记录黑客技术中优秀的内容,传播黑客文化,分享黑客技术精华

某安卓市场论坛注入导致百万用户信息泄露

2014-12-03 00:16

http://www.nduoa.com/message/noticeDetail?id=30

居然有这么赤果果的注入

漏洞证明:

123.jpg





code 区域
| cpa_install_log_2012               |

| cpa_install_log_2013 |

| cpa_install_log_20140328 |

| cpa_install_log_temp |

| cpa_settle_results |

| cpa_settle_results_back20140421 |

| cpd_download_log_201310 |

| cpd_download_log_201311 |

| cpd_download_log_201312 |

| cpd_download_log_201401 |

| cpd_download_log_201402 |

| cpd_download_log_201403 |

| cpd_download_log_201404 |

| cpd_download_log_201405 |

| cpd_download_log_201406 |

| cpd_download_log_201407 |

| cpd_download_log_201408 |

| cpd_download_log_201409 |

| cpd_download_log_201410 |

| cpd_download_log_201411 |

| cps_download_jingwu |

| cps_settle_detail |

| cps_settle_typein |

| cps_trade_log |

| crawl_package |

| crawl_package_info |

| crawl_package_version |

| crawl_resource_queue |

| crawl_site |

| htc_push |

| ma_activity |

| ma_activity_comment |

| ma_activity_pack |

| ma_activity_prize |

| ma_ad |

| ma_ad_new |

| ma_ad_setting |

| ma_adv |

| ma_adv_space |

| ma_adver |

| ma_adver_space |

| ma_adview_push_apks |

| ma_apk_download_backup |

| ma_apk_translation |

| ma_arch_using |

| ma_archive |

| ma_authorization |

| ma_authorization_package |

| ma_authorized |

| ma_bot_app |

| ma_bot_app_log |

| ma_business_app_price |

| ma_category |

| ma_category_mapping |

| ma_check_result |

| ma_check_result_360 |

| ma_check_result_jingwu_20141117 |

| ma_check_result_jinshan |

| ma_claim |

| ma_class |

| ma_class_mapped |

| ma_clients_bookmark |

| ma_clients_category |

| ma_clients_mobile |

| ma_clients_package |

| ma_clients_recommend |

| ma_clients_soft |

| ma_clients_user |

| ma_comment |

| ma_comment_badword |

| ma_comment_banip |

| ma_commenting |

| ma_commenting_20140630 |

| ma_commenting_20140704_audit |

| ma_commenting__bak_20140630 |

| ma_commenting_bk |

| ma_commenting_id_20140630 |

| ma_company_developer |

| ma_developer |

| ma_dict |

| ma_dl_aggregate_daily |

| ma_dl_aggregate_monthly |

| ma_dl_aggregate_weekly |

| ma_dl_stats |

| ma_dl_stats_bk |

| ma_dl_stats_bk_20140822 |

| ma_dl_stats_temp |

| ma_down_split |

| ma_game_block |

| ma_gather_custom_installed_package |

| ma_global_area |

| ma_guess_recommend |

| ma_hot_game |

| ma_hot_keywords |

| ma_hot_keywords_soft |

| ma_image_block |

| ma_individual_developer |

| ma_language_taxonomy |

| ma_localized_download |

| ma_login_log_count |

| ma_m_search |

| ma_m_visit |

| ma_mail |

| ma_market_feature |

| ma_medal |

| ma_members |

| ma_message |

| ma_messaging |

| ma_meta_factor |

| ma_mobile |

| ma_mobile_hardware |

| ma_moto_soft |

| ma_moto_soft_extra |

| ma_moto_soft_log |

| ma_netqin_detection |

| ma_notice |

| ma_notice_user_log |

| ma_notification |

| ma_pa_soft_interim |

| ma_package |

| ma_package_category |

| ma_package_category_update |

| ma_package_gift |

| ma_package_gift_code |

| ma_package_grade |

| ma_package_grade_bk |

| ma_package_lang |

| ma_package_recommend |

| ma_package_tag |

| ma_package_version_extra |

| ma_package_version_lang |

| ma_package_version_list |

| ma_package_version_patch |

| ma_package_version_patch_20130823 |

| ma_partner_package_category |

| ma_partner_soft |

| ma_partner_user |

| ma_pc_poster |

| ma_pkg_hit |

| ma_pkg_rank |

| ma_popular_top |

| ma_poster |

| ma_push_games |

| ma_push_soft |

| ma_qq_check_result |

| ma_rank_daily |

| ma_rank_monthly |

| ma_rank_weekly |

| ma_rating |

| ma_rec360_tmp |

| ma_recommend |

| ma_refuse_reason |

| ma_reg_log_count |

| ma_report |

| ma_rom |

| ma_rom_brand |

| ma_rom_comment |

| ma_rom_device |

| ma_rom_download_link |

| ma_rom_report |

| ma_sdk_download_app_logs |

| ma_sdk_download_log |

| ma_sdk_downlog |

| ma_sdk_info |

| ma_sdk_integral_apklist |

| ma_search_additional |

| ma_search_pinyin |

| ma_search_setting |

| ma_section |

| ma_soft |

| ma_soft_authorized |

| ma_soft_blacklist |

| ma_soft_copyright |

| ma_soft_extra |

| ma_soft_factor_matching |

| ma_soft_fields |

| ma_soft_hit |

| ma_soft_medal |

| ma_soft_recommend |

| ma_soft_request_ownership |

| ma_soft_sdkpay |

| ma_soft_sdkpay_contract |

| ma_soft_sdkpay_contract_logs |

| ma_soft_sdkpay_contract_uploads |

| ma_special |

| ma_special_softlist |

| ma_splash |

| ma_store_goods |

| ma_store_order |

| ma_store_order_goods |

| ma_subject_push |

| ma_sync |

| ma_sync_list |

| ma_sync_log |

| ma_tag_category_count |

| ma_tag_package |

| ma_term_taxonomy |

| ma_terms |

| ma_tokens |

| ma_trend_checking |

| ma_trend_detection |

| ma_trend_detection_jingwu_20141117 |

| ma_uninstall |

| ma_unpublish_game_white |

| ma_user |

| ma_user_20140515mobile |

| ma_user_backup_packages |

| ma_user_bao |

| ma_user_bao_bphistory |

| ma_user_bao_code |

| ma_user_bao_cpa |

| ma_user_bao_downs |

| ma_user_bao_message_content |

| ma_user_bao_message_user |

| ma_user_bao_ms |

| ma_user_bao_pn |

| ma_user_bao_settle_apply |

| ma_user_email_debug |

| ma_user_email_tester |

| ma_user_external |

| ma_user_external_jingwu_20140522 |

| ma_user_favor |

| ma_user_financial_information |

| ma_user_last_action |

| ma_user_newfav |

| ma_user_profile |

| ma_user_rom |

| ma_user_rom_applymoney |

| ma_user_rom_settle_log |

| ma_user_setting |

| ma_user_superstars |

| ma_user_task |

| ma_user_task_gift |

| ma_user_task_result |

| ma_user_tester |

| ma_web_hotwords |

| ma_web_search_log |

| ma_zhuixin |

| masterkey |

| mf_banner |

| mobfond_client |

| pa_partner |

| partner |

| pc_biggame_vote |

| pc_brand |

| pc_client_log |

| pc_device |

| pc_driver |

| pc_help |

| pc_manufacturer |

| pc_mobilephoneimg |

| pc_nomodel |

| pc_poster |

| pc_poster_client |

| register_settle |

| rom |

| rom_brand |

| rom_cpa |

| rom_cpa_user |

| rom_dev_user |

| rom_download_count |

| rom_download_count_by_rom |

| rom_faq |

| rom_hot_model |

| rom_hot_model_v |

| rom_index_banner |

| rom_model |

| rom_post |

| rom_preinstalled_apk |

| rom_recomm |

| rom_referral |

| rom_refuse_reason |

| rom_settle |

| rom_settle_apply |

| rom_settle_month |

| rom_settle_refuse_money |

| rom_tool |

| rom_tutorial |

| rom_upload_user |

| rom_xml |

| tmp_download_hour_2014080109 |

| tmp_download_hour_2014080110 |

| tmp_download_hour_2014080112 |

| tmp_download_hour_2014080115 |

| tmp_online_pkg_factor |

| tmp_online_soft_factor |

| tmp_pkg_factor |

| tmp_soft_factor |

| tmp_test |

| vb_interface_log |

| vb_user_meta |

+------------------------------------+

修复方案:

x


知识来源: www.wooyun.org/bugs/wooyun-2014-084841

阅读:136653 | 评论:0 | 标签:注入

想收藏或者和大家分享这篇好文章→复制链接地址

“某安卓市场论坛注入导致百万用户信息泄露”共有0条留言

发表评论

姓名:

邮箱:

网址:

验证码:

ADS

标签云