乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-05-14： 细节已通知厂商并且等待厂商处理中 2016-05-18： 厂商已经确认，细节仅向厂商公开 2016-05-28： 细节向核心白帽子及相关领域专家公开 2016-06-07： 细节向普通白帽子公开 2016-06-17： 细节向实习白帽子公开 2016-07-02： 细节向公众公开
RT.
不知道能不能首显...这个月打算冲榜的...这货在我的待认领里待好多天了...这次就让他变成待确认好不好撒QAQ同一处参数 不同的网站
http://**.**.**.**/news.php?contentid=2369
http://**.**.**.**/news.php?contentid=2436
http://**.**.**.**/news.php?contentid=2370
http://**.**.**.**/news.php?contentid=2243
available databases [13]:[*] 5ebo[*] 5ebo_bbs[*] 5ebo_oa[*] 5ebo_ucenter[*] 5ebo_www[*] 5ebo_www_test[*] eboedu[*] ebogame[*] ebogame_1[*] information_schema[*] my[*] mysql[*] testDatabase: ebogame[338 tables]+-----------------------------------+| api_send_mail || bbs_actlogs || bbs_apclog || bbs_beg || bbs_bmbcode || bbs_contacts || bbs_emoticons || bbs_favorites || bbs_forumdata || bbs_gueststat || bbs_invite || bbs_lastest || bbs_levels || bbs_onlinestat || bbs_polls || bbs_posts || bbs_potlog || bbs_primsg || bbs_schedule || bbs_search || bbs_shareforum || bbs_tags || bbs_threads || bbs_ugoptlist || bbs_usergroup || bbs_userlist || ebogame_activation || ebogame_advertising || ebogame_advertising_click || ebogame_bbs || ebogame_bbs_section || ebogame_category || ebogame_charge || ebogame_charge_20160118 || ebogame_charge_bf || ebogame_charge_copy || ebogame_charge_heepay || ebogame_content || ebogame_extension || ebogame_extension_member || ebogame_extension_percent || ebogame_extension_settlemen || ebogame_extension_settlemen_once || ebogame_game_areas || ebogame_game_code || ebogame_game_gift_code || ebogame_game_gift_code_ || ebogame_game_gift_code_17173 || ebogame_game_gift_info_ || ebogame_game_gift_info_17173 || ebogame_games || ebogame_integral || ebogame_member || ebogame_member_char || ebogame_member_info || ebogame_member_integral || ebogame_member_login || ebogame_member_price || ebogame_member_serv || ebogame_news || ebogame_pictures || ebogame_price || ebogame_question_reply || ebogame_questions || pre_common_admincp_cmenu || pre_common_admincp_group || pre_common_admincp_member || pre_common_admincp_perm || pre_common_admincp_session || pre_common_admingroup || pre_common_adminnote || pre_common_advertisement || pre_common_advertisement_custom || pre_common_banned || pre_common_block || pre_common_block_favorite || pre_common_block_item || pre_common_block_item_data || pre_common_block_permission || pre_common_block_pic || pre_common_block_style || pre_common_block_xml || pre_common_cache || pre_common_card || pre_common_card_log || pre_common_card_type || pre_common_connect_guest || pre_common_credit_log || pre_common_credit_rule || pre_common_credit_rule_log || pre_common_credit_rule_log_field || pre_common_cron || pre_common_devicetoken || pre_common_district || pre_common_diy_data || pre_common_domain || pre_common_failedlogin || pre_common_friendlink || pre_common_grouppm || pre_common_invite || pre_common_magic || pre_common_magiclog || pre_common_mailcron || pre_common_mailqueue || pre_common_member || pre_common_member_action_log || pre_common_member_connect || pre_common_member_count || pre_common_member_crime || pre_common_member_field_forum || pre_common_member_field_home || pre_common_member_grouppm || pre_common_member_log || pre_common_member_magic || pre_common_member_medal || pre_common_member_profile || pre_common_member_profile_setting || pre_common_member_security || pre_common_member_stat_field || pre_common_member_status || pre_common_member_validate || pre_common_member_verify || pre_common_member_verify_info || pre_common_myapp || pre_common_myinvite || pre_common_mytask || pre_common_nav || pre_common_onlinetime || pre_common_patch || pre_common_plugin || pre_common_pluginvar || pre_common_process || pre_common_regip || pre_common_relatedlink || pre_common_report || pre_common_searchindex || pre_common_secquestion || pre_common_session || pre_common_setting || pre_common_smiley || pre_common_sphinxcounter || pre_common_stat || pre_common_statuser || pre_common_style || pre_common_stylevar || pre_common_syscache || pre_common_tag || pre_common_tagitem || pre_common_task || pre_common_taskvar || pre_common_template || pre_common_template_block || pre_common_template_permission || pre_common_uin_black || pre_common_usergroup || pre_common_usergroup_field || pre_common_word || pre_common_word_type || pre_connect_disktask || pre_connect_feedlog || pre_connect_memberbindlog || pre_connect_postfeedlog || pre_connect_tthreadlog || pre_forum_access || pre_forum_activity || pre_forum_activityapply || pre_forum_announcement || pre_forum_attachment || pre_forum_attachment_0 || pre_forum_attachment_1 || pre_forum_attachment_2 || pre_forum_attachment_3 || pre_forum_attachment_4 || pre_forum_attachment_5 || pre_forum_attachment_6 || pre_forum_attachment_7 || pre_forum_attachment_8 || pre_forum_attachment_9 || pre_forum_attachment_exif || pre_forum_attachment_unused || pre_forum_attachtype || pre_forum_bbcode || pre_forum_collection || pre_forum_collectioncomment || pre_forum_collectionfollow || pre_forum_collectioninvite || pre_forum_collectionrelated || pre_forum_collectionteamworker || pre_forum_collectionthread || pre_forum_creditslog || pre_forum_debate || pre_forum_debatepost || pre_forum_faq || pre_forum_forum || pre_forum_forum_threadtable || pre_forum_forumfield || pre_forum_forumrecommend || pre_forum_groupcreditslog || pre_forum_groupfield || pre_forum_groupinvite || pre_forum_grouplevel || pre_forum_groupuser || pre_forum_imagetype || pre_forum_medal || pre_forum_medallog || pre_forum_memberrecommend || pre_forum_moderator || pre_forum_modwork || pre_forum_onlinelist || pre_forum_order || pre_forum_poll || pre_forum_polloption || pre_forum_pollvoter || pre_forum_post || pre_forum_post_location || pre_forum_post_moderate || pre_forum_post_tableid || pre_forum_postcache || pre_forum_postcomment || pre_forum_postlog || pre_forum_poststick || pre_forum_promotion || pre_forum_ratelog || pre_forum_relatedthread || pre_forum_replycredit || pre_forum_rsscache || pre_forum_spacecache || pre_forum_statlog || pre_forum_thread || pre_forum_thread_moderate || pre_forum_threadaddviews || pre_forum_threadclass || pre_forum_threadclosed || pre_forum_threaddisablepos || pre_forum_threadimage || pre_forum_threadlog || pre_forum_threadmod || pre_forum_threadpartake || pre_forum_threadpreview || pre_forum_threadrush || pre_forum_threadtype || pre_forum_trade || pre_forum_tradecomment || pre_forum_tradelog || pre_forum_typeoption || pre_forum_typeoptionvar || pre_forum_typevar || pre_forum_warning || pre_home_album || pre_home_album_category || pre_home_appcreditlog || pre_home_blacklist || pre_home_blog || pre_home_blog_category || pre_home_blog_moderate || pre_home_blogfield || pre_home_class || pre_home_click || pre_home_clickuser || pre_home_comment || pre_home_comment_moderate || pre_home_docomment || pre_home_doing || pre_home_doing_moderate || pre_home_favorite || pre_home_feed || pre_home_feed_app || pre_home_follow || pre_home_follow_feed || pre_home_follow_feed_archiver || pre_home_friend || pre_home_friend_request || pre_home_friendlog || pre_home_notification || pre_home_pic || pre_home_pic_moderate || pre_home_picfield || pre_home_poke || pre_home_pokearchive || pre_home_share || pre_home_share_moderate || pre_home_show || pre_home_specialuser || pre_home_userapp || pre_home_userappfield || pre_home_visitor || pre_mobile_setting || pre_portal_article_content || pre_portal_article_count || pre_portal_article_moderate || pre_portal_article_related || pre_portal_article_title || pre_portal_article_trash || pre_portal_attachment || pre_portal_category || pre_portal_category_permission || pre_portal_comment || pre_portal_comment_moderate || pre_portal_rsscache || pre_portal_topic || pre_portal_topic_pic || pre_security_evilpost || pre_security_eviluser || pre_security_failedlog || pre_ucenter_admins || pre_ucenter_applications || pre_ucenter_badwords || pre_ucenter_domains || pre_ucenter_failedlogins || pre_ucenter_feeds || pre_ucenter_friends || pre_ucenter_mailqueue || pre_ucenter_memberfields || pre_ucenter_members || pre_ucenter_mergemembers || pre_ucenter_newpm || pre_ucenter_notelist || pre_ucenter_pm_indexes || pre_ucenter_pm_lists || pre_ucenter_pm_members || pre_ucenter_pm_messages_0 || pre_ucenter_pm_messages_1 || pre_ucenter_pm_messages_2 || pre_ucenter_pm_messages_3 || pre_ucenter_pm_messages_4 || pre_ucenter_pm_messages_5 || pre_ucenter_pm_messages_6 || pre_ucenter_pm_messages_7 || pre_ucenter_pm_messages_8 || pre_ucenter_pm_messages_9 || pre_ucenter_protectedmembers || pre_ucenter_settings || pre_ucenter_sqlcache || pre_ucenter_tags || pre_ucenter_vars || sglj_charge || sglj_coin || sglj_extension |+-----------------------------------+
有几个几十万的 由于时间原因 只跑了一个
Database: 5ebo_www+----------------------------+---------+| Table | Entries |+----------------------------+---------+| v9_sso_members | 230299 || v9_member | 230205 || v9_sso_messagequeue | 145306 || v9_found_pass_view | 142519 || v9_member_detail | 142519 || v9_game_code | 105925 || v9_user_code_view | 90917 || v9_activity_role_level | 76843 || v9_media_page_detail | 32460 || v9_log | 19718 || v9_pay_account | 8811 || v9_media_bar_ip_library | 6712 || v9_pay_spend | 6494 || v9_dl_reg_return_view | 5057 || v9_linkage | 3284 || v9_media_page_total_detail | 1421 || v9_attachment | 962 || v9_attachment_index | 853 || v9_keyword_data | 560 || v9_menu | 358 || v9_category_priv | 354 || v9_search | 294 || v9_admin_role_priv | 280 || media_access | 272 || v9_hits | 268 || v9_news_dl | 246 || v9_news_dl_data | 246 || v9_keyword | 244 || v9_model_field | 232 || v9_game_time_view | 155 || v9_pay_spend_total | 140 || v9_media_yy_overall_data | 124 || media_node | 123 || v9_game_login_view | 107 || v9_member_login | 107 || v9_member_total | 77 || v9_pay_statistics | 73 || v9_category | 56 || v9_media_yy_main_date | 56 || v9_cache | 36 || media_role_user | 31 || v9_media_page | 29 || v9_module | 29 || v9_media | 26 || v9_media_partners | 26 || v9_poster_201404 | 21 || v9_news | 20 || v9_news_data | 20 || media_user | 19 || v9_dlbbs_news | 15 || v9_dlbbs_news_data | 15 || v9_dl_patch | 14 || v9_dl_patch_data | 14 || v9_game_card | 14 || media_role | 12 || v9_media_anomalydata | 12 || v9_position | 12 || v9_game_card_view | 10 || v9_poster | 10 || v9_poster_space | 10 || v9_model | 9 || v9_admin_role | 8 || v9_position_data | 8 || v9_urlrule | 8 || v9_all_game_view | 7 || v9_member_group | 7 || v9_type | 7 || v9_admin | 5 || v9_games | 5 || v9_poster_201403 | 5 || v9_sso_settings | 5 || v9_poster_201405 | 4 || v9_workflow | 4 || v9_game_areas | 3 || v9_game_areas_view | 3 || v9_member_menu | 3 || v9_pay_payment | 3 || v9_site | 3 || v9_favorite | 2 || v9_link | 2 || v9_media_ad | 2 || v9_comment_setting | 1 || v9_comment_table | 1 || v9_extend_setting | 1 || v9_media_bar | 1 || v9_media_setting | 1 || v9_message | 1 || v9_sso_admin | 1 || v9_sso_applications | 1 || v9_wap | 1 |+----------------------------+---------+
危害等级：中
漏洞Rank：10
确认时间：2016-05-18 13:45
CNVD未直接复现所述情况，暂未建立与网站管理单位的直接处置渠道，待认领。
暂无
