
| thinkox_shop_buy             |
| thinkox_shop_category        |
| thinkox_shop_config          |
| thinkox_shop_log             |
| thinkox_shop_see             |
| thinkox_super_links          |
| thinkox_support              |
| thinkox_sync_login           |
| thinkox_talk                 |
| thinkox_talk_message         |
| thinkox_talk_message_push    |
| thinkox_talk_push            |
| thinkox_ucenter_admin        |
| thinkox_ucenter_member       |
| thinkox_ucenter_setting      |
| thinkox_ucenter_shangjia     |
| thinkox_url                  |
| thinkox_user_token           |
| thinkox_video                |
| thinkox_weibo                |
| thinkox_weibo_comment        |
| thinkox_weibo_top            |
| thinkox_whu_dltj             |
| thinkox_whu_document         |
| thinkox_whu_event            |
| thinkox_whu_event_attent     |
| thinkox_whu_event_interested |
| thinkox_whu_event_recommand  |
| thinkox_whu_event_set        |
| thinkox_whu_event_type       |
| thinkox_whu_hdtj             |
| thinkox_whu_huangye_cnxh     |
| thinkox_whu_huangye_gg       |
| thinkox_whu_huangye_shbd     |
| thinkox_whu_huangye_yctj     |
| thinkox_whu_show             |
| thinkox_whu_showggw          |
| thinkox_whu_showlbt          |
| thinkox_whu_showtj           |
| thinkox_whu_sybj             |
| thinkox_whu_syewm            |
| thinkox_whu_syggw            |
| thinkox_whu_sytop            |
| thinkox_whu_yhtj             |
| thinkox_yanchu_action        |
+------------------------------+

漏洞证明：

QQ20150921-12@2x.png


QQ20150921-13@2x.png

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝