百度云微信公众号活动存在 SQL 注入漏洞

1. 发现方式：没什么，提现的时候随手一抓包一看觉得有点意思，挖了挖就发现这个了。
2. 漏洞证明：
1.首先给 http://app02.baidurecord.com/html/qianbao.html 这个页面打断点，将这个页面的内容替换为以下内容。
<!doctype html>
<html>
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1,minimum-scale=1,user-scalable=no"/>
    <title>百度云ABC答题王</title>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/jquery-1.11.1.min.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/port.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/jiami.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/vue_min.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/layer_mobile/layer.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/zKit.js"></script>
    <script src="http://res.wx.qq.com/open/js/jweixin-1.0.0.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/share.js"></script>
    <script type="text/javascript" src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/js/zshang.js"></script>
    <link type="text/css" rel="stylesheet" href="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/css/default.css">
</head>
<body>
<section id="stage">
    <div class="part qianbao">
        <div>
            <div>
                <div>
                    <div>
                        <!--头像-->
                        <div><img src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/images/touxiang.png" alt=""></div>
                        <!--昵称-->
                        <h2></h2>
                    </div>

                    <div>
                        <ul>
                            <!--游戏次数展示-->
                            <li>
                                <a href="javascript:void(0)">
                                    <h3>￥<span>0</span>.<b>00</b></h3>
                                    <p>账户余额（元）</p>
                                </a>


                                <a href="JavaScript:void(0)">去提现</a>
                            </li>

                            <!--奖金金额展示-->
                            <li>
                                <a href="javascript:void(0)">
                                    <h3>￥<span>0</span>.<b>00</b></h3>
                                    <p>总收入（元）</p>
                                </a>
                            </li>
                        </ul>
                    </div>



                </div>
            </div>

            <!--明细列表-->
            <div>
                <h1>余额明细</h1>
                <ul>
                   <!-- <li>
                        <div>
                            <h2>奖励</h2>
                            <p>2018.02.05 08:26:22</p>
                        </div>
                        <div class="rightmx centerboth">
                            <p>+<span>110</span>.<b>00</b></p>
                        </div>
                    </li>
-->

                </ul>
                <p style="text-align: center;padding: 1vw 0;color: #999999;font-size: 1.4rem;display: none;">点击加载更多</p>
            </div>



        </div>
    </div>

    <!--提现-->
    <div class="part tixianbxx" style="display: none">
        <!--返回按钮-->
        <div>
            <a href="javascript:void(0)"><img src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/images/back_hei.png" alt=""></a>
        </div>

        <div>
            <h2>提现金额</h2>
            <div>
                <b>￥</b>
                <p><input type="text"><p>
            </div>
            <div>
                <p>可提现余额<span>0.00</span>元<a href="javascript:void(0)">全部提现</a> </p>
            </div>
        </div>


        <div class="linkbox_p linkbox_x_blue tix"><a href="javascript:void(0)">确认提现</a> </div>


        <h3>温馨提示</h3>
        <p>提现成功后，请到<span style="color: #3388FF"> "零钱账户" </span>查看。<br>如有疑问请联系客服<a href=""  style="color: #3388FF"></a> </p>

    </div>


    <!--提示用微信打开-->
    <div class="part weixinTishi"  style="display: none">
        <!--成功界面-->
        <div class="jieguo chenggbox">
            <div><img src="https://bj.bcebos.com/v1/baidu-abc-dati/baidudati/images/chengg.png" alt=""></div>
            <h2>请在微信中打开</h2>
        </div>

    </div>


</section>

<!---->
<script>
    $(function(){
        /*判断是否是微信*/
        if(!z.plat.isWeixin()){
            $('.weixinTishi').show();
        }

        infor_index();
        share();

        var infoData =  localStorage.getItem('infoData');//读取首页信息
        console.log(infoData);
        infoData = JSON.parse(infoData);
        $('.shouname').html(infoData.nickname); //填充昵称
        $('.tiwen_p a').html(infoData.site_tel); //服务电话
        $('.tiwen_p a').attr('href','tel:'+infoData.site_tel); //服务电话

        /*if(infoData.img!=''){
            $('.touxiang img').attr('src',infoData.img); //填充头像
        }*/

        var moneyArr=infoData.money.split('.'); //分割余额
        $('.yue span').html(moneyArr[0]); //赋值金额
        $('.yue b').html(moneyArr[1]); //赋值金额

        $('.tibootmoy span').html(infoData.money); //赋值金额


        var totalMoneyArr=infoData.totalMoney.split('.'); //分割总奖金
        $('.totalmo span').html(totalMoneyArr[0]); //赋值金额
        $('.totalmo b').html(totalMoneyArr[1]); //赋值金额


        /*请求余额明细*/
        var urldatalink = geturllink();
        var pagesize = 10; //每页显示数量
        var page = 1;
        function mingxi() {
            var loading = layer.open({type: 2});
            var token = tokenmake();
            var userAccessToken = localStorage.getItem('userAccessToken');
            var signature = signaturetik(('token='+token),('userAccessToken='+userAccessToken),('pagesize='+pagesize),('page='+page));

            $.ajax({
                url: urldatalink.mxlist,
                type: 'post',
                data: {
                    token: token,
                    signature: signature,
                    userAccessToken: userAccessToken,
                    pagesize: pagesize,
                    page: page

                },
                success:function(ret, err) {
                    layer.close(loading);
                    if (ret) {
                        if(ret.status==1){
                            lockdian = true;
                            if(ret.data.length>0){
                                setdata(ret.data);

                            }else {
                                $('.moredate').html('暂无更多');
                                $('.moredate').show();
                            }

                            if(ret.data.length>0 && ret.data.length<pagesize){
                                $('.moredate').html('暂无更多');
                                $('.moredate').show();
                            }else if(ret.data.length==10){

                                $('.moredate').html('点击加载更多');
                                $('.moredate').show();
                            }




                        }

                    } else {
                        layer.open({
                            content: err.msg,
                            skin: 'msg',
                            time: 2 //2秒后自动关闭
                        });
                    }

                }
            })
        }

        mingxi();
        //填充数据
        function setdata(data){
            
            if(data){
                for(var i =0;i<data.length;i++){
                    var moneyArrl=data[i].money.split('.'); //分割余额


                    if(data[i].money>=0){
                        $('.mingxilist ul').append('<li><div><h2>'+data[i].type+'</h2><p>'+data[i].addTime+'</p></div><div class="rightmx centerboth"><p>+<span>'+moneyArrl[0]+'</span>.<b>'+moneyArrl[1]+'</b></p></div></li>');
                    }else if (data[i].money<0){

                        if(data[i].type=='用户提现'){
                            $('.mingxilist ul').append('<li><div><h2>'+data[i].type+'<span>('+data[i].orderid+')</span></h2><p>'+data[i].addTime+'</p></div><div class="rightmx centerboth"><p><span>'+moneyArrl[0]+'</span>.<b>'+moneyArrl[1]+'</b></p></div></li>');
                        }else {
                            $('.mingxilist ul').append('<li><div><h2>'+data[i].type+'<span></span></h2><p>'+data[i].addTime+'</p></div><div class="rightmx centerboth"><p><span>'+moneyArrl[0]+'</span>.<b>'+moneyArrl[1]+'</b></p></div></li>');
                        }



                    }


                }
            }
        }

        //加载到底部滚动
       /* $(window).scroll(function(){
            var scrollTop = $(this).scrollTop();
            var scrollHeight = $(document).height();
            var windowHeight = $(this).height();
            if(scrollTop + windowHeight == scrollHeight){

            }
        });*/

        /*点击加载更多*/
        var lockdian = true;
        $('.moredate').click(function(){
            if(!lockdian){
                return;
            }
            $('.moredate').html('加载中...');
            lockdian = false;
            page++;
            mingxi();
        });


        /*点击跳提现*/
        $('.tixianbtn').click(function(){
            $('.tixianbxx').show();
            $('.timoney input').focus();
        });
        $('.tixianbxx .back').click(function(){
            infor_index();
            $('.tixianbxx').hide();
        });


        $('.tixianbtn').click(function(){
            var zonmuney = parseFloat($(this).closest('p').find('span').html());
            if(zonmuney>200){
                $('.timoney input').val('200');
            }else {
                $('.timoney input').val(zonmuney);
            }
        });



        /*提现*/
        var locktixian = true;
        $('.tix a').click(function(){
            if(!locktixian){
                return ;
            }
            var don = $('.timoney input').val();  //输入框金额
            var zonmuney = $('.tibootmoy').find('span').html();  //总金额
            console.log(don);

            locktixian = false;
            /*请求首页信息*/
                var loading = layer.open({type: 2});
                var token = tokenmake();
                var userAccessToken = localStorage.getItem('userAccessToken');
                var signature = signaturetik(('token='+token),('userAccessToken='+userAccessToken),('money='+don));

                $.ajax({
                    url: urldatalink.withdraw,
                    type: 'post',
                    data: {
                        token: token,
                        signature: signature,
                        money: don,
                        userAccessToken: userAccessToken

                    },
                    success:function(ret, err) {
                        locktixian = true;
                        layer.close(loading);
                        if (ret) {
                            if(ret.status==1){
                                window.location.href=ret.data.url;

                            }else {
                                layer.open({
                                    content: ret.msg,
                                    skin: 'msg',
                                    time: 2 //2秒后自动关闭
                                });
                            }

                        } else {
                            layer.open({
                                content: err.msg,
                                skin: 'msg',
                                time: 2 //2秒后自动关闭
                            });
                        }

                    }
                })






        });





    });
</script>






</body>
</html>
主要就是将页面上的校验关掉，我懒得去算签名了，直接在页面上输注入语句让页面给算了。
2.然后在提现金额那输入注入语句，可以看到返回有 SQL 语句的错误信息，说明该处存在注入点。
QQ20180218-230214@2x.png