当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0132673

漏洞标题:蜗牛游戏某站SQL注入(ROOT权限)

相关厂商:蜗牛

漏洞作者: M4sk

提交时间:2015-08-08 23:10

修复时间:2015-09-24 11:08

公开时间:2015-09-24 11:08

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-08: 细节已通知厂商并且等待厂商处理中
2015-08-10: 厂商已经确认,细节仅向厂商公开
2015-08-20: 细节向核心白帽子及相关领域专家公开
2015-08-30: 细节向普通白帽子公开
2015-09-09: 细节向实习白帽子公开
2015-09-24: 细节向公众公开

简要描述:

RT

详细说明:

http://gwact.woniu.com/gather/index/gatherSumNumber?act_id=3

Target: 		http://gwact.woniu.com/gather/index/gatherSumNumber?act_id=3
Host IP: 114.80.170.132
Web Server: nginx
DB Server: MySQL error based
Resp. Time(avg): 57 ms
Current User: gwact_ci@192.168.95.119
Sql Version: 5.5.15-log
Current DB: gwact_ci
System User: gwact_ci@192.168.95.119
Host Name: SH-GWACT-MA
Installation dir: /mysql
DB User & Pass: root:*DCED6732FDC63892A3491E671543C3FF88CFE9DE:localhost
gwact_ci:*F95A83A60A75FACAB5921EF01C4B991D8205FA00:%
Data Bases: information_schema
captcha
go
gwact_ci
gwactv2
kaleido
ldabbs
lsm


5jq_h120615_blesswall	
5jq_h140702_account_info
5jq_h140702_gift_log
5jq_h140702_log
5jq_h140702_push_account
5jq_h140702_push_account_update
5jq_h141103_answer
5jq_h141103_option
5jq_h141103_question
9yang_h140729_operation
9yang_h150309_jieyi
9yang_h150309_operation
9yang_h150309_signup
9yang_h150323_info
9yang_h150323_lottery_log
9yang_h150526_bang_push
9yang_h150526_win_push
9yang_h150803_act_config
9yang_h150803_reg
9yangsy_h150402_code_log
9yangsy_h150422_account
9yangsy_h150422_log
9yin_111119_vote
9yin_111221_online_apply
9yin_111224_answers
9yin_111224_questions
9yin_111224_questions_copy
9yin_111230_award
9yin_111230_award_disable
9yin_111230_award_test
9yin_111230_award_white_list
9yin_111230_logs
9yin_111230_passport
9yin_111230_token
9yin_120104_questions
9yin_120108_lucky_draw
9yin_120428_trail
9yin_120605_CJ
9yin_120605_cjdata
9yin_120626_codes
9yin_120716_sign
9yin_120716_sign_copy
9yin_121017_award
9yin_121017_award_type
9yin_h120112_distributor
9yin_h120112_province
9yin_h120117_form
9yin_h120131_jhm
9yin_h120131_jhm_data
9yin_h120203_lts_group
9yin_h120203_lts_user
9yin_h120209_log
9yin_h120228_lts_log
9yin_h120228_lts_reg
9yin_h120309_questionnaire
9yin_h120309_questionnaire_log
9yin_h120309_questionnaire_type
9yin_h120327_answer
9yin_h120327_awards
9yin_h120327_cardno
9yin_h120327_exam
9yin_h120327_logs
9yin_h120327_logs_old
9yin_h120327_participate
9yin_h120327_userinfo
9yin_h120327_vistis
9yin_h120327_win
9yin_h120328_answer
9yin_h120328_cardno
9yin_h120328_exam
9yin_h120328_inline
9yin_h120328_logs
9yin_h120328_topic
9yin_h120328_win
9yin_h120511_award
9yin_h120511_award_disable
9yin_h120511_client
9yin_h120511_ip
9yin_h120511_logs
9yin_h120516_award
9yin_h120516_award_disable
9yin_h120516_ext_userinfo
9yin_h120516_logs
9yin_h120516_relaction
9yin_h120516_stat
9yin_h120516_userinfo
9yin_h120530_award
9yin_h120530_award_data
9yin_h120530_logs
9yin_h120530_user
9yin_h120619_cardno
9yin_h120619_logs
9yin_h120619_user
9yin_h120626_collections
9yin_h120628_logs
9yin_h120628_toserver
9yin_h120811_logs
9yin_h120811_role_recover
9yin_h121229_award_data
9yin_h121229_award_data_bak
9yin_h130726_returned_user
9yin_h130727_lottery_log
9yin_h130727_prize_code
9yin_h131115_code
9yin_h131115_code_log
9yin_h131115_server
9yin_h131115_super
9yin_h131205_code
9yin_h131205_code_log
9yin_h131209_award
9yin_h131209_draw_log
9yin_h131209_repost_log
9yin_h131209_user
9yin_h131209_vip_user
9yin_h131210_award_log
9yin_h131210_jifei_log
9yin_h131210_old_user
9yin_h131210_region
9yin_h131210_server
9yin_h131218_code
9yin_h131224_comment
9yin_h140109_user
9yin_h140408_vote
9yin_h140425_cdkey
9yin_h140425_cdkey_bak
9yin_h140512_sdo
9yin_h140512_sdo_2
9yin_h140522_log
9yin_h140522_lottery
9yin_h140522_lottery_log
9yin_h140522_lottery_prize
9yin_h140523_guid
9yin_h140523_jian
9yin_h140530_code
9yin_h140530_code_log
9yin_h140606_blessings
9yin_h140707_admin
9yin_h140707_gameserver
9yin_h140707_guid
9yin_h140718_88_society
9yin_h140721_admin
9yin_h140721_guid
9yin_h140722_88_8_account_info
9yin_h140722_88_8_gift_log
9yin_h140722_88_8_push
9yin_h140723_log
9yin_h140723_lottery
9yin_h140723_lottery_log
9yin_h140723_lottery_prize
9yin_h140827_account_info
9yin_h140827_cdkey
9yin_h140827_every_day_num
9yin_h140827_lottery_log
9yin_h140827_push
9yin_h140828_account_info
9yin_h140828_gift_log
9yin_h140828_push
9yin_h140922_log
9yin_h140922_lottery
9yin_h140922_lottery_log
9yin_h140922_lottery_prize
9yin_h140923_code
9yin_h141117_turn_server
9yin_h141124_beauty
9yin_h141125_account
9yin_h141125_lottery_log
9yin_h141201_meet
9yin_h141204_account
9yin_h141204_lottery_log
9yin_h141209_info
9yin_h141209_log
9yin_h141211_code
9yin_h141215_log_move
9yin_h141215_log_pc
9yin_h141217_account_info
9yin_h141217_gift_log
9yin_h141217_push
9yin_h141229_admin
9yin_h141229_gameserver
9yin_h141229_user
9yin_h150112_info
9yin_h150113_account
9yin_h150113_pro
9yin_h150202_user
9yin_h150203_data
9yin_h150203_log
9yin_h150409_code
9yin_h150427_obox
9yin_h150519_info
9yin_h150519_log
9yin_h150519_lottery
9yin_h150519_lottery_log
9yin_h150519_lottery_prize
9yin_h150525_log
9yin_h150525_old
9yin_h150525_online
9yin_h150525_signin
9yin_h150527_info
9yin_h150527_log
9yin_h150527_share
9yin_h150529_code
9yin_h150619_info
9yin_h150727_account_info
9yin_h150727_gift_log
9yin_h150727_push
9yin_h150728_code
9yin_h150728_push
9yin_h150804_info
9yin_h150804_server
9yin_hd_type
9yin_sms_down
9yin_sms_ok
9yin_sms_up id dest mobile cmd time link_id
9yin_user id username password createtime state
9yinsy_h150313_preorder
9yinsy_h150331_code_log
9yinsy_h150521_lottery_prize
9yinsy_h150521_lottery_prize_pool
9yinsy_h150521_prize_log
9yinsy_h150521_sso
9yinsy_h150626_code_log
9yinsy_h150714_cdkey
9yinsy_h150714_info
9yinsy_h150714_log
9yinsy_h150727_code
9yinsy_h150731_mobile
9yinsy_h150804_prize_log
Auth_allow
Auth_app
Auth_category
Auth_config id gameid action_name table_name search_field view_field createdate admin export_excel sort_field range_field vague_field updatedate page_num index_address
Auth_log id createtime action_name ip operater op_uid
Auth_menus
Auth_sql
Auth_sql_act
Auth_sql_enabled_user
Auth_users id username realname password permissions lastip lasttime admin isuse createdate
act_activity
act_lottery_prize
act_weixin_openid
action_h120920_dgserver
action_h120920_jlj
active_download_admin
all_lottery_prize
api_upsms_log
api_weibo_config id client_id client_secret repostId type game_id activity_id
award_10
award_5
captcha_DEFAULT
captcha_config
captcha_info
captcha_script_rule
captcha_users id userAccount displayName is_admin last_time last_ip
captcha_verify
captcha_visit
captcha_white_list
collect_3
collect_4
collect_8
collect_img_3
collect_pub_3
collect_pub_4
collect_pub_8
cos_h150120_pro
cos_h150120_user
ddp_h140724_preorder
dg_120620_transfer_log
dg_h140116_gift
dg_h140116_gift_log
dg_h140116_recall_user
dg_h140116_return_user
dg_h140516_gift
dg_h140516_gift_log
dg_h140516_old_user
dg_h150507_gift
dg_h150507_gift_log
dg_h150507_recall_user
dg_h150507_return_user
dhh_h130710_active_log
dhh_h130710_captcha_log
dsg_h130314_activecode
dsg_h141211_preorder
dsg_h141211_preorder_update
dsg_h150108_account
dsg_h150112_mobile
dsg_h150407_operation
dsg_h150416_code_log
dsg_h150417_preorder
dsg_h150615_exchange_log
dsg_h150615_point
dsg_h150615_prize
dsg_h150615_signin
dsg_h150616_quiz
dsg_h150616_vote
dsg_h150708_wish
dsg_h150708_zan
dsg_h150721_preorder
gather_act
gather_log
guild
guild_activity
guild_admin_log
guild_game_list
guild_member id user_id guild_id game_id status create_at update_at
guild_user_info
h130603_admin id username realname
help_ipaddress
help_ipaddress_sz
help_region
hero_111212_jhm
hj_h130520_actived
hj_h130520_actived_1ce
hj_h130520_actived_copy
hj_h130520_temp
hj_h130704_gh_list
hj_h130729_code
hj_h130729_code_test
hj_h130729_log
hj_h130729_pool_test
hj_h130820_apply
hj_h130820_code
hj_h130820_preorder
hj_h130922_admin
hj_h130922_comment
hj_h130922_video
hj_h131011_actived
hj_h131011_code_type
hj_h131011_gift_log
hj_h131011_gifts
hj_h131011_old_user
hj_h131031_order_log
hj_h131129_log
hj_h131203_lottery_log
hj_h131203_prize
hj_h131203_user
hj_h131203_userInfo
hj_h131203_userLottery
hj_h131205_batch
hj_h131205_config
hj_h131205_gift
hj_h131205_log
hj_h131205_old_user
hj_h131205_super
hj_h131210_exchange
hj_h131210_user
hj_h131211_gonghui
hj_h131211_tequancount
hj_h131211_wangba
hj_h131230_click
hj_h131230_join
hj_h140122_exchange
hj_h140122_user
hj_h140207_code
hj_h140207_user
hj_h140207_vote_log
hj_h140213_log
hj_h140214_lottery_log
hj_h140214_prize
hj_h140214_user
hj_h140214_userInfo
hj_h140214_vote
hj_h140303_code
hj_h140303_log
hj_h140303_user
hj_h140304_user
hj_h140304_vote_log
hj_h140305_answer
hj_h140305_code
hj_h140305_gift
hj_h140305_log
hj_h140305_option
hj_h140305_question
hj_h140306_log
hj_h140306_process_log
hj_h140306_tg_user
hj_h140306_unmatch_user
hj_h140306_zb
hj_h140307_award
hj_h140307_fake_log
hj_h140307_log
hj_h140307_user
hj_h140308_code
hj_h140308_log
hj_h140308_user
hj_h140308_vote_log
hj_h140311_lottery_log
hj_h140311_prize
hj_h140311_user
hj_h140311_userInfo
hj_h140311_xinshouka
hj_h140313_gh_createby
hj_h140313_gh_info
hj_h140313_gh_user
hj_h140317_log
hj_h140317_vip_user
hj_h140319_lottery_log
hj_h140319_prize
hj_h140319_user
hj_h140319_userInfo
hj_h140327_lottery_log
hj_h140327_prize
hj_h140327_user
hj_h140327_userInfo
jwl_games
jwl_keyword
lz_h130730_active_log
lz_h130730_captcha_log
lz_h130730_dc_log
lz_h130730_sms_log
lz_h130823_apply_log
mianka_comment
mianka_comment_hits_log
mianka_level
mianka_news
mianka_users id vote_id user_name mobilephone ip created
mianka_vote
mianka_vote_detail
mj_h130909_apply
mm_h130604_login_log
mm_h130909_login_log
mm_h130909_question
mm_h130913_winners
mm_h131203_code
mm_h131203_code_list
mm_h131203_logs
mm_h131203_lottery
mm_h131213_actived
mm_h131213_gift_logs
mm_h131213_gift_type
panda2_h150520_preorder
pd2_h150715_preorder
pd_h140512_preorder
pd_h140529_active
pd_h140618_vote
pd_h140904_log
pd_h140904_user id account total used hash clicked ip
pd_h140910_preorder
pd_h140915_account_info
pd_h140915_log
pd_h140915_request_time
pd_h140919_admin
pd_h140919_log
pd_h140919_server
pd_h141010_account_info
pd_h141010_card
pd_h141012_user_info
pd_h141024V1_account_info
pd_h141024V1_account_number
pd_h141024V2_info
pd_h141024_log
pd_h141030_account
pd_h141030_log
pd_h141030_push
pd_h141103_account
pd_h141105_video
pd_h141125_log
pd_h141219_account
pd_h141219_act_share
pd_h141219_goddess
pd_h141219_lottery_log
pd_h141219_lucky_limit_log
pd_h141219_lucky_log
pd_h141219_userinfo
pd_h141219_vote_user
pd_h150121_account
pd_h150121_code1
pd_h150121_code2
pd_h150121_code3
pd_h150121_code4
pd_h150121_code5
pd_h150121_lucky_log
pd_h150121_share
pd_h150203_lanan
pd_h150323_account_info
pd_h150323_account_number
pd_h150323_code
pd_h150323_ip
pd_h150324_account
pd_h150324_code_100
pd_h150324_code_200
pd_h150324_code_400
pd_h150324_code_50
pd_h150324_log
pd_h150429_code
pd_h150603_act
pd_h150603_code
pd_h150603_log
pd_h150603_prize
pd_h150603_ticket
pt_active_analytics
pt_active_log
pt_config
pt_download_url
pt_form
pt_form_record
pt_game_login_log
pt_platform_diff_project
pt_reuse_code
pt_reuse_code_log
pt_sms_captcha_check_log
pt_sms_captcha_log
pt_sso_goto
pt_sso_goto_admin id username realname
pt_tables
pub_account_aid_10
pub_account_aid_11
pub_account_aid_12
pub_account_aid_15
pub_account_aid_3
pub_account_aid_4
pub_account_aid_5
pub_server_3
pub_server_5
pub_user_invite_10
public_city
public_family_names
public_province
qe_h120621_userinfo_copy
qe_h120724_pic
qe_h130916_lottery_count
qe_h130916_lottery_log
qe_h130916_prize
qe_h130916_sign_log
regression2_invite_10
regression2_new_10
regression2_sort_10
regression_invite_5
regression_sort_5
rxtz_h141219_preorder
rxtz_h150506_accept
rxtz_h150506_invite
rxtz_h150506_signin
rxtz_h150521_list
rxtz_h150521_topic
rxtz_h150617_preorder
safetyMonth
safetyMonth_log
safetyMonth_phone
savetyMonth_mobilecode
savetyMonth_nonjhm
savetymonth_time
slbl2_h150618_account_info
snail_120601_info
software_download_times
spring_festival_award_11
spring_festival_award_12
spring_festival_award_15
spring_festival_consume_sort_11
spring_festival_consume_sort_12
spring_festival_consume_sort_15
spring_festival_entity_11
spring_festival_entity_12
spring_festival_entity_15
spring_festival_titbit_11
spring_festival_titbit_12
spring_festival_titbit_15
ss_h150305_info
ss_h150323_answer
ss_h150323_option
ss_h150323_question
ss_h150327_answer
ss_h150327_option
ss_h150327_question
ss_h150430_code_log
ss_h150612_act_config
ss_h150612_preorder
star_120710_card
star_120710_ip_log
star_120710_star_info
star_h120710_transmit
sys_auth_menus
sys_ip_limit
sys_manager
sys_manager_role
sys_model
sys_operation_log
sys_role
sys_role_model
sys_sql
sql_id
act_id
sql_type
act_desc
sql_temp
tb_crash_back
tb_crash_back_130409
tb_crash_back_20121012
test
tt
tz_120627_old_player
tz_120627_receive_log
tz_h120627_logs
tz_h140409_code
tz_h140409_log
tz_h140409_user
utf_idiom
vc_111025_joinserverlist
vc_111025_saveinfo
vc_130318_joinserverlist
vc_130318_saveinfo
vc_150702_joinserverlist
vc_150702_saveinfo
vc_h120509_certificount
vip_120419_award_log
vote_collect_detail_3
vote_collect_stat_3
vote_man_detail_3
vote_man_stat_3
woniu_h150312_info
woniu_h150325_vote
xian_h140623_admin
xian_h140623_user
xian_h140623_video
xian_h140623_vote
xzcb_h141229_info
xzcb_h150128_account
xzcb_h150128_lucky_log
yh_h150602_preorder
yh_h150610_code_log
yyx_h130604_captcha
yyx_h131209
yyx_h131220_code
yyx_h131220_gift
yyx_h131220_log
yyx_h131220_reference
yyx_h131220_relation
yyx_h140106_ccc
yyx_h140106_log
yyx_h140106_rf
yyx_h140211_code
yyx_h140211_msg
yyx_h140415_log
yyx_h140415_lottery
yyx_h140415_lottery_log
yyx_h140415_lottery_prize
yyx_h140415_lottery_send_log
yyx_h140415_weibo
yyx_h140509_game_info
yyx_h140509_get_gift
yyx_h140509_log
yyx_h140514_regiment_info
yyx_h140514_regiment_member
yyx_h140515_activity
yyx_h140515_log
yyx_h140515_push
yyx_h140714_gift_pool
yyx_h140714_jifen_pool
yyx_h140919_account
yyx_h140919_log
yyx_h140919_new_cdkey
yyx_h140919_old_account
yyx_h140919_old_cdkey
zt_h140928_preorder
zt_h150105_reservation
zt_h150106_info
zt_h150313_gift_log
zt_h150313_info
zt_h150313_total
zt_h150402_info
zt_h150402_lottery_log


1.png


漏洞证明:

综上

修复方案:

你会的

版权声明:转载请注明来源 M4sk@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2015-08-10 11:07

厂商回复:

感谢你对游戏蜗牛的支持

最新状态:

暂无


漏洞评价:

评论

  1. 2015-08-12 13:14 | 岩少 ( 普通白帽子 | Rank:586 漏洞数:171 | 破晓团队)

    +666666