漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2015-0115080
漏洞标题：叉叉助手某管理后台SQL注入/源码泄露等安全漏洞
相关厂商：xxzhushou.cn
漏洞作者： mango
提交时间：2015-05-20 10:46
修复时间：2015-05-25 10:48
公开时间：2015-05-25 10:48
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：15
漏洞状态：漏洞已经通知厂商但是厂商忽略漏洞
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2015-05-20： 细节已通知厂商并且等待厂商处理中
2015-05-25： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
叉叉助手某管理后台SQL注入/源码泄露等安全漏洞
详细说明：
漏洞证明：
并且此战还存在.svn泄漏
$DB_CONFIG = array(
'read' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.130',
'user' => 'analytics',
'password' => 'xxanal123&*(',
'port' => 3306,
'dbname' => 'analytics',
'charset' => 'utf8'
)
//多个从库在这里填写
),
'write' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.130',
'user' => 'analytics',
'password' => 'xxanal123&*(',
'port' => 3306,
'dbname' => 'analytics',
'charset' => 'utf8'
)
),
'api_backend' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.131',
'user' => 'testXXDb',
'password' => 'testXXDb123',
'port' => 3306,
'dbname' => 'testXXDb',
'charset' => 'utf8'
)
),
'api_feedback' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.130',
'user' => 'api_flamingo',
'password' => 'lad9Ad9@3^ladk*A',
'port' => 3306,
'dbname' => 'XXFeedBack',
'charset' => 'utf8'
)
),
'analyticsUser' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.130',
'user' => 'analytics',
'password' => 'xxanal123&*(',
'port' => 3306,
'dbname' => 'XXUser',
'charset' => 'utf8'
)
),
'statistics' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.131',
'user' => 'xxstatistics',
'password' => 'xxst123789',
'port' => 3306,
'dbname' => 'XXStatistics',
'charset' => 'utf8'
)
),
'package' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.131',
'user' => 'xxstatistics',
'password' => 'xxst123789',
'port' => 3306,
'dbname' => 'package',
'charset' => 'utf8'
)
),
'eventlog' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.131',
'user' => 'xxstatistics',
'password' => 'xxst123789',
'port' => 3306,
'dbname' => 'eventlog',
'charset' => 'utf8',
'persistency' => true
)
),
'bbs' => array(
array('dbms' => 'mysql',
'host' => '192.168.1.131',
'user' => 'xxbbs',
'password' => 'xxBbs789!3',
'port' => 3306,
'dbname' => 'XXBbs',
'charset' => 'utf8',
)
),
'testUserWrite' => array(
array('dbms' => 'mysql',
'host' => 'localhost',
'user' => 'testXXUser',
'password' => 'testXXUser123',
'port' => 3306,
'dbname' => 'testXXUser',
'charset' => 'utf8'
),
),
'testGuopan' => array(
array('dbms' => 'mysql',
'host' => 'localhost',
'user' => 'testGuopan',
'password' => 'testGp123@',
'port' => 3306,
'dbname' => 'testGuopan',
'charset' => 'utf8'
),
),
//更多数据库在这里填写
);
/////////////////////////////////////////////////////////////////////
//缓存配置, use_config 为0表示使用第一项配置,为1表示使用第2项
$CACHE_CONFIG = array(
'use_config' => 'memcache' ,
'memcache' =>
array('type' => 'memcache',
'server' => array(
// array('host' =>'server1', 'port' => '11211', 'weight' => '10'),
array('host' =>'192.168.1.130', 'port' => '11211', 'weight' => '10')
),
'ttl' => 7200,
'compress' => false,
),
'file' =>
array('type' => 'file',
'cache_dir'=> SYSDIR_CACHE . '/tmp/',
'ttl' => 600,
)
);
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////
//SESSION配置, use_config 为0表示使用第一项配置,为1表示使用第2项
$SESSION_CONFIG = array(
'use_config' => 'memcache' ,
'memcache' =>
array('type' => 'memcache',
'save_path' => 'tcp://192.168.1.130:11210',
'cache_expire' => 7200, //minutes
),
'files' =>
array('type' => 'files',
'save_path' => SYSDIR_CACHE . '/sessions/',
'cache_expire' => 180, //minutes
)
);
/////////////////////////////////////////////////////////////////////
//REDIS配置 主要用于统计类的集合
$REDIS_CONFIG = array(
'write' => array(
array(
'host' => '192.168.1.131',
'port' => '6379',
'password' => '',
),
),
'read' => array(
array(
'host' => '192.168.1.131',
'port' => '6379',
'password' => '',
),
),
'api' => array(
array(
'host' => '192.168.1.132',
'port' => '6379',
'password' => '',
),
),
'testUser' => array(
array(
'host' => '192.168.1.131',
'port' => '6379',
'password' => '',
),
),
'user' => array(
array(
'host' => '192.168.1.130',
'port' => '6379',
'password' => '',
),
),
'testDm_level' => array(
array(
'host' => '192.168.1.131',
'port' => '6379',
'dbN' => 1,
'password' => '',
),
),
);
?>
修复方案：
版权声明：转载请注明来源 mango@乌云
漏洞回应
厂商回应：
危害等级：无影响厂商忽略
忽略时间：2015-05-25 10:48
厂商回复：
漏洞Rank：4 (WooYun评价)
最新状态：
暂无