酷我音乐一处SQL注入ROOT
漏洞标题 酷我音乐一处SQL注入ROOT 相关厂商 酷我音乐 漏洞作者 左手 提交时间 2016-04-27 10:02 公开时间 2016-06-16 19:40 漏洞类型 SQL注射漏洞 危害等级…
漏洞标题
将我的音乐冷却为SQL注入ROOT
相关制造商
kuwo音乐
漏洞作者
左手
提交时间
2016-04-27 10: 02
公共时间
2016-06-16 19: 40
漏洞类型
SQL注入漏洞
危险等级
高
自我评估等级
15
漏洞状态
制造商已确认
标签标签
漏洞详细信息
RT
漏洞证明：
两个问题：
http://cr.kuwo.cn/
1.弱密码测试/测试
2.注射
登录后，帐户被锁定，相关的div可以删除。
数据库:版权所有
[66表]
+ -------------------------------------------- +
|艺术家|
| Artist_Place_Distribution_201603 |
| Artist_Place_Distribution_201604 |
| Artist_Region_Distribution_201505 |
| Artist_Region_Distribution_201506 |
| Artist_Region_Distribution_201602 |
| Artist_Region_Distribution_201603 |
| Artist_Region_Distribution_201604 |
| Artist_Region_Distribution_City_201505 |
| Artist_Region_Distribution_City_201506 |
| Artist_Region_Distribution_City_201507 |
| Artist_Region_Distribution_City_201508 |
| Artist_Region_Distribution_City_201509 |
| Artist_Region_Distribution_City_201510 |
| Artist_Region_Distribution_City_201511 |
| Artist_Region_Distribution_City_201512 |
| Artist_Region_Distribution_City_201601 |
| Artist_Region_Distribution_City_201602 |
| Artist_Region_Distribution_City_201603 |
| Artist_Region_Distribution_City_201604 |
| Artist_Region_Distribution_County_201506 |
| Artist_Region_Distribution_County_201507 |
| Artist_Region_Distribution_County_201510 |
| Artist_Region_Distribution_County_201511 |
| Artist_Region_Distribution_County_201512 |
| Artist_Region_Distribution_County_201601 |
| Artist_Region_Distribution_County_201602 |
| Artist_Region_Distribution_County_201603 |
| Artist_Region_Distribution_County_201604 |
| Artist_Region_Distribution_Province_201505 |
| Artist_Region_Distribution_Province_201506 |
| Artist_Region_Distribution_Province_201507 |
| Artist_Region_Distribution_Province_201508 |
| Artist_Region_Distribution_Province_201509 |
| Artist_Region_Distribution_Province_201510 |
| Artist_Region_Distribution_Province_201511 |
| Artist_Region_Distribution_Province_201512 |
| Artist_Region_Distribution_Province_201601 |
| Artist_Region_Distribution_Province_201602 |
| Artist_Region_Distribution_Province_201603 |
| Artist_Region_Distribution_Province_201604 |
| Artist_Statistic_201506 |
| Artist_Zone_Distribution_201603 |
| Artist_Zone_Distribution_201604 |
|音乐|
|地区|
| RegionFactor |
| Region_Artist |
| Region_Song |
| Region_bak |
| SYS_Column |
| SYS_Group |
| SYS_Log |
| SYS_Module |
| SYS_Permission |
| SYS_Region |
| SYS_Regions |
| SYS_Role |
从对等方接收数据时失败
数据库:版权所有
[66表]
+ -------------------------------------------- +
|艺术家|
| Artist_Place_Distribution_201603 |
| Artist_Place_Distribution_201604 |
| Artist_Region_Distribution_201505 |
| Artist_Region_Distribution_201506 |
| Artist_Region_Distribution_201602 |
| Artist_Region_Distribution_201603 |
| Artist_Region_Distribution_201604 |
| Artist_Region_Distribution_City_201505 |
| Artist_Region_Distribution_City_201506 |
| Artist_Region_Distribution_City_201507 |
| Artist_Region_Distribution_City_201508 |
| Artist_Region_Distribution_City_201509 |
| Artist_Region_Distribution_City_201510 |
| Artist_Region_Distribution_City_201511 |
| Artist_Region_Distribution_City_201512 |
| Artist_Region_Distribution_City_201601 |
| Artist_Region_Distribution_City_201602 |
| Artist_Region_Distribution_City_201603 |
| Artist_Region_Distribution_City_201604 |
| Artist_Region_Distribution_County_201506 |
| Artist_Region_Distribution_County_201507 |
| Artist_Region_Distribution_County_201510 |
| Artist_Region_Distribution_County_201511 |
| Artist_Region_Distribution_County_201512 |
| Artist_Region_Distribution_County_201601 |
| Artist_Region_Distribution_County_201602 |
| Artist_Region_Distribution_County_201603 |
| Artist_Region_Distribution_County_201604 |
| Artist_Region_Distribution_Province_201505 |
| Artist_Region_Distribution_Province_201506 |
| Artist_Region_Distribution_Province_201507 |
| Artist_Region_Distribution_Province_201508 |
| Artist_Region_Distribution_Province_201509 |
| Artist_Region_Distribution_Province_201510 |
| Artist_Region_Distribution_Province_201511 |
| Artist_Region_Distribution_Province_201512 |
| Artist_Region_Distribution_Province_201601 |
| Artist_Region_Distribution_Province_201602 |
| Artist_Region_Distribution_Province_201603 |
| Artist_Region_Distribution_Province_201604 |
| Artist_Statistic_201506 |
| Artist_Zone_Distribution_201603 |
| Artist_Zone_Distribution_201604 |
|音乐|
|地区|
| RegionFactor |
| Region_Artist |
| Region_Song |
| Region_bak |
| SYS_Column |
| SYS_Group |
| SYS_Log |
| SYS_Module |
| SYS_Permission |
| SYS_Region |
| SYS_Regions |
| SYS_Role |
从对等方接收数据时失败
- 发表于 2016-07-17 08:00
- 阅读 ( 726 )
- 分类：黑客技术
