当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-077746

漏洞标题：TCL系列4：某分站SVN信息泄漏（包含多个DB连接密码）

相关厂商：TCL官方网上商城

漏洞作者： Eoh

提交时间：2014-09-29 11:50

修复时间：2014-11-13 11:54

公开时间：2014-11-13 11:54

漏洞类型：系统/服务运维配置不当

危害等级：高

自评Rank：15

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2014-09-29： 细节已通知厂商并且等待厂商处理中
2014-09-29： 厂商已经确认，细节仅向厂商公开
2014-10-09： 细节向核心白帽子及相关领域专家公开
2014-10-19： 细节向普通白帽子公开
2014-10-29： 细节向实习白帽子公开
2014-11-13： 细节向公众公开

简要描述：

详细说明：

整站源代码可查看，漫游内网就留给年轻人吧。

漏洞证明：

http://voice.tcl.com/.svn/entries
.bowerrc
package.json
phpdoc.php
bower.json
<dir> api/
<dir> protected/
index-dev.php
Gruntfile.js
.htaccess
README.md
...


const.php
<?php
define("LIB_ASSETS_VERSION", "1.7.3");
define("MOBILE_ASSETS_VERSION", "8db87140bb12cfa1a524");
define("GAME_ASSETS_VERSION", "f0eb69319f6f92242342");
define("HEADLINE_ASSETS_VERSION", "623fb12ed50767ff7833");
define("MAIN_ASSETS_VERSION", "8f5c1ab1f112ccda57b0");
//define('UC_CONNECT', '');
//define('UC_DBHOST', '10.4.22.74');
//define('UC_DBUSER', 'testadmin');
//define('UC_DBPW', '12345678');
//define('UC_DBNAME', 't-fans-test');
//define('UC_DBCHARSET', 'utf8');
//define('UC_DBTABLEPRE', '`t-fans-test`.pre_ucenter_');
//define('UC_DBCONNECT', '0');
//define('UC_KEY', '111111');
//define('UC_API', 'http://www.t-fans.net/uc_server');
//define('UC_CHARSET', 'utf-8');
//define('UC_IP', '');
//define('UC_APPID', '4');
//define('UC_PPP', '20');
//define('UC_CONNECT', '');
//define('UC_DBHOST', 'localhost');
//define('UC_DBUSER', 'root');
//define('UC_DBPW', 'root');
//define('UC_DBNAME', 'ultrax');
//define('UC_DBCHARSET', 'utf8');
//define('UC_DBTABLEPRE', '`ultrax`.pre_ucenter_');
//define('UC_DBCONNECT', '0');
//define('UC_KEY', 'FrDqZWQvLwiuBlQo');
//define('UC_API', 'http://192.168.1.110/dz/uc_server');
//define('UC_CHARSET', 'utf-8');
//define('UC_IP', '');
//define('UC_APPID', '2');
//define('UC_PPP', '20');
//ONLINE
define('UC_CONNECT', '');
define('UC_DBHOST', '10.4.22.74');
define('UC_DBUSER', 'tfans_admin');
define('UC_DBPW', 'kuyu@123@adsl');
define('UC_DBNAME', 't-fans');
define('UC_DBCHARSET', 'utf8');
define('UC_DBTABLEPRE', '`t-fans`.pre_ucenter_');
define('UC_DBCONNECT', '0');
define('UC_KEY', 'FrDqZWQvLwiuBlQo');
define('UC_API', 'http://fans.tcl.com/uc_server');
define('UC_CHARSET', 'utf-8');
define('UC_IP', '');
define('UC_APPID', '3');
define('UC_PPP', '20');


main.php
<?php
require(dirname(__FILE__) . DIRECTORY_SEPARATOR . 'const.php');
return array(
	'basePath' => dirname(__FILE__) . DIRECTORY_SEPARATOR . '..',
	'name' => '娱乐TV+ 中国好声音',
	'timeZone' => 'Asia/Chongqing',
	'language' => 'zh_cn',
	'preload' => array('log'),
	'import' => array(
		'application.models.*',
		'application.components.*',
		'application.helpers.*',
		'application.services.*',
		'zii.behaviors.CTimestampBehavior'
	),
	'modules' => array(
		'mobile' => array(
			'defaultController' => 'site'
		),
		'headline' => array(
			'defaultController' => 'site'
		),
		'wish' => array(
			'defaultController' => 'site'
		),
		'admin',
		'api'
	),
	'components' => array(
		'cache' => array(
			'class'=>'CMemCache',
			'servers'=>array(
				array(
					'host' => '10.131.188.78',
					'port' => 11211,
					'weight' => 100,
				),
			),
		),
		'session' => array (
				'class'=> 'CCacheHttpSession',
				'cookieMode' => 'only',
				'timeout' => 3600*2
		),
		'db' => array(
			'connectionString' => 'mysql:host=10.131.188.78;dbname=voice',
			'emulatePrepare' => true,
			'username' => 'voice',
			'password' => 'FrDqZWQvLwiuBlQo',
			'charset' => 'utf8',
			'tablePrefix' => 'voice_'
		),
		'errorHandler' => array(
			'errorAction' => 'site/error',
		),
		'urlManager' => array(
			'class' => 'UrlManager',
			'urlFormat' => 'path',
			'showScriptName' => false,
			'matchValue' => true,
			'rules' => array(
				'/' => 'site/index',
				'/home' => 'site/want',
				'm' => 'mobile/site/index',
				'm/<controller:\w+>' => 'mobile/<controller>/index',
				'm/<controller:\w+>/<action:\w+>' => 'mobile/<controller>/<action>'
			)
		),
		'log' => array(
			'class' => 'CLogRouter',
			'routes' => array(
				array(
					'class' => 'CDbLogRoute',
					'levels' => join(', ', array(CLogger::LEVEL_ERROR, CLogger::LEVEL_WARNING)),
					'connectionID' => 'db',
					'filter' => 'CLogFilter',
					'autoCreateLogTable' => true,
					'logTableName' => 'voice_log'
				)
			),
		),
		'request' => array(
			'class' => 'Request'
		),
		'user' => array(
			'class' => 'WebUser',
			'allowAutoLogin' => true,
			'stateKeyPrefix'=> 'tuan_site',
			'returnUrl' => array('site/index'),
			'loginUrl' => array('user/login')
		)
	),
	'params' => array(
		'version' => '20140928',
		'keywords' => '',
		'description' => '',
		'defaultAvatar' => '',
		'changeMobile' => array(
			'' => 'm',
			'#star' => '/m/constellation',
			'#guess' => 'm/team',
			'#guess' => 'm/guess',
			'#poem' => 'm/poetry',
			'#draw' => 'm/draw',
			'dream/index' => 'm/dream/index',
			'dream' => 'm/dream',
			'user/index' => 'm/user/index',
			'user' => 'm/user',
		),
		'LINK_URL' => 'http://voice.tcl.com/site/redirect?url=http://shop.tcl.com',
		'CURRENT_RO' => '16',
		'QINIU'=>array(
			'AK'=>'5eKzSGsXWY3A6-nN5lSg5a-v2UIHcucs4WB4SRlJ',
			'SK'=>'3bT2RhA2LQ_xO61kNYbczJLe_6HVC9fgsazFE_2G',
			'BUCKET'=>'vassets'
		),
		'SCHOOL_VOTE'=>'2014-09-18 23:59:59'
	)
);


development.php
<?php
return CMap::mergeArray(require(dirname(__FILE__) . '/main.php'),
	array(
			'components' => array(
					'cache' => null,
					'log' => null,
			),
	),
	array(
		'modules' => array(
			'gii' => array(
				'class' => 'system.gii.GiiModule',
				'password' => '111111',
				'ipFilters' => array(
					'127.0.0.1',
					'::1'
				)
			)
		),
		'components' => array(
			'db' => array(
				'connectionString' => 'mysql:host=192.168.1.10;dbname=voice',
				'username' => 'root',
				'password' => '111111',
				'enableProfiling' => true,
				'enableParamLogging' => true,
				'tablePrefix'=>'voice_'
			),
			'cache' => array(
				'class'=>'CFileCache',
				/*'servers'=>array(
					array(
							'host' => '192.168.1.10',
							'port' => 11211,
							'weight' => 100,
					),
				),*/
			),
			'log' => array(
				'class' => 'CLogRouter',
				'routes' => array(
					array(
						'class' => 'CFileLogRoute',
						'filter' => 'CLogFilter',
						'levels' => join(', ', array(CLogger::LEVEL_ERROR, CLogger::LEVEL_WARNING, CLogger::LEVEL_INFO)),
					),
				)
			)
		)
	));


console.php
<?php
// This is the configuration for yiic console application.
// Any writable CConsoleApplication properties can be configured here.
return array(
	'basePath' => dirname(__FILE__) . DIRECTORY_SEPARATOR . '..',
	'name' => 'My Console Application',
	// preloading 'log' component
	'preload' => array('log'),
	'import' => array(
		'application.models.*',
		'application.components.*',
		'application.services.*'
	),
	// application components
	'components' => array(
		'db' => array(
			'connectionString' => 'mysql:host=localhost;dbname=voice',
			'emulatePrepare' => true,
			'username' => 'voice',
			'password' => 'FrDqZWQvLwiuBlQo',
			'charset' => 'utf8',
			'tablePrefix' => 'voice_'
		),
		/*'db' => array(
			'connectionString' => 'mysql:host=192.168.1.10;dbname=voice',
			'emulatePrepare' => true,
			'username' => 'root',
			'password' => '111111',
			'charset' => 'utf8',
			'tablePrefix' => 'voice_'
		),*/
		'log' => array(
			'class' => 'CLogRouter',
			'routes' => array(
				array(
					'class' => 'CFileLogRoute',
					'levels' => 'error, warning',
				),
			),
		),
		'cache' => array(
			'class' => 'CMemCache',
			'servers' => array(
				array(
					'host' => '10.131.188.78',
					'port' => 11211,
					'weight' => 100,
				),
			),
		),
	),
);

修复方案：

删除.svn目录

版权声明：转载请注明来源 Eoh@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2014-09-29 12:27

厂商回复：

感谢

最新状态：

暂无