当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-081793

漏洞标题:多玩YY站点SQL注入

相关厂商:广州多玩

漏洞作者: 宝宝

提交时间:2014-11-03 09:51

修复时间:2014-12-18 09:52

公开时间:2014-12-18 09:52

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-11-03: 细节已通知厂商并且等待厂商处理中
2014-11-05: 厂商已经确认,细节仅向厂商公开
2014-11-15: 细节向核心白帽子及相关领域专家公开
2014-11-25: 细节向普通白帽子公开
2014-12-05: 细节向实习白帽子公开
2014-12-18: 细节向公众公开

简要描述:

多玩YY站点SQL注入脱裤,求礼物!

详细说明:

YY直播站点:http://yy.tv/
注入点:http://yy.tv/index.php?m=Video&do=gameProfileList&gid=7

1.jpg


2.jpg


db_live有420个表

Database: db_live
[420 tables]
+------------------------------------+
| batch_deduct_user_bean |
| channel_notice! |
| channel_recommended_live |
| channel_support_\?84ctivity_apply |
| channel_unsign_request |
| daily_config_init |
| act_account_bind |
| act_aion_account |
| act_anti_korea_sign |
| act_blackgold_code |
| act_blackgold_lock |
| act_blackgold_recharge_log |
| act_blackgold_sdk |
| act_blood_meng_banker_rank |
| act_blood_meng_rank |
| act_card_package |
| act_card_prjze |
| act_cjshowgirl |
| act_commission_commit |
| act_commission_record |
| act_commission_request |
| act_config_info |
| act_cs_account |
| act_cs_prize |
| act_cs_winner_info |
| act_dopa_vote |
| act_dota2league_sign |
| act_dream_ticket_result |
| act_dreamticket_lottery_prize |
| act_dreamticket_lottery_user |
| act_dreamticket_rank |
| act_giftmoney_user |
| act_giftmqney_payer |
| act_guildwars |
| act_headline_history |
| act_heartstone_channel |
| act_heartstone_user |
| act_jianghu_account |
| act_jianghu_code |
| act_jianghu_log |
| act_jianghu_recharge_log |
| act_lolbox_lottery_lock |
| act_lolbox_lottery_log_1 |
| act_lolbox_lottery_log_2 |
| act_lolbox_lottery_log_3 |
| act_lolbox_lottery_log_4 |
| act_lolbox_lottery_log_5 |
| act_lolbox_prize |
| act_lolboxguofu_rank |
| act_lolboxguofu_user |
| act_lottery_account |
| act_lottery_prize |
| act_lottery_task |
| act_micro_privilege |
| act_netease_code |
| act_netease_code_2 |
| act_netease_lock |
| act_prize_info |
| act_purple_signup |
| act_qiannv_code |
| act_qiannv_code2 |
| act_qiannv_log |
| act_recharge_lock |
| act_recharge_log |
| act_recharge_log_2 |
| act_shumen_bind_lock |
| act_shumen_code |
| act_shumen_lock |
| act_shumen_recharge_log |
| act_treasuremap_give |
| act_whitebean_detail |
| act_whitebean_lottery_num |
| act_whitebean_lottery_prize |
| act_whitebean_lottery_user |
| act_whitebean_total |
| act_worldofwar_code |
| act_worldofwar_gb_log |
| act_wuhun_code |
| act_wuhun_lock |
| act_wuhun_recharge_log |
| activation_code |
| activity_box |
| activity_news |
| activity_preview |
| activity_privilege |
| activity_prop |
| activity_prop_client_common |
| activity_prop_client_identity |
| admin_app |
| admin_app_op |
| admin_app_role |
| admin_app_role_op |
| admin_appprop_client_identity |
| admin_auth_user_role |
| admin_blacklist |
| admin_op_log |
| admin_user |
| alarm_record |
| anchor_badge_reuuest |
| anchor_badge_whitelist |
| app_interface |
| appserver_channel |
| appserver_info |
| backup_act_jianghu_code_20140509 |
| backup_guess_history_record0 |
| backup_guess_history_record1 |
| backup_guess_history_record2 |
| backup_guess_history_record3 |
| backup_guess_history_record_201402 |
| backup_guess_open_detail |
| backup_guess_unit_record |
| backup_init_profile_level_v2 |
| baijin_baoming |
| bao_award_list |
| biaobai_rank |
| biaobai_sum |
| biaobai_word |
| blood_520_user |
| blood_milk_history_list |
| box_hit_detail |
| brief_app_relation |
| brief_apy_detail |
| buy_greenbean_lock |
| buy_greenbebn_error |
| captcha |
| card_operate_detail |
| channel_actiye_record |
| channel_auth_info |
| channel_default_percent |
| channel_group |
| channel_recommended_ad |
| channel_stat |
| channel_unfo_request |
| channel_unfreeze |
| channel_uot_recommended |
| commission_cecord |
| commission_check_result |
| commission_commit |
| commission_riquest |
| compare_income_balance |
| compare_income_balance_resvlt |
| crontab_run_time |
| daily_recorded_check_result |
| daily_recorded_tystem |
| daily_recorded_user_status |
| daily_source_init |
| daily_stat_compare_result |
| daily_stat_init |
| daily_stat_result |
| daily_stat_result_jdva |
| decoration |
| decoration_user_get |
| dingyue_count_info |
| dream_lover_profile |
| dream_lover_profile_user_list |
| dream_lover_profile_user_list_temp |
| dream_lover_user |
| dream_ticket_anchor |
| dream_ticket_anchor_candidate |
| dream_ticket_anchor_fans |
| dream_ticket_black_list |
| dream_ticket_channel |
| dream_ticket_payer |
| dream_ticket_record |
| duowan_user_deposit |
| duowan_yb_order |
| extension_content |
| file_public_record |
| goddess_registration |
| goddess_vote_detail |
| goddess_vote_sum |
| goldbean_discard_detail |
| goldbean_income_detail |
| goldbean_user_balances |
| goldbean_user_debt |
| goldbrean_mortgage |
| greenbean_income_detail |
| greenbean_user_deduct |
| guard_level |
| guard_month_report |
| guard_rank |
| guard_request_detail |
| guess_game_notice |
| guess_game_notice_20140811 |
| guess_greenbean_punish |
| guess_video_info |
| handsel_volume |
| happybean_income_detail |
| happybean_video_info |
| headline_info |
| help_list |
| icenter_live_mult_notice |
| icenter_live_notice |
| icenter_notice |
| icenter_pic |
| icenter_white_link |
| iframe_wonderful_tuijian |
| improve_unfreeze_credit_request |
| init_profile_level_v2 |
| live_best_channel |
| live_best_comment |
| live_best_profile |
| live_news |
| live_notice |
| live_organization |
| live_product |
| live_recommend_channel |
| live_screenshot |
| live_slideshow |
| live_time_info |
| livedata_blackword |
| livedata_detail |
| livedata_guess |
| livedata_is_blackword |
| livedata_item |
| livedata_item_history0 |
| livedata_item_history1 |
| livedata_item_history2 |
| livedata_item_history3 |
| livedata_item_info |
| livedata_item_subchannel_info |
| livedata_item_user0 |
| livedata_item_user1 |
| livedata_item_user2 |
| livedata_item_user3 |
| log_status |
| lu_game_sum |
| lu_record |
| main_activity_info |
| main_countrys |
| main_focus_recommed_live |
| main_focus_slideshow |
| main_games |
| main_games_exes |
| main_games_shownames |
| main_games_type |
| main_match_battle_team_relation |
| main_match_battles |
| main_match_teams |
| main_match_videos |
| main_matchs |
| main_user_games |
| main_user_room |
| medal |
| medal_auto_rule |
| medal_handle_rule |
| medal_user_get |
| medal_user_show |
| medal_user_show2 |
| medal_user_state |
| message_request |
| message_uids |
| mine_gift |
| mine_gift_grant |
| mini_act_info |
| mini_best_channel |
| mini_best_profile |
| mini_contest |
| mini_contest_logo |
| mini_focus_slideshow |
| mini_girlsrecommend |
| minicard_auth_profiler |
| monitor_m |
| monitor_record |
| month_guess_stat_user |
| multi_award_set |
| new_match_info |
| new_match_team |
| new_match_user |
| new_total_buy_greenbean |
| newyear_prop_list_bk |
| nick_user |
| org_program |
| ow_activity |
| ow_activity_profile |
| ow_boke_video_join |
| ow_channel_info |
| ow_detail |
| ow_scout |
| payer_count |
| payshow_daily_stat_result |
| payshow_daily_stat_result_java |
| payshow_detail |
| payshow_rank |
| payshow_user_score |
| platinum_union_info |
| pop_manage |
| pop_request |
| pop_uids |
| pop_wait_aid |
| profile_activity_invite |
| profile_admin_channel |
| profile_admin_game |
| profile_admin_game_bak |
| profile_admin_idcard |
| profile_admin_user |
| profile_admin_user_external_info |
| profile_admin_user_recommend |
| profile_celebrity |
| profile_level_live_on |
| profile_level_v2 |
| profile_private_host |
| profile_prop_count |
| profile_recommend |
| profile_recommend_apply |
| profile_recommend_booking |
| profile_sign |
| profile_unfreeze |
| profile_yss_enter |
| profile_yss_praise_info |
| promotion_content |
| prop_latest_use |
| qaily_checking_resylt |
| rank_fans_prop |
| rank_guess_gain |
| rank_guess_gain_greenbean |
| rank_guess_loss |
| rank_guess_loss_greenbean |
| rank_guess_rate |
| rank_guess_rate_greenbean |
| rank_guess_wealth |
| rank_guess_wealth_greenbean |
| rank_mini_rich |
| rank_mini_rich_today |
| rank_mini_rich_weekly |
| rank_mini_star_today |
| rank_mini_upstart |
| rank_payer_count |
| rank_prop_activity |
| rank_prop_blood |
| rank_top_channel |
| rank_top_profile |
| rank_user_channel_score |
| rank_user_score |
| recharge_rebate |
| rolling_sub_title |
| rolling_sub_title_group |
| rolling_sub_title_job |
| score_add_status |
| score_user_value |
| screenshot |
| sign_invite |
| sign_profile_detail |
| sign_profile_request |
| sign_profile_update_request |
| sign_service_contract |
| so_cloudnode |
| so_commonparam |
| so_config |
| so_message |
| stat_guess_day |
| stat_guess_month |
| stat_payshow_day |
| subscribe_record |
| t1 |
| task_activity_0 |
| task_activity_progress_0 |
| task_item |
| task_newbie_0 |
| task_newbie_1 |
| task_newbie_2 |
| task_newbie_3 |
| task_newbie_4 |
| task_newbie_5 |
| task_newbie_6 |
| task_newbie_7 |
| task_newbie_progress_0 |
| task_newbie_progress_1 |
| task_newbie_progress_2 |
| task_newbie_progress_3 |
| task_newbie_progress_4 |
| task_newbie_progress_5 |
| task_newbie_progress_6 |
| task_newbie_progress_7 |
| task_onlive |
| task_onlive_config |
| task_quota_config |
| task_quota_relation |
| task_user_type |
| task_weekly |
| task_weekly_progress |
| tmp_different_level_profile |
| tmp_prop_detail |
| tmp_table |
| total_buy_greenbean |
| up_file_tocloud_log |
| user_booking_detail |
| user_booking_record |
| user_channel_change_record |
| user_channel_change_record_history |
| user_channel_info |
| user_channel_times |
| user_contract_status |
| user_green_bean |
| user_guess_auth |
| user_guess_auth_greenbean |
| user_guess_complain |
| user_guess_credit |
| user_guess_credit_greenbean |
| user_guess_record |
| user_pop_options |
| user_realname_status |
| user_taillight |
| user_unfreeze_goldbean_request |
| user_unsign_order |
| user_white_bean |
| video_auth |
| view_admin_profile_prop_detail |
| view_appserver_channel |
| view_livedata_item |
| view_match_videos |
| view_profile_detail |
| view_profile_level_detail |
| view_rank_item |
| view_user_guess_auth |
| view_user_guess_auth_greenbean |
| vip_draw |
| vip_gift_bag |
| vip_stat |
| white_list_manager |
+------------------------------------+


另外附送几个类似hadoop集群的监控平台,感觉会暴露不少敏感信息,如果是自己看的话,就限制个IP吧!
http://14.17.109.4:8002/
http://14.17.109.44/ganglia/
http://14.17.108.40:8080/
http://183.60.218.160:8080/index.html

3.jpg


4.jpg

漏洞证明:

1.jpg

修复方案:

这个你们比较在行

版权声明:转载请注明来源 宝宝@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2014-11-05 14:58

厂商回复:

感谢对于欢聚时代安全工作的支持,我们会尽快修复

最新状态:

暂无