当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2012-013725

漏洞标题：j2ee分层架构安全（注册乌云1周年庆祝集锦） -- 联众世界大量敏感信息泄露

相关厂商：联众世界

漏洞作者： shine

提交时间：2012-10-22 18:41

修复时间：2012-12-06 18:42

公开时间：2012-12-06 18:42

漏洞类型：系统/服务运维配置不当

危害等级：中

自评Rank：10

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签： 无

4人收藏 收藏
分享漏洞：

漏洞详情

披露状态：

2012-10-22： 细节已通知厂商并且等待厂商处理中
2012-10-26： 厂商已经确认，细节仅向厂商公开
2012-11-05： 细节向核心白帽子及相关领域专家公开
2012-11-15： 细节向普通白帽子公开
2012-11-25： 细节向实习白帽子公开
2012-12-06： 细节向公众公开

简要描述：

RT!

详细说明：


首先看一个以前典型的case:
   WooYun: 去哪儿任意文件读取（基本可重构该系统原工程） 
  或哥这篇粗糙的文章：
http://hi.baidu.com/shine%5F%C9%C1%C1%E9/blog/item/7d7d57445f523a4384352468.html

漏洞证明：


http://auth.ourgame.com/WEB-INF/web.xml
http://auth.ourgame.com/WEB-INF/classes/data.xml



<?xml version="1.0" encoding="utf-8" ?> 
- <xml-data>
- <url>
  <webhall-ddz>http://ddz.lianzhong.com/default.aspx</webhall-ddz> 
  <webhall-fish>http://fish.lianzhong.com/default.aspx</webhall-fish> 
  <webhall-twomj>http://mj.lianzhong.com/default.aspx</webhall-twomj> 
- <!--  二人麻将，普通接入 
  --> 
  <webhall-mj>http://mj.lianzhong.com/default.aspx</webhall-mj> 
- <!--  二人麻将，通行证接入用 
  --> 
  <webhall-pw>http://pw.lianzhong.com/default.aspx</webhall-pw> 
- <!-- 扑克世界
  --> 
  <webhall-pk>http://pk.lianzhong.com/index.aspx</webhall-pk> 
- <!-- 超级挑战
  --> 
  <webhall-poker>http://poker.lianzhong.com/index.aspx</webhall-poker> 
- <!-- 扑克世界领奖中心
  --> 
  <webhall-pokerworld>http://poker.lianzhong.com/index.aspx</webhall-pokerworld> 
- <!-- 扑克世界领奖中心
  --> 
  <webhall-boc>http://boc.lianzhong.com/Questionnaire.aspx</webhall-boc> 
- <!-- 中国银行活动
  --> 
  <webhall-open>http://open.lianzhong.com/Platform/Index</webhall-open> 
- <!-- 云游戏
  --> 
  <webhall-junqi>http://junqi.lianzhong.com</webhall-junqi> 
- <!--  四国军旗 
  --> 
  <passport-interface>http://account.lianzhong.com/auth!login.do</passport-interface> 
  <webhall-yaoji>http://yaoji.lianzhong.com/Home/Proxy</webhall-yaoji> 
- <!--  姚记 
  --> 
  <webhall-ttmj>http://ttmj.lianzhong.com/Default.aspx</webhall-ttmj> 
  <webhall-gold>http://gold.lianzhong.com/Default.aspx</webhall-gold> 
  </url>
- <time>
  <cross-domain-token>600000</cross-domain-token> 
  <my-domain-login-cookie /> 
  </time>
- <AuthServer>
  <port>22049</port> 
  <cert_lifetime>86400000</cert_lifetime> 
  <shortcert_lifetime>3600000</shortcert_lifetime> 
  <?replace runEnv local test begin <ipauth> 192.168.1.192,172.28.14.98,127.0.0.1,192.168.3.132,192.168.3.133,192.168.3.134,202.108.0.60,192.168.2.41,202.108.0.60,172.28.8.118,211.154.165.84,172.28.19.28,172.28.8.120,172.28.19.78,172.28.19.85,172.28.19.76,172.28.19.233,172.28.14.18,172.28.25.148,192.168.1.132,192.168.1.182,192.168.1.183,202.108.36.113,192.168.1.67,172.28.26.95,192.168.3.72,172.21.29.101,172.28.26.59,172.28.14.56,172.28.8.120,192.168.3.38,192.168.3.39,192.168.3.186,192.168.3.187,192.168.3.188,192.168.3.189,192.168.3.190,192.168.3.191,192.168.3.192,192.168.3.193,192.168.3.194,192.168.3.195,192.168.3.196,192.168.3.197,192.168.3.198,192.168.3.199,172.28.14.176 </ipauth> replace runEnv local test end?> 
  <?replace runEnv alpha test begin <ipauth>192.168.1.192,172.28.14.98,127.0.0.1,192.168.3.132,192.168.3.133,192.168.3.134,192.168.1.203,192.168.1.219,202.108.255.95,202.108.0.60,192.168.2.41,202.108.0.60,172.28.8.118,211.154.165.84,172.28.19.28,172.28.8.120,172.28.19.78,172.28.19.85,172.28.19.76,172.28.19.233,172.28.14.18,172.28.25.148,192.168.1.132,192.168.1.182,192.168.1.183,202.108.36.113,192.168.1.67,172.28.26.95,192.168.3.72,172.21.29.101,172.28.26.59,172.28.14.56,172.28.8.120,192.168.3.38,192.168.3.39,192.168.3.186,192.168.3.187,192.168.3.188,192.168.3.189,192.168.3.190,192.168.3.191,192.168.3.192,192.168.3.193,192.168.3.194,192.168.3.195,192.168.3.196,192.168.3.197,192.168.3.198,192.168.3.199</ipauth> replace runEnv alpha test end?> 
  <?replace runEnv real begin?> 
  <ipauth>192.168.1.192,127.0.0.1,192.168.3.132,192.168.3.133,192.168.3.134,192.168.1.203,192.168.1.219,202.108.255.95,202.108.0.60,192.168.2.41,211.154.165.84,192.168.1.100,192.168.1.99,202.108.255.97,202.108.255.98,192.168.1.132,192.168.1.182,192.168.1.183,202.108.36.113,192.168.1.67,192.168.3.72,192.168.3.38,192.168.3.39,192.168.3.186,192.168.3.187,192.168.3.188,192.168.3.189,192.168.3.190,192.168.3.191,192.168.3.192,192.168.3.193,192.168.3.194,192.168.3.195,192.168.3.196,192.168.3.197,192.168.3.198,192.168.3.199,192.168.1.87,192.168.3.43,192.168.3.44</ipauth> 
  <?replace runEnv real end?> 
- <!-- 
			将flags为该项的数据去DBSERVER取数据，将取回的userFrom字段强制转换成0并填入证书，userFrom与角色表的comeform(渠道号)字段对应
		
  --> 
  <flags_change_to_zero>1,2,3</flags_change_to_zero> 
- <!-- 
			将flags为该项的数据去DBSERVER取数据，将取回的userFrom字段根据输入的账号特征判断是否改写证书，ddz0~-ddz9~开头将证书userFrom强制转换为11，userFrom与角色表的comeform字段对应
		
  --> 
  <flags_notneed_change>0</flags_notneed_change> 
- <!-- 
			将flags为该项的数据强制转换为flags=0，去DBSERVER取数据，将取回的userFrom字段强制转换成0并填入证书，userFrom与角色表的comeform字段对应
		
  --> 
  <flags_change_to_robot>11</flags_change_to_robot> 
- <!-- 
			只需用户名即可去DBSERVER取数据，并将证书的userFrom字段值强制设置为0，userFrom与角色表的comeform字段对应
		
  --> 
  <flags_onlyneed_username>10</flags_onlyneed_username> 
- <!-- 
			将flags为该项的数据取默认证书，并将证书的userFrom字段值设置为该项数据值，userFrom与角色表的comeform字段对应
		
  --> 
  <flags_change_to_default>104,200-499</flags_change_to_default> 
  </AuthServer>
- <OpenId>
- <openid_allowed_domain>
  <url>auth.ourgame.com</url> 
  <url>www.ourgame.com</url> 
  <url>vv.ourgame.com</url> 
  <url>newshop.ourgame.com</url> 
- <!-- 商城
  --> 
  <url>shop2.ourgame.com</url> 
- <!-- 商城
  --> 
  <url>flashgame.ourgame.com</url> 
  <url>subject.ourgame.com</url> 
  <url>ddz.lianzhong.com</url> 
  <url>quan.ourgame.com</url> 
  <url>xx.ourgame.com</url> 
  <url>fish.ourgame.com</url> 
  <url>fish.lianzhong.com</url> 
  <url>id.ourgame.com</url> 
  <url>scenter.ourgame.com</url> 
  <url>gameshow.ourgame.com</url> 
  <url>pay.ourgame.com</url> 
  <url>vip.ourgame.com</url> 
  <url>wndou.ourgame.com</url> 
- <!--  万能豆 
  --> 
  <url>lucky.ourgame.com</url> 
- <!--  万能豆 
  --> 
  <url>luckyin.ourgame.com</url> 
- <!--  万能豆内网 
  --> 
  <url>cs.ourgame.com</url> 
- <!-- 客服  
  --> 
  <url>zyh.ourgame.com</url> 
  <url>flash.ourgame.com</url> 
  <url>www1.ourgame.com</url> 
  <url>2011sj.ourgame.com</url> 
  <url>pay.lianzhong.com</url> 
  <url>shop.ourgame.com</url> 
  <url>home.ourgame.com</url> 
  <url>coin.ourgame.com</url> 
  <url>jingcai.ourgame.com</url> 
  <url>pw.lianzhong.com</url> 
  <url>pk.lianzhong.com</url> 
  <url>tg.ourgame.com</url> 
  <url>yuquan.ourgame.com</url> 
  <url>hb.ourgame.com</url> 
  <url>dou.ourgame.com</url> 
  <url>jc.ourgame.com</url> 
  <url>mj.lianzhong.com</url> 
  <url>icbc.ourgame.com</url> 
  <url>icon.ourgame.com</url> 
  <url>hd.ourgame.com</url> 
  <url>newpay.ourgame.com</url> 
  <url>dlyd.ourgame.com</url> 
  <url>poker.lianzhong.com</url> 
  <url>pokerworld.lianzhong.com</url> 
  <url>account.lianzhong.com</url> 
  <url>boc.lianzhong.com</url> 
  <url>chess.ourgame.com</url> 
  <url>luckychase.ourgame.com</url> 
  <url>open.lianzhong.com</url> 
  <url>zhushou.ourgame.com</url> 
  <url>mj.ourgame.com</url> 
  <url>yn.ourgame.com</url> 
  <url>sd.ourgame.com</url> 
  <url>jn.ourgame.com</url> 
  <url>junqi.lianzhong.com</url> 
  <url>yaoji.lianzhong.com</url> 
- <!-- webGameAllowedUrls 
  --> 
  <url>account.1999game.com</url> 
  <url>www.1999game.com</url> 
  <url>6.ourgame.com</url> 
  <url>9.ourgame.com</url> 
  <url>auth.ourgame.com</url> 
  <url>news.ourgame.com</url> 
  <url>1999game.com</url> 
  <url>ddt.ourgame.com</url> 
  <url>astd.ourgame.com</url> 
  <url>yqcm.ourgame.com</url> 
  <url>qq.ourgame.com</url> 
  <url>x.ourgame.com</url> 
  <url>wlyx.ourgame.com</url> 
  <url>mh.ourgame.com</url> 
  <url>dxy.ourgame.com</url> 
  <url>kingling.ourgame.com</url> 
  <url>newbbs.ourgame.com</url> 
  <url>dlyd2012.ourgame.com</url> 
  <url>fudan.ourgame.com</url> 
  <url>91dq.ourgame.com</url> 
  <url>ttmj.lianzhong.com</url> 
  <url>gold.lianzhong.com</url> 
  <url>ogzq.lianzhong.com</url> 
  <url>ddztv.ourgame.com</url> 
  <url>ogzq.ourgame.com</url> 
  <url>ddz.ourgame.com</url> 
  <url>yc.lianzhong.com</url> 
  <url>bbs.ourgame.com</url> 
  <url>cs.lianzhong.com</url> 
  <url>register.ourgame.com</url> 
  <url>yc.ourgame.com</url> 
  <url>bbs.ourgame.com</url> 
  <url>baohuang.ourgame.com</url> 
  <url>sj.lianzhong.com</url> 
  <url>xq.lianzhong.com</url> 
  </openid_allowed_domain>
  <?replace runEnv local test begin <register_log_url>http://admin-alpha.ourgame.com/id-log-stat/rgst.do </register_log_url> replace runEnv local test end?> 
  <?replace runEnv alpha test begin <register_log_url>http://admin-alpha.ourgame.com/id-log-stat/rgst.do</register_log_url> replace runEnv alpha test end?> 
  <?replace runEnv real begin?> 
  <register_log_url>http://admin-id.ourgame.com/id-log-stat/rgst.do</register_log_url> 
  <?replace runEnv real end?> 
  </OpenId>
- <commSettings>
- <DBSvr>
  <?replace runEnv local test begin <ip>172.28.14.11</ip> <port>6000</port> replace runEnv local test end?> 
  <?replace runEnv local test begin <ip>172.28.14.11</ip> <port>6000</port> replace runEnv local test end?> 
  <?replace runEnv alpha test begin <ip>172.28.14.11</ip> <port>6000</port> replace runEnv alpha test end?> 
  <?replace runEnv beta real begin <ip>192.168.1.17</ip> <port>6000</port> replace runEnv beta real end?> 
  <?replace runEnv real begin?> 
  <ip>192.168.1.17</ip> 
  <port>6000</port> 
  <?replace runEnv real end?> 
  <?replace runEnv local test begin <ip>172.28.14.11</ip> <port>6000</port> replace runEnv local test end?> 
  </DBSvr>
- <!--  ks 服务器 202.108.0.60
  --> 
- <KSSvr>
  <?replace runEnv local test begin <ip>202.108.0.60</ip> <port>22032</port> replace runEnv local test end?> 
  <?replace runEnv alpha test begin <ip>202.108.0.60</ip> <port>22032</port> replace runEnv alpha test end?> 
  <?replace runEnv beta real begin <ip>202.108.0.60</ip> <port>22032</port> replace runEnv beta real end?> 
  <?replace runEnv real begin?> 
  <ip>192.168.1.91</ip> 
  <port>22032</port> 
  <?replace runEnv real end?> 
  </KSSvr>
  </commSettings>
- <webGameAllowedUrls>
  <Url>account.1999game.com</Url> 
  <Url>www.1999game.com</Url> 
  <Url>6.ourgame.com</Url> 
  <Url>9.ourgame.com</Url> 
  <Url>auth.ourgame.com</Url> 
  <Url>news.ourgame.com</Url> 
  <Url>1999game.com</Url> 
  <Url>ddt.ourgame.com</Url> 
  </webGameAllowedUrls>
- <!-- 图游注册地址
  --> 
- <GraphGamePassport>
  <regist-default>http://id.ourgame.com/quickregist.do?g=default</regist-default> 
  <regist-astd>http://id.ourgame.com/quickregist.do?g=astd&project=astd</regist-astd> 
  <regist-ddt>http://id.ourgame.com/quickregist.do?g=ddt&project=DDT</regist-ddt> 
  <regist-yqcm>http://id.ourgame.com/quickregist.do?g=yqcm&project=yqcm</regist-yqcm> 
  <regist-mh>http://id.ourgame.com/regist.do?project=MMOG6015</regist-mh> 
  <regist-qyxc>http://id.ourgame.com/quickregist.do?g=qyxc</regist-qyxc> 
  <regist-ntj>http://id.ourgame.com/quickregist.do?g=ntj&project=NTJ&third_company=ourgame</regist-ntj> 
  <regist-wlyx>http://id.ourgame.com/quickregist.do?g=wlyx&project=MMOG6004</regist-wlyx> 
  <regist-sgchd>http://id.ourgame.com/quickregist.do?g=sgc&project=MMOG6005</regist-sgchd> 
  <regist-dxy>http://id.ourgame.com/quickregist.do?g=dxy&project=dxy</regist-dxy> 
  <regist-ogzq>http://id.ourgame.com/quickregist.do?g=ogzq&project=ogzq</regist-ogzq> 
  </GraphGamePassport>
- <IDJarEnv>
  <?replace runEnv local test begin <key>123</key> replace runEnv local test end?> 
  <?replace runEnv alpha test begin <key>123</key> replace runEnv alpha test end?> 
  <?replace runEnv real begin?> 
  <key>568</key> 
  <?replace runEnv real end?> 
  </IDJarEnv>
- <!-- 绑定有特殊字符的第三方账号，一段时间后可去除，不要修改,并区分大小写  
  --> 
- <unexpected_bindusername>
  <sina>zhke1016</sina> 
  <renren>[email protected]</renren> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <dx>99076377969</dx> 
  <dx>04001088982</dx> 
  <dx>99050780032</dx> 
  <dx>99048859395</dx> 
  <dx>99057767725</dx> 
  <renren>[email protected]</renren> 
  <renren>[email protected]</renren> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  <sina>[email protected]</sina> 
  </unexpected_bindusername>
  </xml-data>


修复方案：

如上！

版权声明：转载请注明来源 shine@乌云

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：3

确认时间：2012-10-26 14:28

厂商回复：

谢谢，已经修复

最新状态：

暂无