当前位置：WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号：
wooyun-2013-027448
漏洞标题：
新浪的一些小的信息泄漏
相关厂商：
新浪
漏洞作者：
D＆G
提交时间：
2013-07-02 14:28
修复时间：
2013-08-16 14:29
公开时间：
2013-08-16 14:29
漏洞类型：
敏感信息泄露
危害等级：
低
自评Rank：
1
漏洞状态：
厂商已经确认
漏洞来源：
http://www.wooyun.org，如有疑问或需要帮助请联系 [email protected]
Tags标签：
无
分享漏洞：
4人收藏 收藏
分享漏洞：
>

漏洞详情

披露状态：

2013-07-02： 细节已通知厂商并且等待厂商处理中
2013-07-02： 厂商已经确认，细节仅向厂商公开
2013-07-12： 细节向核心白帽子及相关领域专家公开
2013-07-22： 细节向普通白帽子公开
2013-08-01： 细节向实习白帽子公开
2013-08-16： 细节向公众公开

简要描述：

小问题，有数据库密码，内网连不了。

详细说明：

http://survey.news.sina.com.cn/test.php
http://roll.2008.sina.com.cn/test.php
https://netlogin.sina.com.cn/
http://202.106.182.172/admin/blog/login.php 登录报错，

漏洞证明：

http://survey.news.sina.com.cn/test.php

Array
(
    [surveynewsgroup] => 1
    [SCRIPT_URL] => /test.php
    [SCRIPT_URI] => http://survey.news.sina.com.cn/test.php
    [SINASRV_GLOBAL_MEMCACHED_SERVERS] => 10.55.28.21:7691 10.55.28.22:7691 10.55.28.23:7691
    [SINASRV_MEMCACHED_SERVERS] => 10.55.28.21:7691 10.55.28.22:7691 10.55.28.23:7691
    [SINASRV_MEMCACHED_HOST] => 127.0.0.1
    [SINASRV_MEMCACHED_PORT] => 7600
    [SINASRV_DATA_DIST_SERVER] => wvfs2.mars.grid.sina.com.cn
    [SINASRV_DATA_DIST_PORT] => 8080
    [SINASRV_ZONE_IDC] => XD
    [SINASRV_ZONE_ISP] => CNC
    [SINASRV_ZONE_ID] => 010201
    [SINASRV_ROLE] => Web2
    [SINASRV_OUTIP] => 10.54.22.53
    [SINASRV_INTIP] => 10.55.22.53
    [SINASRV_TTF_PATH] => /usr/local/sinasrv2/lib/X11/fonts/TTF
    [SINASRV_WVFS_SERVERS] => wvfs2.mars.grid.sina.com.cn:8090 wvfs2.orion.grid.sina.com.cn:8090
    [SINASRV_RVFS_SERVERS] => rvfs2.mars.grid.sina.com.cn:80 rvfs2.orion.grid.sina.com.cn:80
    [SINASRV_CACHE_DOMAINS] => cache.mars.sina.com.cn cache.orion.sina.com.cn cache.aries.sina.com.cn cache.atlas.sina.com.cn
    [SQUID_PURGE_API] => http://10.73.48.209/squidclear/ http://10.44.6.245/squidclear/
    [SQUID_PURGE_ID] => dpool
    [SQUID_PURGE_PROJECT] => all
    [SQUID_PURGE_HOST] => www.sc.sina.com.cn
    [SINASRV_SQUID_PURGE_API] => http://10.73.48.209/squidclear/ http://10.44.6.245/squidclear/
    [SINASRV_SQUID_PURGE_ID] => dpool
    [SINASRV_SQUID_PURGE_PROJECT] => all
    [SINASRV_SQUID_PURGE_HOST] => www.sc.sina.com.cn
    [SINASRV_DPMAIL_HOST] => 10.44.6.21
    [SINASRV_DPMAIL_URL] => http://10.44.6.21/mailservice/api.php
    [SINASRV_COUNTER_SERVICE_MASTER] => counteri.mars.grid.sina.com.cn:8000
    [SINASRV_COUNTER_SERVICE_SLAVE] => 10.55.22.65:8000
    [SINASRV_COUNTER_SERVICE_RESTRICT] => 1
    [SINASRV_SIMPLEDB_SERVICE] => 1
    [SINASRV_SIMPLEDB_SERVICE_RESTRICT] => 1
    [SINASRV_VERSION] => 2
    [SERVER_ALIAS] => auto.survey.sina.com.cn news.survey.sina.com.cn finance.survey.sina.com.cn survey.2008.sina.com.cn survey.sports.sina.com.cn survey.ent.sina.com.cn survey.finance.sina.com.cn survey.tech.sina.com.cn survey.auto.sina.com.cn survey.eladies.sina.com.cn survey.baby.sina.com.cn survey.house.sina.com.cn survey.edu.sina.com.cn survey.book.sina.com.cn survey.astro.sina.com.cn survey.chinawriter.com.cn survey.2010.sina.com.cn i.survey.news.sina.com.cn survey.fo.sina.com.cn
    [SINASRV_DATA_DIR] => /data1/www/data/survey.news.sina.com.cn/
    [SINASRV_CACHE_DIR] => /data1/www/cache/survey.news.sina.com.cn/
    [SINASRV_PRIVDATA_DIR] => /data1/www/privdata/survey.news.sina.com.cn/
    [SINASRV_APPLOGS_DIR] => /data1/www/applogs/survey.news.sina.com.cn/
    [SINASRV_DATA_URL] => http://survey.news.sina.com.cn/data
    [SINASRV_CACHE_URL] => http://survey.news.sina.com.cn/cache
    [SINASRV_NDATA_CACHE_URL] => http://etch.s.dpool.sina.com.cn/nd/surveynews/
    [SINASRV_DB_HOST] => m3310i.mars.grid.sina.com.cn
    [SINASRV_DB_HOST_R] => s3310i.mars.grid.sina.com.cn
    [SINASRV_DB_PORT] => 3310
    [SINASRV_DB_NAME] => news_survey
    [SINASRV_DB_USER] => generalsurvey
    [SINASRV_DB_PASS] => AD8xckZDkj1ek
    [SINASRV_DB_PORT_R] => 3310
    [SINASRV_DB_NAME_R] => news_survey
    [SINASRV_DB_USER_R] => generalsurvey_r
    [SINASRV_DB_PASS_R] => Ck0a8Ldia!kdaj
    [SINASRV_DB2_HOST] => m3310i.mars.grid.sina.com.cn
    [SINASRV_DB2_HOST_R] => s3310i.mars.grid.sina.com.cn
    [SINASRV_DB2_PORT] => 3310
    [SINASRV_DB2_NAME] => news_survey_2
    [SINASRV_DB2_USER] => generalsurvey
    [SINASRV_DB2_PASS] => AD8xckZDkj1ek
    [SINASRV_DB2_PORT_R] => 3310
    [SINASRV_DB2_NAME_R] => news_survey_2
    [SINASRV_DB2_USER_R] => generalsurvey_r
    [SINASRV_DB2_PASS_R] => Ck0a8Ldia!kdaj
    [SINASRV_DB3_HOST] => m3310i.mars.grid.sina.com.cn
    [SINASRV_DB3_HOST_R] => s3310i.mars.grid.sina.com.cn
    [SINASRV_DB3_PORT] => 3310
    [SINASRV_DB3_NAME] => news_survey_3
    [SINASRV_DB3_USER] => generalsurvey
    [SINASRV_DB3_PASS] => AD8xckZDkj1ek
    [SINASRV_DB3_PORT_R] => 3310
    [SINASRV_DB3_NAME_R] => news_survey_3
    [SINASRV_DB3_USER_R] => generalsurvey_r
    [SINASRV_DB3_PASS_R] => Ck0a8Ldia!kdaj
    [SINASRV_MEMCACHED_KEY_PREFIX] => survey_news-
    [HTTP_HOST] => survey.news.sina.com.cn

修复方案：

不用的系统都下了吧。

版权声明：转载请注明来源 D＆G@乌云

>

漏洞回应

厂商回应：

危害等级：低

漏洞Rank：2

确认时间：2013-07-02 14:51

厂商回复：

感谢关注新浪安全，已安排人员进行处理。

最新状态：

暂无