当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-090512

漏洞标题：习网某站SQL注入(影响24个数据库)

相关厂商：ciwong.com

漏洞作者： im503

提交时间：2015-01-08 11:51

修复时间：2015-02-17 19:15

公开时间：2015-02-17 19:15

漏洞类型：SQL注射漏洞

危害等级：中

自评Rank：8

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-08： 细节已通知厂商并且等待厂商处理中
2015-01-08： 厂商已经确认，细节仅向厂商公开
2015-01-18： 细节向核心白帽子及相关领域专家公开
2015-01-28： 细节向普通白帽子公开
2015-02-07： 细节向实习白帽子公开
2015-02-17： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

详细说明：

url:http://xxcg.ciwong.com/learninglevel/SubjectDet
ail?id=35
136个数据库.24个系统用户。还爆出几个密码，我就不在这贴了.
请叫我小红帽。

database management system users [24]:
[*] 'backup'@'192.168.1.101'
[*] 'backup'@'192.168.1.237'
[*] 'bkpuser'@'127.0.0.1'
[*] 'bruce'@'%'
[*] 'cacti'@'192.168.1.241'
[*] 'china_read'@'%'
[*] 'ciwong_ck'@'%'
[*] 'ciwong_it'@'%'
[*] 'leoxqing'@'192.168.1.241'
[*] 'repl'@'192.168.1.%'
[*] 'repl_ck'@'192.168.1.%'
[*] 'root'@'%'
[*] 'root'@'127.0.0.1'
[*] 'root'@'192.168.1.100'
[*] 'root'@'192.168.1.233'
[*] 'root'@'192.168.1.234'
[*] 'root'@'192.168.1.241'
[*] 'root'@'::1'
[*] 'root'@'localhost'
[*] 'videouser'@'%'
[*] 'webadmin_pac'@'%'
[*] 'wordchange'@'%'
[*] 'zhiligame'@'%'
[*] 'ziyuan'@'%'

漏洞证明：

available databases [136]:
[*] beehive_listenread
[*] beehive_pointmall
[*] beehive_synchronwork
[*] beehive_voicespeech
[*] beehivedb
[*] bookcase
[*] ciwong_colorful
[*] ciwong_newsmanagement
[*] ciwong_qr
[*] cloudreader
[*] cmsdata
[*] cw_6v68_settlement
[*] cw_admin_elearning
[*] cw_admin_elearning_bak
[*] cw_app_store
[*] cw_audio_video_db
[*] cw_basedapplications
[*] cw_chinadream
[*] cw_cooperator
[*] cw_dw
[*] cw_edu
[*] cw_elearning
[*] cw_elearning_bak
[*] cw_englishshow
[*] cw_eshop_cart
[*] cw_eshop_common
[*] cw_eshop_news
[*] cw_eshop_order
[*] cw_eshop_product
[*] cw_eshop_user
[*] cw_gwy
[*] cw_hd
[*] cw_homepage
[*] cw_jibei
[*] cw_jibei_school
[*] cw_learnmonth
[*] cw_microvideo
[*] cw_netschool
[*] cw_packager_arithmetic
[*] cw_packager_arithmetic_en
[*] cw_packager_ebook
[*] cw_packager_experiment
[*] cw_packager_experiment_v2
[*] cw_packager_kousuan
[*] cw_packager_learning_level
[*] cw_packager_listenning_ch
[*] cw_packager_listenning_ch_v2
[*] cw_packager_listenning_en
[*] cw_packager_listenning_en_v2
[*] cw_packager_playwords
[*] cw_packager_reading_ch
[*] cw_packager_reading_en
[*] cw_packager_speaking_en
[*] cw_pay
[*] cw_press
[*] cw_press_new
[*] cw_recommend
[*] cw_resx_center
[*] cw_settlement
[*] cw_trainingdb
[*] cw_workcategory
[*] cw_workcategory_arithmetic
[*] cw_workcategory_arithmetic_en
[*] cw_workcategory_common
[*] cw_workcategory_ebook
[*] cw_workcategory_experience
[*] cw_workcategory_experiment
[*] cw_workcategory_experiment_v2
[*] cw_workcategory_learning_level
[*] cw_workcategory_listenning_ch
[*] cw_workcategory_listenning_ch_v2
[*] cw_workcategory_listenning_en
[*] cw_workcategory_listenning_en_v2
[*] cw_workcategory_more
[*] cw_workcategory_playwords
[*] cw_workcategory_reading_ch
[*] cw_workcategory_reading_en
[*] cw_workcategory_settings
[*] cw_workcategory_speaking_en
[*] cw_workshop
[*] cw_workshop2
[*] cw_yishang
[*] cw_yishang1
[*] cw_yishang_settle
[*] cw_ziyuan
[*] cwapi
[*] cwfav
[*] db_ciliao
[*] db_filestatus
[*] db_kousuan100
[*] db_statistics
[*] db_txb
[*] db_txb_paipai
[*] efficientclassroom
[*] enterprisestudy
[*] game
[*] gxktv3
[*] gxktv3_resource
[*] information
[*] information_schema
[*] microrecord
[*] mysql
[*] notebook_good
[*] notebook_mistake
[*] notebook_senten
[*] notebook_word
[*] performance_schema
[*] qc_ciwong
[*] quesdata
[*] research
[*] research_ky
[*] roompermissionjingsai
[*] schoolzone
[*] searcher
[*] synchpreparation
[*] szdsy2013
[*] t_db_areaconf
[*] t_db_jibei
[*] t_db_listening
[*] t_db_markham
[*] t_db_reportlog
[*] t_db_roomtask
[*] t_db_tinyurl
[*] test
[*] videouser
[*] wiki
[*] wikicommunity
[*] wikipoint
[*] wikiques
[*] wordstockchinese
[*] wordstockenglish
[*] wordstockenglishchangebuilding
[*] wordstockenglishchangeclassifying
[*] wordstockenglishchangescene
[*] wordstocktempresources
[*] work_listen

修复方案：

你懂得。

版权声明：转载请注明来源 im503@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：18

确认时间：2015-01-08 11:59

厂商回复：

我司会尽快修复此漏洞！谢谢反馈！

最新状态：

2015-02-17：谢谢。