{"id":70,"date":"2018-11-28T15:33:06","date_gmt":"2018-11-28T15:33:06","guid":{"rendered":"https:\/\/blog.rubiya.kr\/?p=70"},"modified":"2018-11-28T15:33:06","modified_gmt":"2018-11-28T15:33:06","slug":"wechall-net-logical-bug","status":"publish","type":"post","link":"https:\/\/blog.rubiya.kr\/index.php\/2018\/11\/28\/wechall-net-logical-bug\/","title":{"rendered":"wechall.net logical bug"},"content":{"rendered":"

wechall.net\uc740 \ub9ce\uc740 \uc6cc\uac8c\uc784\ub4e4\uc744 \uc5f0\ub3d9\uc2dc\ucf1c\uc11c \uc810\uc218\ub97c \ucd94\ud569\ud574 \uc21c\uc704\ub97c \ub9e4\uaca8\uc8fc\ub294 \uc0ac\uc774\ud2b8\uc774\ub2e4.<\/p>\n

\uc5f0\ub3d9\uc744 \uc704\ud574\uc11c\ub294 wechall.net \uc11c\ubc84\uc5d0\uc11c \uac01 \uc6cc\uac8c\uc784\uc758 \uc720\uc800\uc758 \uc810\uc218\ub97c \uc54c \uc218 \uc788\uc5b4\uc57c \ud55c\ub2e4.<\/p>\n

\uadf8\ub54c\ubb38\uc5d0 \uc5f0\ub3d9\ud560 \uc6cc\uac8c\uc784\uc5d0\uc11c\ub294 userscore.php \ub77c\ub294 \ud30c\uc77c\uc744 \ub9cc\ub4e4\uace0, wechall.net \uc11c\ubc84\uc5d0\uc11c \uc624\ub294 \uc694\uccad\uc5d0 \uc751\ub2f5\ud558\ub294 \ucf54\ub4dc\ub97c \ub123\ub294\ub2e4.<\/p>\n

\uc608\ub97c\ub4e4\uc790\uba74 webhacking.kr \uc774\ub77c\ub294 \uc6cc\uac8c\uc784\uc758 rubiya \/ rubiya805@gmail.com \uacc4\uc815\uc744 wechall.net\uc5d0 \ub4f1\ub85d\ud558\ub824 \ud560 \uacbd\uc6b0\uc5d0 \uc544\ub798\uc640 \uac19\uc740 \uc21c\uc11c\ub97c \uac70\uce5c\ub2e4.<\/p>\n

1. \ub0b4\uac00 wechall.net\uc5d0 webhacking.kr \/ rubiya \/ rubiya805@gmail.com \ub77c\ub294 \uc815\ubcf4\ub97c request \ud558\uba74
\n2. wechall.net\uc758 \uc11c\ubc84\uc5d0\uc11c http:\/\/webhacking.kr\/userscore.php \uc5d0\uac8c rubiya \/ rubiya805@gmail.com \uc774\ub77c\ub294 \ud68c\uc6d0\uc774 \uc788\ub294\uc9c0 \uc54c\ub824\ub2ec\ub77c\uace0 \uc694\uccad\ud558\uace0
\n3. webhacking.kr\uc758 \uc11c\ubc84\ub294 \ud574\ub2f9 \uc815\ubcf4\ub97c \ucc3e\uc544\uc11c \uc874\uc7ac\ud558\uba74 \uadf8 \ud68c\uc6d0\uc758 \uc810\uc218\ub97c \uc751\ub2f5\ud55c\ub2e4.<\/p>\n

\ub0b4\uac00 \uc9c0\uae08\uae4c\uc9c0 \ubcf8 \ubaa8\ub4e0 \uc6cc\uac8c\uc784\uc740 \ud68c\uc6d0\uc815\ubcf4\ub97c \uad00\ub9ac\ud558\uae30 \uc704\ud574\uc11c mysql, mssql\ub4f1\uc758 dbms\ub97c \uc0ac\uc6a9\ud588\ub294\ub370, \uc774 dbms\ub4e4\uc740 \ub300\uc18c\ubb38\uc790\ub97c \uad6c\ubd84\ud558\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n

\uc608\ub97c\ub4e4\uc5b4, mysql\uc744 \uc0ac\uc6a9\ud558\ub294 webhacking.kr \uc5d0\uc11c rubiya \uc640 RUBIYA\ub294 \uac19\uc740 \ud68c\uc6d0\uc774\ub2e4.<\/p>\n

\uadf8\ub7ec\ub098 wechall.net \uc5d0\uc11c\ub294 \ub300\uc18c\ubb38\uc790\uc5d0 \uad00\ud55c \uc774\uc288\ub97c \uc81c\ub300\ub85c \ucc98\ub9ac\ud558\uc9c0 \ubabb\ud588\uace0, \uc800 \ub450\uac1c\ub97c \ub2e4\ub978 \ud68c\uc6d0\uc73c\ub85c \uad6c\ubd84\ud588\ub2e4.<\/p>\n

wechall.net \uc740 \ud55c \uacc4\uc815\ub2f9 \ud55c \uc0ac\uc6a9\uc790\ub9cc \uc5f0\ub3d9\uc774 \uac00\ub2a5\ud558\ub3c4\ub85d \ub418\uc5b4\uc788\ub294\ub370 \uc704\uc758 \uc774\uc720\ub85c \ud574\ub2f9 \ub85c\uc9c1\uc744 \uc6b0\ud68c\ud560 \uc218 \uc788\ub2e4.<\/p>\n

\ubaa8 \uc6cc\uac8c\uc784\uc744 \uc774 \ucde8\uc57d\uc810\uc744 \uc0ac\uc6a9\ud574\uc11c \uc62c\ud074\ub9ac\uc5b4\ub85c \ub9cc\ub4e4 \uc218 \uc788\uc5c8\ub2e4.<\/p>\n

\uacfc\uc815\uc740 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n

1. A\uc6cc\uac8c\uc784\uc758 \uc62c\ud074\ub9ac\uc5b4 \uacc4\uc815\ub4e4\uc758 \ud328\uc2a4\uc6cc\ub4dc\ub97c \uac8c\uc2f1\ud574\uc11c “abc”\ub77c\ub294 \uacc4\uc815\uc744 \uc5bb\uc5c8\ub2e4.
\n2. \uadf8\ub7ec\ub098 \ub0b4\uac00 \ucc3e\uc544\ub0b8 \uacc4\uc815\uc740 \uc774\ubbf8 wechall.net\uc5d0\uc11c \ub2e4\ub978 \uc0ac\uc6a9\uc790\uac00 \uc5f0\ub3d9\ud55c \uacc4\uc815\uc774\ub2e4.
\n3. \ub300\ubb38\uc790\ub97c \uc0ac\uc6a9\ud574\uc11c “ABC” \uacc4\uc815\uc758 \uc5f0\ub3d9\uc744 \uc2dc\ub3c4\ud588\ub2e4.
\n4. wechall.net \uc5d0\uc11c\ub294 A\uc6cc\uac8c\uc784\uc758 \uc11c\ubc84\uc5d0 “ABC” \ub77c\ub294 \uacc4\uc815\uc774 \uc788\ub294\uc9c0 \uc54c\ub824\ub2ec\ub77c\uace0 \uc694\uccad\ud588\ub2e4.
\n5. A\uc6cc\uac8c\uc784 \uc5d0\uc11c\ub294 “ABC” = “abc” \uc774\ubbc0\ub85c \uadf8\ub7f0 \uacc4\uc815\uc774 \uc874\uc7ac\ud558\uba70, \uadf8 \uacc4\uc815\uc740 A\uc6cc\uac8c\uc784\uc758 \ubaa8\ub4e0 \ubb38\uc81c\ub97c \ud480\uc5c8\ub2e4\uace0 \uc751\ub2f5\ud588\ub2e4.
\n6. wechall.net \uc5d0\uc11c\ub294 “ABC”\ub77c\ub294 \uacc4\uc815\uc774 \uc5f0\ub3d9\ub41c\uc801\uc774 \uc5c6\uc73c\ubbc0\ub85c \uc815\uc0c1\uc801\uc73c\ub85c \uc5f0\ub3d9\uc774 \ub418\uc5c8\ub2e4.<\/p>\n

\uc774 \uacbd\uc6b0\uc5d0 wechall.net \uc5d0\uc11c\ub294 \uc6cc\uac8c\uc784\uc758 userscore.php \ud30c\uc77c\uc774 \ub300\uc18c\ubb38\uc790\ub97c \uad6c\ubd84\ud558\ub3c4\ub85d \ud574\ub2ec\ub77c\uace0 \uba85\uc2dc\ud558\uac70\ub098,
\nwechall.net \uc758 \ucf54\ub4dc\uac00 \uacc4\uc815\uc758 \ub300\uc18c\ubb38\uc790\ub97c \uad6c\ubd84\ud558\uc9c0 \uc54a\ub3c4\ub85d \uc218\uc815\ud574\uc11c \ub300\uc18c\ubb38\uc790\uc5d0 \ub300\ud55c \uc815\ucc45\uc744 \ud1b5\uc77c\ud574\uc57c\ud55c\ub2e4.<\/p>\n

\uc5f0\ub3d9\ub41c \uc0ac\uc774\ud2b8\uc758 \uc11c\ub85c \ub2e4\ub978 \uc815\ucc45\ud0d3\uc5d0 \ubc1c\uc0dd\ud558\ub294 \ub85c\uc9c1\uc0c1\uc758 \ucde8\uc57d\uc810\uc774\ub2e4.<\/p>\n

Also ensure that you do case-sensitive checks to avoid potential exploitation.<\/p>\n

\ud655\uc778\ud574\ubcf4\ub2c8 join us \uba54\ub274\uc5d0 \uc694 \uc904\uc774 \ucd94\uac00\ub418\uc5c8\ub2e4.<\/p>\n","protected":false},"excerpt":{"rendered":"

wechall.net\uc740 \ub9ce\uc740 \uc6cc\uac8c\uc784\ub4e4\uc744 \uc5f0\ub3d9\uc2dc\ucf1c\uc11c \uc810\uc218\ub97c \ucd94\ud569\ud574 \uc21c\uc704\ub97c \ub9e4\uaca8\uc8fc\ub294 \uc0ac\uc774\ud2b8\uc774\ub2e4. \uc5f0\ub3d9\uc744 \uc704\ud574\uc11c\ub294 wechall.net \uc11c\ubc84\uc5d0\uc11c \uac01 \uc6cc\uac8c\uc784\uc758 \uc720\uc800\uc758 \uc810\uc218\ub97c \uc54c \uc218 \uc788\uc5b4\uc57c \ud55c\ub2e4. \uadf8\ub54c\ubb38\uc5d0 \uc5f0\ub3d9\ud560 \uc6cc\uac8c\uc784\uc5d0\uc11c\ub294 userscore.php \ub77c\ub294 \ud30c\uc77c\uc744 \ub9cc\ub4e4\uace0, wechall.net \uc11c\ubc84\uc5d0\uc11c \uc624\ub294 \uc694\uccad\uc5d0 \uc751\ub2f5\ud558\ub294 \ucf54\ub4dc\ub97c \ub123\ub294\ub2e4. \uc608\ub97c\ub4e4\uc790\uba74 webhacking.kr \uc774\ub77c\ub294 \uc6cc\uac8c\uc784\uc758 rubiya \/ rubiya805@gmail.com \uacc4\uc815\uc744 wechall.net\uc5d0 \ub4f1\ub85d\ud558\ub824 \ud560 \uacbd\uc6b0\uc5d0 \uc544\ub798\uc640 \uac19\uc740 \uc21c\uc11c\ub97c \uac70\uce5c\ub2e4. 1. \ub0b4\uac00 wechall.net\uc5d0 webhacking.kr \/ rubiya \/ rubiya805@gmail.com \ub77c\ub294 \uc815\ubcf4\ub97c request \ud558\uba74 2. wechall.net\uc758 \uc11c\ubc84\uc5d0\uc11c http:\/\/webhacking.kr\/userscore.php \uc5d0\uac8c rubiya \/ rubiya805@gmail.com \uc774\ub77c\ub294 \ud68c\uc6d0\uc774 \uc788\ub294\uc9c0 \uc54c\ub824\ub2ec\ub77c\uace0 \uc694\uccad\ud558\uace0 3. webhacking.kr\uc758 \uc11c\ubc84\ub294 \ud574\ub2f9 \uc815\ubcf4\ub97c \ucc3e\uc544\uc11c \uc874\uc7ac\ud558\uba74 \uadf8 \ud68c\uc6d0\uc758 \uc810\uc218\ub97c \uc751\ub2f5\ud55c\ub2e4. \ub0b4\uac00 \uc9c0\uae08\uae4c\uc9c0 \ubcf8 \ubaa8\ub4e0 \uc6cc\uac8c\uc784\uc740 \ud68c\uc6d0\uc815\ubcf4\ub97c \uad00\ub9ac\ud558\uae30 \uc704\ud574\uc11c mysql, mssql\ub4f1\uc758 dbms\ub97c \uc0ac\uc6a9\ud588\ub294\ub370, \uc774 dbms\ub4e4\uc740 \ub300\uc18c\ubb38\uc790\ub97c \uad6c\ubd84\ud558\uc9c0 \uc54a\ub294\ub2e4. \uc608\ub97c\ub4e4\uc5b4, mysql\uc744 \uc0ac\uc6a9\ud558\ub294 webhacking.kr \uc5d0\uc11c rubiya \uc640 RUBIYA\ub294 \uac19\uc740 \ud68c\uc6d0\uc774\ub2e4. \uadf8\ub7ec\ub098 wechall.net \uc5d0\uc11c\ub294 \ub300\uc18c\ubb38\uc790\uc5d0 \uad00\ud55c \uc774\uc288\ub97c \uc81c\ub300\ub85c \ucc98\ub9ac\ud558\uc9c0 \ubabb\ud588\uace0, \uc800 \ub450\uac1c\ub97c \ub2e4\ub978 \ud68c\uc6d0\uc73c\ub85c \uad6c\ubd84\ud588\ub2e4. wechall.net \uc740 \ud55c \uacc4\uc815\ub2f9 \ud55c \uc0ac\uc6a9\uc790\ub9cc \uc5f0\ub3d9\uc774 \uac00\ub2a5\ud558\ub3c4\ub85d \ub418\uc5b4\uc788\ub294\ub370 \uc704\uc758 \uc774\uc720\ub85c \ud574\ub2f9 \ub85c\uc9c1\uc744 \uc6b0\ud68c\ud560 \uc218 \uc788\ub2e4. \ubaa8 \uc6cc\uac8c\uc784\uc744 \uc774 \ucde8\uc57d\uc810\uc744 \uc0ac\uc6a9\ud574\uc11c \uc62c\ud074\ub9ac\uc5b4\ub85c \ub9cc\ub4e4 \uc218 \uc788\uc5c8\ub2e4. \uacfc\uc815\uc740 \uc544\ub798\uc640 \uac19\ub2e4. 1. A\uc6cc\uac8c\uc784\uc758 \uc62c\ud074\ub9ac\uc5b4 \uacc4\uc815\ub4e4\uc758 \ud328\uc2a4\uc6cc\ub4dc\ub97c \uac8c\uc2f1\ud574\uc11c “abc”\ub77c\ub294 \uacc4\uc815\uc744 \uc5bb\uc5c8\ub2e4. 2. \uadf8\ub7ec\ub098 \ub0b4\uac00 \ucc3e\uc544\ub0b8 \uacc4\uc815\uc740 \uc774\ubbf8 wechall.net\uc5d0\uc11c \ub2e4\ub978 \uc0ac\uc6a9\uc790\uac00 \uc5f0\ub3d9\ud55c \uacc4\uc815\uc774\ub2e4. 3. \ub300\ubb38\uc790\ub97c \uc0ac\uc6a9\ud574\uc11c “ABC” \uacc4\uc815\uc758 \uc5f0\ub3d9\uc744 \uc2dc\ub3c4\ud588\ub2e4. 4. wechall.net \uc5d0\uc11c\ub294 A\uc6cc\uac8c\uc784\uc758 \uc11c\ubc84\uc5d0 “ABC” \ub77c\ub294 \uacc4\uc815\uc774 \uc788\ub294\uc9c0 \uc54c\ub824\ub2ec\ub77c\uace0 \uc694\uccad\ud588\ub2e4. 5. A\uc6cc\uac8c\uc784 \uc5d0\uc11c\ub294 “ABC” = “abc” \uc774\ubbc0\ub85c \uadf8\ub7f0 \uacc4\uc815\uc774 \uc874\uc7ac\ud558\uba70, \uadf8 \uacc4\uc815\uc740 A\uc6cc\uac8c\uc784\uc758 \ubaa8\ub4e0 \ubb38\uc81c\ub97c \ud480\uc5c8\ub2e4\uace0 \uc751\ub2f5\ud588\ub2e4. 6. wechall.net \uc5d0\uc11c\ub294 “ABC”\ub77c\ub294 \uacc4\uc815\uc774 \uc5f0\ub3d9\ub41c\uc801\uc774 \uc5c6\uc73c\ubbc0\ub85c \uc815\uc0c1\uc801\uc73c\ub85c \uc5f0\ub3d9\uc774 \ub418\uc5c8\ub2e4. \uc774 \uacbd\uc6b0\uc5d0 wechall.net \uc5d0\uc11c\ub294 \uc6cc\uac8c\uc784\uc758 userscore.php \ud30c\uc77c\uc774 \ub300\uc18c\ubb38\uc790\ub97c \uad6c\ubd84\ud558\ub3c4\ub85d \ud574\ub2ec\ub77c\uace0 \uba85\uc2dc\ud558\uac70\ub098, wechall.net \uc758 \ucf54\ub4dc\uac00 \uacc4\uc815\uc758 \ub300\uc18c\ubb38\uc790\ub97c \uad6c\ubd84\ud558\uc9c0 \uc54a\ub3c4\ub85d \uc218\uc815\ud574\uc11c \ub300\uc18c\ubb38\uc790\uc5d0 \ub300\ud55c \uc815\ucc45\uc744 \ud1b5\uc77c\ud574\uc57c\ud55c\ub2e4. \uc5f0\ub3d9\ub41c \uc0ac\uc774\ud2b8\uc758 \uc11c\ub85c \ub2e4\ub978 \uc815\ucc45\ud0d3\uc5d0 \ubc1c\uc0dd\ud558\ub294 \ub85c\uc9c1\uc0c1\uc758 \ucde8\uc57d\uc810\uc774\ub2e4. Also ensure that you do case-sensitive checks to avoid potential exploitation. \ud655\uc778\ud574\ubcf4\ub2c8 join us \uba54\ub274\uc5d0 \uc694 \uc904\uc774 \ucd94\uac00\ub418\uc5c8\ub2e4.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts\/70"}],"collection":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/comments?post=70"}],"version-history":[{"count":1,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts\/70\/revisions"}],"predecessor-version":[{"id":71,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/posts\/70\/revisions\/71"}],"wp:attachment":[{"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/media?parent=70"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/categories?post=70"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.rubiya.kr\/index.php\/wp-json\/wp\/v2\/tags?post=70"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}