当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-059483

漏洞标题:PPTV小漏洞合集

相关厂商:PPTV(PPlive)

漏洞作者: 路人甲

提交时间:2014-05-05 10:33

修复时间:2014-06-19 10:34

公开时间:2014-06-19 10:34

漏洞类型:后台弱口令

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-05-05: 细节已通知厂商并且等待厂商处理中
2014-05-05: 厂商已经确认,细节仅向厂商公开
2014-05-15: 细节向核心白帽子及相关领域专家公开
2014-05-25: 细节向普通白帽子公开
2014-06-04: 细节向实习白帽子公开
2014-06-19: 细节向公众公开

简要描述:

几个PPTV的小漏洞,包括后台弱口令、配置文件下载等。

详细说明:

1.后台弱口令
http://acm.pptv.com/ (最新一次检测已修复)
用户名:ejacky 密码:123456
http://cooperation.pplive.com/
用户名:test 密码:123456
2.配置文件下载
http://sr3.pplive.com/upload.php(已修复)

<?php
/**
* Controller for upload
*
* @author luoqiang
*
*/
class Controller_Upload extends Controller_Common_Base {
private $_upload_cache_path;
private $_ftp_server;
private $_ftp_user_name;
private $_ftp_user_pass;
private $_file_md5;
private $_files;
private $_off; // 返回操作状态(成功/失败)
private $_conn_id; // FTP连接
private $_return;
private $_img_upload_config_url;
private $_img_upload_config_info;
private $_img_upload_config_local_file;
private $_cache_time;
private $_max_size;
private $_server_num;
private $_relaxation_size;
const EXTEND_MAX_SIZE = 0;
const EXTEND_CUSTOM_SIZE = 1;
const SIZE_OK = 2;

public function __construct(){
$this->_upload_cache_path = WEB_ROOT_DIR . '/../cache/';
//$this->_ftp_server = "180.153.106.41";
//$this->_ftp_server = "static.ftp.pplive.cn";//公网域名走CDN,会出现图片上传很慢以及失败的情况
$this->_ftp_server = "static.ftp.idc.pplive.cn";//内网域名
$this->_ftp_user_name = "unsrser";
$this->_ftp_user_pass = "********";
$this->_return = array();
$this->_file_md5 = "";
$this->_files = array();
$this->_img_upload_config_url = "http://config.aplusapi.pptv.com/web/img_upload/?".time();
$this->_img_upload_config_info = array();
$this->_img_upload_config_local_file = '../../cache/cms/configurations_img_upload.json';
$this->_cache_time = 600;
$this->_max_limit_size = 100;
$this->_server_num = 4;
$this->_relaxation_size = array("swf");
}
public function index(){
$inputId = Request::get("inputId");
$this->view->assign('inputId', $inputId);
$this -> render('upload_img.tpl');
}

public function uploadImgConfig($width,$height,$size){
$filemtime = filemtime($this->_img_upload_config_local_file);
........


http://180.153.106.106:8888/conf.tar.gz
http://180.153.106.107:8888/conf.tar.gz
http://180.153.106.26:8888/conf.tar.gz
http://180.105.106.27:8888/conf.tar.gz
(最新一次检测已修复)

漏洞证明:

QQ截图20140215001316.jpg


2.jpg

3.jpg

修复方案:

·修改相关密码
·删除对应文件

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:5

确认时间:2014-05-05 10:45

厂商回复:

多谢关注PPTV 安全,我们正在跟进处理

最新状态:

暂无