漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2012-05744
漏洞标题：17173多个站数据库报错致敏感信息泄露
相关厂商：17173游戏
漏洞作者： zeracker
提交时间：2012-04-02 20:05
修复时间：2012-04-07 20:06
公开时间：2012-04-07 20:06
漏洞类型：重要敏感信息泄露
危害等级：中
自评Rank：8
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2012-04-02： 细节已通知厂商并且等待厂商处理中
2012-04-07： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
数据库报错致敏感信息泄露等等。
貌似存在注入，你们看一下吧，网速不给力，卡的要死。
亲，上传图片好慢的，能否考虑加个批量上图？？
详细说明：
http://aion.17173.com/xqly/01.shtml
Warning: mysql_connect() [function.mysql-connect]: Host '10.59.96.9' is not allowed to connect to this MySQL server in/home/httpd/html/board.news.17173.com/include/db.php on line 32
Warning: mysql_close(): supplied argument is not a valid MySQL-Link resource in /home/httpd/html/board.news.17173.com/include/db.php on line 59
数据库暂时无法连接，请稍候……
http://moyu.17173.com/zt/ynz071015/index.shtml
Warning: mysql_connect() [function.mysql-connect]: Host '10.59.96.9' is not allowed to connect to this MySQL server in/home/httpd/html/board.news.17173.com/include/db.php on line 32
Warning: mysql_close(): supplied argument is not a valid MySQL-Link resource in/home/httpd/html/board.news.17173.com/include/db.php on line 59
数据库暂时无法连接，请稍候……
http://moyu.17173.com/leaveword/more.html
Warning: mysql_connect() [function.mysql-connect]: Host '10.59.96.9' is not allowed to connect to this MySQL server in/home/httpd/html/board.news.17173.com/include/db.php on line 32
Warning: mysql_close(): supplied argument is not a valid MySQL-Link resource in/home/httpd/html/board.news.17173.com/include/db.php on line 59
数据库暂时无法连接，请稍候……
http://tera.17173.com/xqly/02.shtml
http://act.17173.com/2010/12/sp1224/show.php
connect error:Lost connection to MySQL server at 'reading initial communication packet', system error: 111
http://act.17173.com/2010/03/tl0316/index.php
http://act.17173.com/2010/04/qnyh0401/index.php
http://act.17173.com/2010/09/cqsn0901/show.php
http://act.17173.com/2010/02/mhzx0209/mjoin.php
漏洞证明：
修复方案：
你们懂的===>QQ2036234 By:301
版权声明：转载请注明来源 zeracker@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2012-04-07 20:06
厂商回复：
最新状态：
暂无