当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0115196

漏洞标题:p2p金融安全之爱钱进某漏洞(涉及数据配置信息)

相关厂商:iqianjin.com

漏洞作者: 李旭敏

提交时间:2015-05-20 18:16

修复时间:2015-07-04 23:18

公开时间:2015-07-04 23:18

漏洞类型:敏感信息泄露

危害等级:高

自评Rank:20

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-05-20: 细节已通知厂商并且等待厂商处理中
2015-05-20: 厂商已经确认,细节仅向厂商公开
2015-05-30: 细节向核心白帽子及相关领域专家公开
2015-06-09: 细节向普通白帽子公开
2015-06-19: 细节向实习白帽子公开
2015-07-04: 细节向公众公开

简要描述:

详细说明:

http://bbs.iqianjin.com/config/config_global.php.bak

漏洞证明:

$_config = array();
// ---------------------------- CONFIG DB ----------------------------- //
$_config[\'db\'][\'1\'][\'dbhost\'] = \'192.168.100.13\';
$_config[\'db\'][\'1\'][\'dbuser\'] = \'iqianjin_bbs\';
$_config[\'db\'][\'1\'][\'dbpw\'] = \'Ke83HsLH\';
$_config[\'db\'][\'1\'][\'dbcharset\'] = \'utf8\';
$_config[\'db\'][\'1\'][\'pconnect\'] = \'0\';
$_config[\'db\'][\'1\'][\'dbname\'] = \'bbs\';
$_config[\'db\'][\'1\'][\'tablepre\'] = \'pre_\';
$_config[\'db\'][\'slave\'] = \'\';
$_config[\'db\'][\'common\'][\'slave_except_table\'] = \'\';
// -------------------------- CONFIG MEMORY --------------------------- //
$_config[\'memory\'][\'prefix\'] = \'GGMjSj_\';
$_config[\'memory\'][\'redis\'][\'server\'] = \'\';
$_config[\'memory\'][\'redis\'][\'port\'] = 6379;
$_config[\'memory\'][\'redis\'][\'pconnect\'] = 1;
$_config[\'memory\'][\'redis\'][\'timeout\'] = \'0\';
$_config[\'memory\'][\'redis\'][\'requirepass\'] = \'\';
$_config[\'memory\'][\'redis\'][\'serializer\'] = 1;
$_config[\'memory\'][\'memcache\'][\'server\'] = \'\';
$_config[\'memory\'][\'memcache\'][\'port\'] = 11211;
$_config[\'memory\'][\'memcache\'][\'pconnect\'] = 1;
$_config[\'memory\'][\'memcache\'][\'timeout\'] = 1;
$_config[\'memory\'][\'apc\'] = 1;
$_config[\'memory\'][\'xcache\'] = 1;
$_config[\'memory\'][\'eaccelerator\'] = 1;
$_config[\'memory\'][\'wincache\'] = 1;
// -------------------------- CONFIG SERVER --------------------------- //
$_config[\'server\'][\'id\'] = 1;
// ------------------------- CONFIG DOWNLOAD -------------------------- //
$_config[\'download\'][\'readmod\'] = 2;
$_config[\'download\'][\'xsendfile\'][\'type\'] = \'0\';
$_config[\'download\'][\'xsendfile\'][\'dir\'] = \'/down/\';
// -------------------------- CONFIG OUTPUT --------------------------- //
$_config[\'output\'][\'charset\'] = \'utf-8\';
$_config[\'output\'][\'forceheader\'] = 1;
$_config[\'output\'][\'gzip\'] = \'0\';
$_config[\'output\'][\'tplrefresh\'] = 1;
$_config[\'output\'][\'language\'] = \'zh_cn\';
$_config[\'output\'][\'staticurl\'] = \'static/\';
$_config[\'output\'][\'ajaxvalidate\'] = \'0\';
$_config[\'output\'][\'iecompatible\'] = \'0\';
// -------------------------- CONFIG COOKIE --------------------------- //
$_config[\'cookie\'][\'cookiepre\'] = \'Cbq6_\';
$_config[\'cookie\'][\'cookiedomain\'] = \'\';
$_config[\'cookie\'][\'cookiepath\'] = \'/\';
// ------------------------- CONFIG SECURITY -------------------------- //
$_config[\'security\'][\'authkey\'] = \'1072a8mBp4McSNqB\';
$_config[\'security\'][\'urlxssdefend\'] = 1;
$_config[\'security\'][\'attackevasive\'] = \'0\';
$_config[\'security\'][\'querysafe\'][\'status\'] = 1;
$_config[\'security\'][\'querysafe\'][\'dfunction\'][\'0\'] = \'load_file\';
$_config[\'security\'][\'querysafe\'][\'dfunction\'][\'1\'] = \'hex\';
$_config[\'security\'][\'querysafe\'][\'dfunction\'][\'2\'] = \'substring\';
$_config[\'security\'][\'querysafe\'][\'dfunction\'][\'3\'] = \'if\';
$_config[\'security\'][\'querysafe\'][\'dfunction\'][\'4\'] = \'ord\';
$_config[\'security\'][\'querysafe\'][\'dfunction\'][\'5\'] = \'char\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'0\'] = \'@\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'1\'] = \'intooutfile\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'2\'] = \'intodumpfile\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'3\'] = \'unionselect\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'4\'] = \'(select\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'5\'] = \'unionall\';
$_config[\'security\'][\'querysafe\'][\'daction\'][\'6\'] = \'uniondistinct\';
$_config[\'security\'][\'querysafe\'][\'dnote\'][\'0\'] = \'/*\';
$_config[\'security\'][\'querysafe\'][\'dnote\'][\'1\'] = \'*/\';
$_config[\'security\'][\'querysafe\'][\'dnote\'][\'2\'] = \'#\';
$_config[\'security\'][\'querysafe\'][\'dnote\'][\'3\'] = \'--\';
$_config[\'security\'][\'querysafe\'][\'dnote\'][\'4\'] = \'\"\';
$_config[\'security\'][\'querysafe\'][\'dlikehex\'] = 1;
$_config[\'security\'][\'querysafe\'][\'afullnote\'] = \'0\';
// -------------------------- CONFIG ADMINCP -------------------------- //
// -------- Founders: $_config[\'admincp\'][\'founder\'] = \'1,2,3\'; --------- //
$_config[\'admincp\'][\'founder\'] = \'1\';
$_config[\'admincp\'][\'forcesecques\'] = \'0\';
$_config[\'admincp\'][\'checkip\'] = 1;
$_config[\'admincp\'][\'runquery\'] = \'0\';
$_config[\'admincp\'][\'dbimport\'] = 1;
// -------------------------- CONFIG REMOTE --------------------------- //
$_config[\'remote\'][\'on\'] = \'0\';
$_config[\'remote\'][\'dir\'] = \'remote\';
$_config[\'remote\'][\'appkey\'] = \'62cf0b3c3e6a4c9468e7216839721d8e\';
$_config[\'remote\'][\'cron\'] = \'0\';
// --------------------------- CONFIG INPUT --------------------------- //
$_config[\'input\'][\'compatible\'] = 1;
// ------------------- THE END -------------------- //
?> <br>网址:http://bbs.iqianjin.com/uc_server/data/config.inc.php.bak <br> 内容:<?php
define(\'UC_DBHOST\', \'192.168.100.13\');
define(\'UC_DBUSER\', \'iqianjin_bbs\');
define(\'UC_DBPW\', \'Ke83HsLH\');
define(\'UC_DBNAME\', \'bbs\');
define(\'UC_DBCHARSET\', \'utf8\');
define(\'UC_DBTABLEPRE\', \'pre_ucenter_\');
define(\'UC_COOKIEPATH\', \'/\');
define(\'UC_COOKIEDOMAIN\', \'\');
define(\'UC_DBCONNECT\', 0);
define(\'UC_CHARSET\', \'utf-8\');
define(\'UC_FOUNDERPW\', \'ef8b55f6a426165d20e4b9c8891862e0\');
define(\'UC_FOUNDERSALT\', \'7cP4T5\');
define(\'UC_KEY\', \'WcC455N1zbS0deb8kcd7BbH96fk16dyfj7Yby1P5i1u849y4I2M1A8Y4v6bbKfCb\');
define(\'UC_SITEID\', \'VcE4M521LbV0SeE8icb7bbN91fS1cd6f27TbN1P5M1586984m2r1p8H476gbsfDb\');
define(\'UC_MYKEY\', \'ucI4S581ab00Heg8Tcr7fbi9cfe1cdLfc7QbY1i5Z1F8j9d4v2R118N4h6Nbefab\');
define(\'UC_DEBUG\', false);
define(\'UC_PPP\', 20);
<br>

修复方案:

可有礼物?

版权声明:转载请注明来源 李旭敏@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:3

确认时间:2015-05-20 23:16

厂商回复:

论坛数据库早已迁移,是一个很久的备份文件,无使用价值,但确实不应该以这种形式备份文件,感谢提醒

最新状态:

暂无